diff --git a/urlhaus-filter-ag-online.txt b/urlhaus-filter-ag-online.txt index 346a3197..59146cc4 100644 --- a/urlhaus-filter-ag-online.txt +++ b/urlhaus-filter-ag-online.txt @@ -1,5 +1,5 @@ ! Title: Online Malicious URL Blocklist (AdGuard) -! Updated: Thu, 08 Apr 2021 00:12:42 UTC +! Updated: Thu, 08 Apr 2021 12:12:46 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/urlhaus-filter ! License: https://gitlab.com/curben/urlhaus-filter#license @@ -7,7 +7,6 @@ ||0-24bpautomentes.hu$all ||0cl.sldov.ru$all ||1.10.147.48$all -||1.207.196.135$all ||1.222.196.60$all ||1.245.4.163$all ||1.246.222.107$all @@ -17,10 +16,10 @@ ||1.246.222.134$all ||1.246.222.138$all ||1.246.222.14$all +||1.246.222.153$all ||1.246.222.16$all ||1.246.222.165$all ||1.246.222.20$all -||1.246.222.228$all ||1.246.222.234$all ||1.246.222.237$all ||1.246.222.245$all @@ -47,14 +46,13 @@ ||1.246.223.148$all ||1.246.223.15$all ||1.246.223.151$all -||1.246.223.22$all ||1.246.223.223$all ||1.246.223.4$all ||1.246.223.48$all -||1.246.223.54$all ||1.246.223.58$all ||1.246.223.59$all ||1.246.223.6$all +||1.246.223.61$all ||1.246.223.71$all ||1.246.223.83$all ||1.246.223.94$all @@ -80,7 +78,6 @@ ||102.141.240.139$all ||103.113.99.79$all ||103.125.218.107$all -||103.141.138.118$all ||103.16.145.25$all ||103.204.168.34$all ||103.217.215.21$all @@ -93,15 +90,11 @@ ||103.4.117.26$all ||103.79.112.254$all ||103.82.98.170$all -||103.91.123.92$all +||103.84.240.228$all +||103.84.241.94$all ||103.91.245.12$all ||103.91.245.14$all ||103.91.245.16$all -||103.91.245.17$all -||103.91.245.23$all -||103.91.245.25$all -||103.91.245.28$all -||103.91.245.36$all ||103.91.245.46$all ||103.91.245.47$all ||103.92.25.90$all @@ -121,6 +114,7 @@ ||107.172.193.132$all ||107.172.249.148$all ||107.173.219.80$all +||107.173.23.240$all ||107.174.250.107$all ||107.174.61.139$all ||107.175.197.135$all @@ -134,44 +128,41 @@ ||108.190.201.37$all ||108.190.250.48$all ||108.249.194.121$all -||109.104.151.108$all ||109.124.90.229$all ||109.233.196.232$all ||109.235.7.228$all +||109.248.58.238$all ||109.86.85.253$all -||109.88.185.119$all ||109.95.200.102$all ||109.95.200.230$all ||109.96.127.90$all ||109.96.57.246$all ||109.99.37.97$all ||110.14.58.190$all -||110.187.229.182$all ||110.228.195.46$all ||110.248.124.254$all ||110.248.175.141$all ||110.248.251.194$all ||110.251.10.18$all -||110.253.150.248$all ||110.253.213.198$all ||110.255.101.184$all ||110.35.145.127$all ||110.35.208.21$all ||110.35.221.77$all ||110.35.223.92$all -||110.35.225.24$all +||110.35.233.147$all ||110.35.235.57$all ||110.35.4.2$all ||110.89.10.147$all ||110.89.222.213$all -||111.118.111.207$all +||111.118.41.173$all +||111.118.88.128$all ||111.118.88.61$all ||111.119.245.114$all ||111.125.67.125$all ||111.163.50.120$all ||111.170.86.31$all ||111.172.57.20$all -||111.182.235.252$all ||111.185.171.111$all ||111.185.177.85$all ||111.185.23.84$all @@ -186,7 +177,6 @@ ||111.38.121.223$all ||111.38.121.226$all ||111.38.121.228$all -||111.38.123.136$all ||111.38.26.243$all ||111.38.8.81$all ||112.111.108.184$all @@ -211,7 +201,6 @@ ||112.236.171.69$all ||112.237.141.241$all ||112.237.144.226$all -||112.237.209.30$all ||112.237.75.157$all ||112.237.99.207$all ||112.238.143.135$all @@ -241,6 +230,7 @@ ||112.254.208.123$all ||112.255.6.129$all ||112.255.8.235$all +||112.26.212.80$all ||112.27.124.111$all ||112.27.124.117$all ||112.27.124.131$all @@ -277,6 +267,7 @@ ||112.30.1.219$all ||112.30.1.229$all ||112.30.1.230$all +||112.30.1.245$all ||112.30.1.247$all ||112.30.1.90$all ||112.30.1.91$all @@ -284,6 +275,7 @@ ||112.30.110.38$all ||112.30.110.43$all ||112.30.110.48$all +||112.30.110.62$all ||112.30.38.19$all ||112.30.4.103$all ||112.30.4.124$all @@ -293,16 +285,20 @@ ||112.30.97.184$all ||112.31.0.113$all ||112.31.176.16$all +||112.31.177.39$all ||112.31.240.239$all ||112.31.87.98$all ||112.53.224.79$all +||112.53.227.66$all ||112.65.53.175$all ||112.72.153.37$all +||112.72.162.159$all ||112.72.162.49$all ||112.72.175.147$all ||112.72.176.112$all ||112.72.176.84$all ||112.72.226.202$all +||112.72.231.35$all ||112.78.45.158$all ||112.80.127.91$all ||112.80.215.101$all @@ -314,23 +310,20 @@ ||113.122.238.68$all ||113.161.58.249$all ||113.161.78.185$all -||113.226.42.250$all ||113.227.194.172$all ||113.227.35.229$all ||113.231.211.131$all ||113.254.169.251$all ||113.59.128.133$all ||113.59.133.16$all +||113.59.136.39$all ||113.59.144.42$all -||113.59.154.21$all +||113.59.191.47$all ||113.61.204.205$all -||113.87.226.255$all ||113.87.32.93$all ||113.89.43.185$all ||114.111.242.3$all ||114.224.203.128$all -||114.226.100.56$all -||114.228.205.101$all ||114.229.165.194$all ||114.30.54.64$all ||114.79.172.42$all @@ -338,28 +331,27 @@ ||115.201.38.185$all ||115.42.47.36$all ||115.50.227.209$all -||115.50.92.195$all +||115.53.254.187$all ||115.55.158.93$all ||115.56.131.242$all ||115.56.133.96$all -||115.56.135.210$all ||115.56.152.194$all ||115.58.132.140$all ||115.59.233.160$all -||115.61.112.199$all ||115.73.3.11$all ||115.92.174.231$all +||115.97.142.58$all ||116.124.219.2$all ||116.132.151.60$all ||116.206.164.46$all ||116.211.100.26$all -||117.196.50.5$all +||116.75.197.220$all ||117.20.204.138$all ||117.20.204.5$all -||117.20.210.52$all ||117.20.220.126$all ||117.20.243.40$all ||117.200.76.54$all +||117.251.59.16$all ||117.26.104.74$all ||117.63.113.146$all ||117.63.195.140$all @@ -384,7 +376,6 @@ ||118.233.65.93$all ||118.42.125.246$all ||118.43.180.33$all -||118.79.125.92$all ||118.79.50.203$all ||118.79.58.82$all ||118.99.179.164$all @@ -396,7 +387,6 @@ ||119.123.238.52$all ||119.14.143.145$all ||119.147.213.57$all -||119.163.93.191$all ||119.164.18.235$all ||119.164.218.229$all ||119.165.107.93$all @@ -435,8 +425,9 @@ ||119.56.144.75$all ||119.56.148.115$all ||119.56.155.57$all -||119.56.173.24$all ||119.56.195.90$all +||119.56.206.43$all +||119.56.220.170$all ||12.132.113.2$all ||12.15.69.83$all ||12.178.187.6$all @@ -462,10 +453,10 @@ ||120.193.91.233$all ||120.209.126.235$all ||120.209.126.239$all +||120.209.126.250$all ||120.209.126.60$all ||120.209.127.187$all ||120.209.99.127$all -||120.210.89.79$all ||120.50.66.60$all ||120.50.93.115$all ||120.6.8.11$all @@ -492,6 +483,7 @@ ||122.100.150.204$all ||122.160.147.53$all ||122.188.86.225$all +||122.199.66.28$all ||122.199.72.23$all ||122.199.79.27$all ||122.202.37.85$all @@ -502,6 +494,7 @@ ||123.110.170.237$all ||123.110.182.187$all ||123.110.19.248$all +||123.110.200.98$all ||123.110.238.188$all ||123.129.2.28$all ||123.129.84.36$all @@ -538,9 +531,8 @@ ||123.241.148.58$all ||123.241.184.124$all ||123.28.217.23$all -||123.4.44.113$all ||123.5.5.242$all -||123.8.17.78$all +||123.9.193.157$all ||124.129.221.150$all ||124.129.76.230$all ||124.129.78.176$all @@ -553,6 +545,7 @@ ||124.132.110.150$all ||124.135.34.49$all ||124.152.26.45$all +||124.153.136.175$all ||124.153.236.6$all ||124.160.126.238$all ||124.163.65.64$all @@ -561,6 +554,7 @@ ||124.199.56.198$all ||124.230.174.233$all ||124.254.251.54$all +||124.5.112.43$all ||124.5.92.20$all ||124.6.0.4$all ||124.67.89.28$all @@ -571,7 +565,6 @@ ||125.128.28.161$all ||125.142.93.34$all ||125.191.113.212$all -||125.209.71.6$all ||125.40.1.235$all ||125.40.73.68$all ||125.43.23.193$all @@ -580,6 +573,7 @@ ||128.116.133.92$all ||130.255.159.133$all ||134.195.139.4$all +||134.236.252.28$all ||135.148.36.127$all ||138.99.204.224$all ||139.159.226.180$all @@ -592,6 +586,7 @@ ||14.189.247.118$all ||14.232.33.212$all ||14.37.222.190$all +||14.42.237.237$all ||14.45.127.110$all ||14.46.25.17$all ||14.46.98.241$all @@ -624,7 +619,6 @@ ||163.53.206.228$all ||165.90.16.5$all ||167.114.172.177$all -||168.205.223.254$all ||170.81.238.178$all ||171.120.222.98$all ||171.121.255.12$all @@ -634,11 +628,13 @@ ||171.35.162.156$all ||171.35.174.198$all ||172.105.36.168$all +||172.105.68.51$all ||172.114.244.127$all ||172.245.186.107$all ||172.245.5.185$all ||172.245.5.190$all ||172.245.81.19$all +||172.93.176.142$all ||172.93.194.114$all ||173.167.85.89$all ||173.169.46.85$all @@ -651,14 +647,11 @@ ||173.56.119.108$all ||173.56.92.166$all ||173.63.64.213$all -||174.106.33.85$all ||174.61.3.149$all -||174.61.48.94$all ||174.73.246.193$all ||174.81.78.7$all ||174.83.73.163$all ||175.10.147.167$all -||175.11.193.66$all ||175.11.65.112$all ||175.117.66.74$all ||175.169.13.182$all @@ -679,38 +672,40 @@ ||176.113.161.76$all ||176.113.161.84$all ||176.113.161.91$all +||176.113.174.139$all ||176.12.117.70$all ||176.123.7.115$all ||176.123.7.127$all -||176.123.9.243$all ||176.124.7.225$all -||176.221.188.251$all -||176.221.251.238$all ||176.240.84.106$all ||177.11.92.78$all ||177.131.226.235$all ||177.54.82.154$all ||178.124.182.187$all -||178.134.185.112$all ||178.150.174.65$all ||178.151.143.2$all ||178.165.122.141$all +||178.17.171.144$all +||178.175.0.143$all ||178.175.1.179$all ||178.175.10.164$all +||178.175.10.76$all ||178.175.10.94$all ||178.175.101.51$all ||178.175.102.138$all ||178.175.102.142$all ||178.175.102.162$all ||178.175.102.25$all -||178.175.103.143$all ||178.175.103.173$all +||178.175.103.52$all ||178.175.104.112$all +||178.175.104.67$all ||178.175.104.69$all ||178.175.105.213$all ||178.175.105.238$all ||178.175.105.7$all ||178.175.107.0$all +||178.175.107.71$all ||178.175.108.173$all ||178.175.108.87$all ||178.175.109.118$all @@ -718,57 +713,56 @@ ||178.175.111.135$all ||178.175.111.171$all ||178.175.111.190$all -||178.175.112.111$all ||178.175.112.135$all ||178.175.112.159$all ||178.175.112.198$all ||178.175.112.85$all +||178.175.114.146$all ||178.175.114.151$all -||178.175.114.178$all ||178.175.114.57$all ||178.175.115.166$all ||178.175.116.101$all ||178.175.116.138$all +||178.175.116.20$all ||178.175.116.242$all ||178.175.118.112$all -||178.175.118.116$all -||178.175.118.244$all ||178.175.119.69$all ||178.175.12.135$all ||178.175.120.154$all -||178.175.121.0$all ||178.175.121.228$all +||178.175.121.54$all ||178.175.122.28$all ||178.175.123.213$all -||178.175.123.223$all ||178.175.123.232$all ||178.175.123.248$all ||178.175.123.26$all ||178.175.123.91$all ||178.175.124.4$all ||178.175.125.14$all +||178.175.125.149$all ||178.175.126.129$all -||178.175.126.254$all ||178.175.126.46$all ||178.175.127.202$all -||178.175.127.63$all +||178.175.127.223$all ||178.175.14.14$all +||178.175.14.155$all ||178.175.15.199$all ||178.175.15.232$all ||178.175.15.44$all -||178.175.17.194$all +||178.175.16.26$all ||178.175.17.236$all -||178.175.18.75$all +||178.175.19.160$all ||178.175.19.163$all ||178.175.2.158$all ||178.175.2.217$all ||178.175.2.225$all +||178.175.2.254$all ||178.175.2.59$all ||178.175.20.126$all ||178.175.20.7$all ||178.175.20.74$all -||178.175.21.149$all -||178.175.23.119$all +||178.175.21.41$all +||178.175.22.120$all ||178.175.24.166$all ||178.175.24.232$all ||178.175.25.129$all @@ -776,9 +770,15 @@ ||178.175.27.32$all ||178.175.27.46$all ||178.175.29.233$all +||178.175.3.86$all +||178.175.30.109$all ||178.175.30.133$all ||178.175.30.151$all +||178.175.31.55$all ||178.175.32.146$all +||178.175.32.186$all +||178.175.33.179$all +||178.175.33.32$all ||178.175.34.230$all ||178.175.35.170$all ||178.175.35.193$all @@ -792,108 +792,109 @@ ||178.175.38.12$all ||178.175.4.227$all ||178.175.4.29$all +||178.175.40.209$all +||178.175.42.46$all ||178.175.43.121$all ||178.175.43.217$all -||178.175.43.238$all ||178.175.44.186$all -||178.175.44.241$all ||178.175.45.125$all ||178.175.45.26$all -||178.175.46.41$all ||178.175.46.59$all -||178.175.47.15$all -||178.175.47.181$all +||178.175.47.220$all ||178.175.47.222$all ||178.175.47.80$all -||178.175.48.40$all +||178.175.48.140$all +||178.175.48.223$all +||178.175.48.67$all ||178.175.5.254$all ||178.175.5.44$all -||178.175.5.74$all ||178.175.50.217$all ||178.175.50.42$all +||178.175.50.54$all ||178.175.53.101$all ||178.175.54.186$all -||178.175.54.234$all ||178.175.54.58$all ||178.175.55.99$all -||178.175.56.11$all ||178.175.56.185$all ||178.175.56.56$all -||178.175.57.134$all +||178.175.56.64$all ||178.175.57.14$all ||178.175.57.183$all +||178.175.57.204$all ||178.175.58.230$all ||178.175.58.234$all ||178.175.58.235$all ||178.175.59.106$all ||178.175.60.247$all ||178.175.61.103$all -||178.175.61.210$all -||178.175.62.241$all ||178.175.62.60$all ||178.175.64.156$all -||178.175.64.17$all ||178.175.64.35$all +||178.175.65.189$all ||178.175.65.208$all +||178.175.66.186$all ||178.175.68.123$all -||178.175.68.209$all ||178.175.68.44$all ||178.175.68.57$all +||178.175.69.79$all ||178.175.7.156$all ||178.175.70.218$all ||178.175.70.250$all ||178.175.70.74$all -||178.175.72.148$all +||178.175.72.126$all ||178.175.72.158$all ||178.175.72.75$all ||178.175.73.238$all ||178.175.75.181$all ||178.175.75.205$all +||178.175.75.214$all +||178.175.77.248$all ||178.175.77.47$all ||178.175.78.2$all ||178.175.78.242$all -||178.175.78.243$all ||178.175.79.146$all +||178.175.79.198$all ||178.175.79.66$all -||178.175.8.248$all ||178.175.8.85$all +||178.175.8.93$all ||178.175.80.142$all +||178.175.80.167$all ||178.175.81.185$all ||178.175.81.192$all ||178.175.81.226$all -||178.175.83.224$all +||178.175.81.240$all ||178.175.84.195$all ||178.175.84.215$all +||178.175.86.117$all ||178.175.86.182$all -||178.175.86.47$all ||178.175.86.59$all -||178.175.87.146$all ||178.175.87.16$all ||178.175.87.207$all ||178.175.87.42$all ||178.175.88.102$all -||178.175.88.207$all +||178.175.88.85$all ||178.175.89.121$all +||178.175.89.132$all ||178.175.89.45$all ||178.175.89.69$all ||178.175.91.223$all ||178.175.92.144$all -||178.175.92.33$all ||178.175.93.113$all -||178.175.93.200$all ||178.175.93.234$all ||178.175.93.98$all ||178.175.94.224$all +||178.175.94.248$all ||178.175.94.27$all ||178.175.94.32$all ||178.175.94.40$all -||178.175.95.60$all -||178.175.96.106$all +||178.175.95.105$all +||178.175.95.188$all ||178.175.96.125$all +||178.175.96.93$all ||178.175.97.127$all -||178.175.97.227$all ||178.175.99.106$all ||178.175.99.209$all +||178.175.99.21$all ||178.19.183.14$all ||178.205.101.33$all ||178.21.164.68$all @@ -904,7 +905,6 @@ ||178.48.235.59$all ||178.95.136.35$all ||179.159.58.134$all -||179.4.187.39$all ||179.43.176.41$all ||179.43.176.48$all ||179.60.84.7$all @@ -941,6 +941,7 @@ ||181.49.236.4$all ||181.49.59.162$all ||181.80.69.94$all +||182.112.177.134$all ||182.115.179.201$all ||182.119.206.219$all ||182.119.225.221$all @@ -953,13 +954,14 @@ ||182.233.0.252$all ||182.235.252.31$all ||182.53.197.62$all -||183.105.104.83$all ||183.105.225.154$all ||183.109.169.45$all ||183.143.148.105$all ||183.188.50.93$all -||183.83.8.225$all +||183.83.1.1$all +||183.83.14.20$all ||184.164.185.41$all +||184.175.115.10$all ||184.74.149.230$all ||184.82.15.135$all ||185.106.209.68$all @@ -974,7 +976,6 @@ ||185.215.113.93$all ||185.221.3.244$all ||185.222.58.152$all -||185.224.129.224$all ||185.228.141.74$all ||185.233.186.151$all ||185.245.96.94$all @@ -984,6 +985,7 @@ ||185.55.1.182$all ||185.68.230.207$all ||185.8.173.159$all +||185.81.154.208$all ||185.81.157.186$all ||185.82.217.185$all ||185.82.217.213$all @@ -1011,6 +1013,8 @@ ||188.152.41.141$all ||188.169.178.50$all ||188.169.179.127$all +||188.169.199.59$all +||188.169.30.30$all ||188.169.36.163$all ||188.242.167.159$all ||188.242.242.144$all @@ -1040,6 +1044,7 @@ ||190.216.140.123$all ||190.65.206.162$all ||190.85.213.51$all +||190.92.4.231$all ||190.98.37.135$all ||190.98.37.200$all ||190.98.41.33$all @@ -1053,7 +1058,6 @@ ||192.227.230.72$all ||192.227.230.74$all ||192.227.230.76$all -||192.236.147.58$all ||192.99.240.77$all ||194.113.107.243$all ||194.147.142.230$all @@ -1065,11 +1069,10 @@ ||195.24.94.187$all ||195.5.3.87$all ||196.202.26.182$all +||196.218.48.82$all ||196.221.148.90$all ||196.221.166.203$all ||197.50.27.115$all -||198.23.133.218$all -||198.23.174.104$all ||198.23.213.61$all ||198.23.251.105$all ||198.46.132.132$all @@ -1077,6 +1080,7 @@ ||2.239.22.188$all ||2.36.231.201$all ||2.37.149.230$all +||2.37.203.65$all ||2.45.111.158$all ||2.45.4.24$all ||2.55.125.182$all @@ -1093,32 +1097,29 @@ ||200.194.4.24$all ||200.30.132.50$all ||201.170.46.2$all +||201.171.40.215$all ||201.184.163.170$all ||201.187.102.73$all ||201.200.254.86$all ||201.203.221.20$all ||201.203.27.37$all ||202.107.233.41$all -||202.150.176.100$all ||202.166.217.54$all ||202.175.103.10$all ||202.29.95.12$all ||202.4.124.58$all ||202.51.176.114$all ||202.51.191.174$all -||202.74.236.9$all ||203.109.201.243$all ||203.159.80.128$all ||203.159.80.129$all +||203.159.80.164$all ||203.170.123.78$all ||203.189.156.107$all ||203.204.232.18$all ||203.229.21.56$all ||203.236.190.28$all -||203.238.86.202$all -||203.243.142.132$all ||203.70.166.107$all -||203.77.80.159$all ||203.80.119.166$all ||203.80.171.138$all ||203.82.36.34$all @@ -1133,7 +1134,6 @@ ||209.141.40.31$all ||209.146.98.50$all ||210.124.149.19$all -||210.180.17.140$all ||210.216.152.122$all ||210.216.153.142$all ||210.57.234.93$all @@ -1142,19 +1142,20 @@ ||210.68.242.114$all ||211.187.132.204$all ||211.187.75.220$all -||211.200.160.239$all ||211.204.215.157$all ||211.210.66.179$all ||211.210.93.93$all ||211.216.66.105$all ||211.237.114.96$all ||211.237.120.13$all +||211.237.246.137$all ||211.238.83.238$all ||211.247.5.96$all ||211.32.122.110$all ||211.93.191.153$all ||212.122.86.105$all ||212.143.227.22$all +||212.156.215.178$all ||212.46.197.114$all ||212.56.197.230$all ||213.123.206.197$all @@ -1165,28 +1166,30 @@ ||213.163.104.99$all ||213.163.111.201$all ||213.163.114.136$all -||213.163.114.165$all -||213.163.115.104$all ||213.163.116.153$all +||213.163.118.10$all +||213.163.118.216$all ||213.163.126.20$all ||213.163.126.201$all -||213.163.126.243$all ||213.163.126.7$all +||213.186.69.101$all ||213.189.178.163$all ||213.240.218.15$all ||213.249.156.189$all -||213.91.244.58$all ||213.92.254.52$all ||216.158.238.236$all ||216.170.240.98$all ||216.183.54.169$all +||216.183.54.196$all ||216.36.12.98$all ||217.11.75.162$all +||217.12.209.82$all ||218.12.181.110$all -||218.161.69.135$all ||218.2.40.34$all ||218.234.165.18$all ||218.238.246.3$all +||218.255.226.166$all +||218.32.118.1$all ||218.35.207.119$all ||218.35.227.133$all ||218.35.68.35$all @@ -1196,11 +1199,10 @@ ||218.79.103.159$all ||218.93.102.63$all ||218.93.102.75$all +||219.155.234.33$all ||219.155.29.165$all ||219.155.64.104$all ||219.157.139.165$all -||219.157.202.92$all -||219.157.214.235$all ||219.241.6.180$all ||219.68.1.148$all ||219.68.1.84$all @@ -1214,8 +1216,8 @@ ||21robo.com$all ||220.118.168.155$all ||220.126.237.74$all -||220.132.89.154$all ||220.200.22.163$all +||220.81.44.181$all ||220.90.159.188$all ||221.0.133.84$all ||221.124.78.15$all @@ -1241,11 +1243,13 @@ ||222.132.125.138$all ||222.133.103.120$all ||222.135.9.5$all +||222.137.133.125$all ||222.137.139.86$all ||222.137.73.214$all -||222.138.201.129$all ||222.140.17.245$all +||222.142.210.144$all ||222.185.116.233$all +||222.186.20.19$all ||222.187.9.178$all ||222.211.72.66$all ||222.236.85.220$all @@ -1268,6 +1272,7 @@ ||23.24.213.121$all ||23.243.149.13$all ||23.243.21.167$all +||23.95.122.24$all ||23.95.89.21$all ||24.103.74.180$all ||24.11.141.134$all @@ -1302,7 +1307,6 @@ ||27.147.40.128$all ||27.184.251.135$all ||27.193.217.210$all -||27.194.149.142$all ||27.194.192.66$all ||27.197.23.215$all ||27.199.232.65$all @@ -1332,7 +1336,6 @@ ||27.208.247.130$all ||27.208.25.59$all ||27.208.34.2$all -||27.209.208.122$all ||27.209.231.15$all ||27.21.151.205$all ||27.210.107.125$all @@ -1375,10 +1378,10 @@ ||27.223.242.164$all ||27.35.129.198$all ||27.35.154.13$all -||27.35.2.30$all +||27.35.171.36$all ||27.35.212.124$all ||27.35.58.5$all -||27.7.204.255$all +||27.6.255.101$all ||31.0.98.131$all ||31.11.51.57$all ||31.13.23.180$all @@ -1405,7 +1408,6 @@ ||31.30.119.23$all ||31.32.120.79$all ||32.208.157.193$all -||32792.prolocksmithwinterpark.com$all ||34.122.44.188$all ||35.184.169.169$all ||36.108.231.218$all @@ -1421,6 +1423,7 @@ ||36.66.105.159$all ||36.66.133.125$all ||36.66.139.36$all +||36.67.152.161$all ||36.89.18.133$all ||36.91.89.187$all ||360.lcy2zzx.pw$all @@ -1497,33 +1500,32 @@ ||40.88.2.151$all ||41.139.209.46$all ||41.165.130.43$all -||41.190.63.174$all ||41.193.192.100$all ||41.219.185.171$all ||41.226.60.115$all ||41.72.203.82$all ||41.76.157.2$all ||41.86.18.200$all -||41.86.18.201$all +||41.86.5.164$all ||41.86.5.197$all +||42.202.101.118$all ||42.202.101.199$all +||42.224.51.229$all ||42.228.60.114$all ||42.229.173.80$all ||42.230.91.1$all ||42.231.208.64$all +||42.236.212.157$all ||42.56.15.227$all ||42.61.99.155$all -||42.82.217.241$all +||43.230.207.204$all ||43.241.106.183$all -||43.241.108.134$all -||43.252.8.94$all ||45.133.1.242$all ||45.133.203.192$all ||45.135.134.228$all ||45.14.149.178$all ||45.14.149.182$all ||45.14.149.204$all -||45.141.84.182$all ||45.141.84.184$all ||45.144.225.118$all ||45.144.225.135$all @@ -1533,6 +1535,7 @@ ||45.144.225.27$all ||45.148.10.47$all ||45.148.10.94$all +||45.156.22.230$all ||45.176.109.205$all ||45.176.111.159$all ||45.176.111.35$all @@ -1550,7 +1553,6 @@ ||45.92.108.35$all ||45.95.169.153$all ||46.114.28.132$all -||46.161.185.15$all ||46.172.75.231$all ||46.20.63.218$all ||46.214.27.4$all @@ -1582,6 +1584,7 @@ ||49.213.170.49$all ||49.213.178.183$all ||49.213.179.129$all +||4et3ja.am.files.1drv.com$all ||5.14.122.233$all ||5.188.62.111$all ||5.2.70.50$all @@ -1600,10 +1603,8 @@ ||58.115.174.4$all ||58.125.191.4$all ||58.126.247.118$all -||58.141.122.109$all ||58.142.166.120$all ||58.142.200.124$all -||58.218.67.253$all ||58.22.212.107$all ||58.226.129.29$all ||58.229.194.122$all @@ -1614,7 +1615,6 @@ ||58.241.78.55$all ||58.243.126.133$all ||58.72.165.153$all -||58.72.165.39$all ||58.76.151.51$all ||58.97.206.33$all ||59.0.211.161$all @@ -1625,6 +1625,7 @@ ||59.151.246.125$all ||59.173.193.208$all ||59.23.114.97$all +||59.26.181.228$all ||59.30.12.254$all ||60.13.61.12$all ||60.208.135.42$all @@ -1648,7 +1649,6 @@ ||60.253.44.99$all ||60.253.51.127$all ||60.253.60.174$all -||60.253.8.81$all ||60.7.10.121$all ||60.7.8.43$all ||61.164.96.98$all @@ -1679,17 +1679,19 @@ ||62.141.73.58$all ||62.219.131.205$all ||62.219.143.46$all -||62.219.227.31$all ||62.31.126.33$all ||62.38.149.66$all ||62.38.222.98$all ||62.43.207.148$all ||62.90.165.236$all ||63.245.122.93$all +||64.233.154.99$all +||65.0.168.152$all ||65.125.128.196$all ||65.21.58.252$all ||65.26.155.131$all ||65.35.61.255$all +||66.108.199.144$all ||66.229.214.115$all ||66.57.55.210$all ||66.74.7.197$all @@ -1750,7 +1752,6 @@ ||73.70.164.42$all ||74.101.1.159$all ||74.108.224.112$all -||74.119.195.101$all ||74.194.117.165$all ||74.195.115.176$all ||74.199.84.77$all @@ -1854,6 +1855,7 @@ ||84.40.127.242$all ||84.42.20.217$all ||8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com$all +||85.105.11.216$all ||85.105.123.251$all ||85.105.135.187$all ||85.105.180.33$all @@ -1866,13 +1868,13 @@ ||85.74.215.180$all ||85.97.130.227$all ||86.35.43.220$all -||87.110.105.250$all +||87.117.11.46$all ||87.172.19.130$all ||87.61.89.40$all -||87du.vip$all ||88.119.171.253$all ||88.2.208.71$all ||88.2.219.179$all +||88.218.17.110$all ||88.218.17.149$all ||88.225.222.128$all ||88.247.96.19$all @@ -1881,10 +1883,12 @@ ||88.249.244.180$all ||88.250.204.12$all ||88.250.226.26$all +||88.250.240.245$all ||88.250.254.90$all ||89.122.183.130$all ||89.136.197.170$all ||89.22.152.244$all +||89.248.112.202$all ||89.29.213.33$all ||89.40.85.166$all ||8poieq.bn.files.1drv.com$all @@ -1960,7 +1964,6 @@ ||aceeprc.com.aceeprc.com$all ||acellr.co.uk$all ||acteon.com.ar$all -||activecost.com.au$all ||addahealingmusic.com$all ||adithimedia.com$all ||adithimedia.memengers.com$all @@ -2023,11 +2026,14 @@ ||artedibujoyarquitectura.com$all ||arwenyapi.com$all ||ask-regard.call-save.biz$all +||asucssa.live$all ||atfile.com$all ||athenacapsg.com$all +||atlasconcreteworks.com$all ||attach.66rpg.com$all ||atteuqpotentialunlimited.com$all ||augustair.com$all +||aulist.com$all ||automaticrefreshments.com$all ||avadhanagames.com$all ||ayahuascasp.com.br$all @@ -2043,6 +2049,7 @@ ||bary.sz4h.com$all ||bash.givemexyz.in$all ||bausch.kr-atlas.monaxikoslykos@zytrox.tk$all +||bavhome.com$all ||bbia.co.uk$all ||bcmt.elin.co.za$all ||bcrg.co.za$all @@ -2076,8 +2083,17 @@ ||bitbucket.org/labesoftware/update/downloads/install_plugin_x64_x86.exe$all ||bitbucket.org/labesoftware/update/downloads/vpn_free.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/1.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/2.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/3.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/clr.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/dianthus.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/n.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/newred.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/omar.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/serv.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/test.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/updachrome.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/updatedata.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/updatev.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/work.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/ya.exe$all @@ -2176,7 +2192,6 @@ ||bt2.elin.co.za$all ||btdapi.robotake.com$all ||buigiaphat.com.vn$all -||bulkyfoodja.com$all ||bullseyemedia.in$all ||busandvanrentalmalaysia.com$all ||buscascolegios.diit.cl$all @@ -2190,11 +2205,8 @@ ||calgaryautorepairservice.com$all ||callbury.in$all ||camminachetipassa.it$all -||canadianwork.cc$all ||capitalgroup-kw.com$all ||capoeiraventrelivre.com$all -||carlsbadre.com$all -||carsidecor.com$all ||cashyinvestment.org$all ||catchperch.com$all ||catchpoolshetlands.co.uk$all @@ -2245,7 +2257,6 @@ ||colorpak.pl$all ||columbia.aula-web.net$all ||community.reimclub.com$all -||comosairdoburaco.com.br$all ||competancy.indigoconsult.net$all ||conceptimagine.ro$all ||config.cqhbkjzx.com$all @@ -2254,12 +2265,14 @@ ||consulateins.solucioneslink.com$all ||contributeindustry.com$all ||copelandscapes.com$all +||corwin-tommie06f.ru.com$all ||coulsongraphics.com$all ||count.mail.163.com.impactmedfoundation.com$all ||covid19.cyberschool.or.id$all ||cpanel.shivay.net$all ||cr-sq.com$all ||craftech.nxtnet.ga$all +||crearechile.cl$all ||creationskateboards.com$all ||crecerco.com$all ||crittersbythebay.com$all @@ -2269,6 +2282,7 @@ ||crscorretordeimoveis.com.br$all ||cse-engineer.com$all ||csnserver.com$all +||ctracknxt.in$all ||cubescargoexpress.com$all ||curasoles.co.za$all ||currantmedia.com$all @@ -2287,7 +2301,6 @@ ||dating.khokhas.co.za$all ||datsom.vn$all ||davethompson.me.uk$all -||davidmcguinness.info$all ||dayspringdaisies.com$all ||dd.qiyuea.cn$all ||ddns.cyberium.cc$all @@ -2321,15 +2334,13 @@ ||dl.installcdn-aws.com$all ||dl.packetstormsecurity.net$all ||dl.rina-roleplay.com$all -||dnn.alibuf.com$all -||dns.alibuf.com$all ||dockerupdate.anondns.net$all ||docman.orientalservices.in$all ||docs.google.com/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq$all +||docs.google.com/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq$all ||dodsonimaging.com$all ||doitunlimited.com$all ||dokan.blueberrytec.com$all -||dom-chel74.ru$all ||dom.daf.free.fr$all ||doncedyhall.com$all ||donghobinhminh.com$all @@ -2339,6 +2350,7 @@ ||dosman.pl$all ||dovberger.com$all ||down.pcclear.com$all +||down.udashi.com$all ||down.webbora.com$all ||down1.arpun.com$all ||download.caihong.com$all @@ -2355,63 +2367,54 @@ ||drgroup.co.za$all ||drive.google.com.it-barcelona.com/frm0reseen/prntscrnofamzorderid.jpg.exe$all ||drive.google.com/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm$all +||drive.google.com/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g$all ||drive.google.com/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss$all ||drive.google.com/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch$all ||drive.google.com/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g$all -||drive.google.com/uc?export=download&id=152yoztzpbx_bbpxepfackfklg8c1eao6$all -||drive.google.com/uc?export=download&id=15hcgek7odccdafzf-9gvibnlgkirj4uo$all ||drive.google.com/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox$all +||drive.google.com/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo$all ||drive.google.com/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w$all -||drive.google.com/uc?export=download&id=194lqzukzvt-jtdxmihcvhd0yk1sxoybk$all ||drive.google.com/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig$all ||drive.google.com/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld$all ||drive.google.com/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn$all ||drive.google.com/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw$all ||drive.google.com/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio$all ||drive.google.com/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv$all -||drive.google.com/uc?export=download&id=1cos43rmscrescxk3u40qjuqbwr-pydsn$all ||drive.google.com/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben$all +||drive.google.com/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a$all ||drive.google.com/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e$all ||drive.google.com/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv$all ||drive.google.com/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd$all ||drive.google.com/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6$all ||drive.google.com/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei$all ||drive.google.com/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr$all -||drive.google.com/uc?export=download&id=1jkov2g5s1xkcq4bfb3uvmd6inhadatrg$all ||drive.google.com/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd$all -||drive.google.com/uc?export=download&id=1kjcylye1dbmhystyyotz-3pagktkhlhq$all +||drive.google.com/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx$all ||drive.google.com/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu$all ||drive.google.com/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer$all ||drive.google.com/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp$all -||drive.google.com/uc?export=download&id=1mwgdd3lxuuk-bnsrm1rpclom0cmx7wob$all ||drive.google.com/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y$all ||drive.google.com/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd$all -||drive.google.com/uc?export=download&id=1nmf6kty3xsoygjxjhb-bsafvlfy-0lt2$all ||drive.google.com/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw$all ||drive.google.com/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol$all -||drive.google.com/uc?export=download&id=1p5fvqkxzwoiu_uauzbmrxpklsetculad$all ||drive.google.com/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk$all ||drive.google.com/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s$all ||drive.google.com/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej$all -||drive.google.com/uc?export=download&id=1q1dwckludrpqijtrpw14_60d5nu7n97t$all ||drive.google.com/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p$all ||drive.google.com/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl$all ||drive.google.com/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko$all ||drive.google.com/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq$all -||drive.google.com/uc?export=download&id=1sjvkrinuscxqmbkdeusxaezazbiagnv3$all -||drive.google.com/uc?export=download&id=1so1trfuzt5-giahetghfhmd-_ot3rq35$all ||drive.google.com/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn$all ||drive.google.com/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w$all ||drive.google.com/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno$all ||drive.google.com/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t$all ||drive.google.com/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb$all +||drive.google.com/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy$all ||drive.google.com/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh$all ||drive.google.com/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e$all ||drive.google.com/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi$all ||drive.google.com/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58$all ||drive.google.com/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi$all -||drive.google.com/uc?export=download&id=1yhflwpk3yeyrdhlhanctlind-5j24iwv$all -||drive.google.com/uc?export=download&id=1yqpuxjbnjokc5fjgt-8xzuybr97rtvg2$all ||drive.google.com/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy$all ||drive.google.com/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr$all ||drive.google.com/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0$all @@ -2434,6 +2437,7 @@ ||eandgdesign.com.ng$all ||eastsheen-glaziers.co.uk$all ||ebruyatkin.com$all +||edu.saicraftsman.com$all ||eedo.ee$all ||efficientegroup.com$all ||elbauldenora.com$all @@ -2448,8 +2452,8 @@ ||erp.zilymax.com$all ||escola.probommar.org.br$all ||esnconsultants.com$all -||esrhf04.top$all ||essentia.org.br$all +||estjh05.top$all ||ethereality.info$all ||eubanks7.com$all ||europeanzonexxi.com$all @@ -2531,9 +2535,11 @@ ||goldcoastoffice365.com.au$all ||golden-memories-funerals.yourpageserver.com$all ||goldenasiacapital.com$all +||goldmen.in$all ||gpotecnosystems.com$all ||gracejukes.com$all ||grupoinmare.com$all +||gruposelt.000webhostapp.com$all ||gs.monerorx.com$all ||guide-to-cell-phones.com$all ||gulfac-house.com$all @@ -2561,6 +2567,7 @@ ||hmpmall.co.kr$all ||hoagietesting10.com$all ||hoayeuthuong-my.sharepoint.com$all +||holmesservices.mobiledevsite.co$all ||homefindersolutions.com$all ||hongluosi.com$all ||hookedupboatclub.com$all @@ -2575,6 +2582,7 @@ ||htownbars.com$all ||hubtech.co.za$all ||huellacero.cl$all +||hunchomusichub.com$all ||hunggiang.vn$all ||husamiyahschool.com$all ||ia801802.us.archive.org/19/items/startup_20210219/startup.txt$all @@ -2632,7 +2640,6 @@ ||jcedu.org/ebook/cs17.exe$all ||jebs.net.au$all ||jeffdahlke.com$all -||jhayesconsulting.com$all ||jiaoyuzixun.cn$all ||jing-da.com.tw$all ||jmtc.91756.cn$all @@ -2649,7 +2656,6 @@ ||jupiter.toxsl.in$all ||justinscott.com.au$all ||kadigital.co.uk$all -||kaizenjanitorial.com$all ||kalawatihomes.com$all ||kalogirosfinance.com$all ||kaptaanchapal.com$all @@ -2661,11 +2667,9 @@ ||ketofitnessexpert.com$all ||kevinjewelry.com.co$all ||keywatch.yourpageserver.com$all -||khmerosja.net$all ||kingssa.co.za$all ||kizitox.ga$all ||kjcpromo.com$all -||kldatabase.com$all ||kleinendeli.co.za$all ||korrectconceptservices.com$all ||kotakwarna.co.id/dg/etrac/nf4emwz/$all @@ -2674,7 +2678,7 @@ ||ktb.sch.id$all ||kuaizip.com/down/affiliate/kuaizip_setup_10029.exe$all ||kubatoglubaklava.com.tr$all -||kullumanalitours.com$all +||kumaralok.in$all ||kwanfromhongkong.com$all ||kz.sldov.ru$all ||lacasadelosalebrijes.com$all @@ -2683,7 +2687,6 @@ ||laodongnhat.vn$all ||laravel.pointersoftwares.com.br$all ||lasermobilesounds.co.uk$all -||laura9630fr.com$all ||lauratomismith.com$all ||lautarosanmiguel.com$all ||lawforall.edu.lk$all @@ -2792,14 +2795,12 @@ ||misterson.com$all ||mkontakt.az$all ||mktf.mx$all -||mmdx.com$all ||mmogollon.com.mx$all ||mncarteam.com$all ||modelhouseturkey.com$all ||modernmanna.org$all ||monetization.business$all ||moninediy.com$all -||mopai.sg$all ||morrobaydrugandgift.com/wp-contentbak/t9m/$all ||motorcomunicacion.com$all ||moumitas.com$all @@ -2822,7 +2823,7 @@ ||nch.com.au/components/aacenc.exe$all ||nch.com.au/components/doxillionsetup.exe$all ||nec-i.com$all -||nellaimasthanbiryani.com$all +||nelitrianggraeni.000webhostapp.com$all ||nerve.untergrund.net$all ||nettube.com.br$all ||networkwheels.co.za$all @@ -2843,6 +2844,7 @@ ||nilinkeji.com$all ||nimboohomes.com$all ||njtiledesigncenter.com$all +||nmxwllwsdyminoragenw.dns.army$all ||nobius.org$all ||nocalnoodle.elin.co.za$all ||nomadicbees.com$all @@ -2857,6 +2859,7 @@ ||nyeh2o.com.au$all ||obseques-conseils.com$all ||oecteam.com$all +||ohe.ie$all ||ohsewgorgeous.co.uk$all ||oknoplastik.sk$all ||oldschoolvalue.s3.amazonaws.com/spreadsheets/osv_stock_valuation-sample-dummy.exe$all @@ -2868,6 +2871,8 @@ ||omscoc.pappai.com$all ||onedigitalcard.granvizionnecorp.com$all ||onedrive.listifyapp.co$all +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm$all +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$all ||onedrive.live.com/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa$all ||onedrive.live.com/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq$all ||onedrive.live.com/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe$all @@ -2914,6 +2919,7 @@ ||onedrive.live.com/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0$all ||onedrive.live.com/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte$all ||onedrive.live.com/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte$all +||onedrive.live.com/download?cid=16b1c02dce9ea41f&resid=16b1c02dce9ea41f!286&authkey=almwisomhv3c0zc$all ||onedrive.live.com/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54$all ||onedrive.live.com/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54$all ||onedrive.live.com/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g$all @@ -2933,6 +2939,14 @@ ||onedrive.live.com/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg$all ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4$all ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc$all +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom$all +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom$all ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po$all ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe$all ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk$all @@ -2944,6 +2958,10 @@ ||onedrive.live.com/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga$all ||onedrive.live.com/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28$all ||onedrive.live.com/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk$all ||onedrive.live.com/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0$all ||onedrive.live.com/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620$all ||onedrive.live.com/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo$all @@ -2990,8 +3008,10 @@ ||onedrive.live.com/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm$all ||onedrive.live.com/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm$all ||onedrive.live.com/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik$all +||onedrive.live.com/download?cid=44d422e98133708b&resid=44d422e98133708b%21109&authkey=adzxmpjk-etbkjq$all ||onedrive.live.com/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy$all ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0$all +||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0$all ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw$all ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw$all ||onedrive.live.com/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y$all @@ -3007,6 +3027,7 @@ ||onedrive.live.com/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8$all ||onedrive.live.com/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc$all ||onedrive.live.com/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y$all +||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc$all @@ -3097,10 +3118,15 @@ ||onedrive.live.com/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe$all ||onedrive.live.com/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i$all ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8$all +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq$all +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s$all ||onedrive.live.com/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa$all ||onedrive.live.com/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe$all ||onedrive.live.com/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi$all ||onedrive.live.com/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e$all +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e!1094&authkey=anqjzd7pr18fu90$all +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211094&authkey=anqjzd7pr18fu90$all +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211099&authkey=alxq-bvz7nqbv4c$all ||onedrive.live.com/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk$all ||onedrive.live.com/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4$all ||onedrive.live.com/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo$all @@ -3171,6 +3197,8 @@ ||onedrive.live.com/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4$all ||onedrive.live.com/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk$all ||onedrive.live.com/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk$all +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y$all +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y$all ||onedrive.live.com/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0$all ||onedrive.live.com/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s$all ||onedrive.live.com/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my$all @@ -3190,11 +3218,6 @@ ||onedrive.live.com/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli$all ||onedrive.live.com/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm$all ||onedrive.live.com/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935!778&authkey=aaezyk4ypt-elma$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21772&authkey=akeozmv0aafqlbg$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21774&authkey=aly_m3fnrvh6dfq$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21775&authkey=abblpjxi4mwomgs$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21777&authkey=ahmuwqi4jg8rvho$all ||onedrive.live.com/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc$all ||onedrive.live.com/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w$all ||onedrive.live.com/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm$all @@ -3264,6 +3287,7 @@ ||onedrive.live.com/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0$all ||onedrive.live.com/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m$all ||onedrive.live.com/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8$all +||onedrive.live.com/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$all ||onedrive.live.com/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g$all ||onedrive.live.com/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g$all ||onedrive.live.com/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90$all @@ -3272,6 +3296,7 @@ ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm$all ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai$all ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk$all +||onedrive.live.com/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta$all ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa$all ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa$all ||onedrive.live.com/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e$all @@ -3331,11 +3356,6 @@ ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q$all ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw$all ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!141&authkey=alya4infudqs53o$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!142&authkey=aiemnxi-s-5vrz0$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21141&authkey=alya4infudqs53o$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0&c=3ii9gcd&r=5onulz3wldybwlmup37su3&k=7s1&s=kzymn52eroemh1tamvmlsfsn9jtvwguukky5hlxcfgw$all ||onedrive.live.com/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe$all ||onedrive.live.com/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq$all ||onedrive.live.com/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4$all @@ -3369,6 +3389,7 @@ ||onedrive.live.com/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha$all ||onedrive.live.com/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha$all ||onedrive.live.com/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke$all +||onedrive.live.com/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21349&authkey=ae9ea8jdsa7vmom$all ||onedrive.live.com/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da$all ||onedrive.live.com/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu$all ||onedrive.live.com/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu$all @@ -3445,9 +3466,11 @@ ||pagos.krayem.com.mx$all ||palbas.cl$all ||palochusvet.szm.com$all +||panslimiterd.com$all ||parallel.rockvideos.at$all ||parejasfelices.mi-fs.com$all ||parkhussion.com$all +||paste.ee/r/a39ev$all ||pastebin.com/raw/77jhk0iw$all ||pastebin.com/raw/89hkc7wb$all ||pastebin.com/raw/yqvsvlvq$all @@ -3479,6 +3502,7 @@ ||plasfan.ind.br$all ||playground2.grupoaliadasca.com$all ||pmglance.startwriteup.com$all +||pmrimewsdylimtewsogh.dns.army$all ||pokojewewladyslawowie.pl$all ||pole.com.vc$all ||pool.phxdir.com$all @@ -3494,7 +3518,6 @@ ||procrossover.ru/wp-content/uploads/2020/10/skodaqq.jpg$all ||production.sparshims.com$all ||programaoperadoronline.com.br$all -||project.exquitec.com$all ||promotoradescomplica.com.br$all ||promoversdubai.com$all ||propertiq.elin.co.za$all @@ -3504,7 +3527,6 @@ ||prosyarmakassar.com$all ||provence.elin.co.za$all ||prox.realunix.cc$all -||prueba.danielluza.com$all ||pujashoppe.in$all ||punchdialogues.com$all ||punjabdevelopersassociation.com.pk$all @@ -3523,7 +3545,6 @@ ||rainbowisp.info$all ||rajeshtailang.com$all ||rakeshkhatri.in$all -||raodigitalmedia.com$all ||raquelhelena.com.br$all ||rarlabarchiver.ac$all ||rasadbar.ir$all @@ -3548,7 +3569,6 @@ ||readymmade.com$all ||recyclethesurplus.com$all ||redbats.co.in$all -||redboxmultimedia.com$all ||redchillicrackers.com$all ||reifenquick.de$all ||relaxindulge.co.nz$all @@ -3635,7 +3655,6 @@ ||sibernetix.fr$all ||sigapresschennai.com$all ||sige.brisainformatica.com.br$all -||signatureads.co.in$all ||siili.net$all ||simoneporzi.it$all ||simorsint.com$all @@ -3672,7 +3691,6 @@ ||spetsesyachtcharter.gr$all ||spititourism.com$all ||spittinfire.com$all -||springbedspetroleum.com$all ||src1.minibai.com$all ||sreenivasapaintingworks.com$all ||sriglobalit.com$all @@ -3724,12 +3742,12 @@ ||tajushariya.com$all ||tallyinvoicecustomization.com$all ||taltus.co.uk$all -||tapalkoedacoffee.com$all ||tarravalleyfoods.com.au$all ||tavo.cl$all ||tc.snpsresidential.com$all ||tcy.198424.com$all ||tdsp.yngw518.com$all +||tech332.synology.me$all ||techgms.com$all ||technologydistilled.com/a-nurse-ss8d9/z/$all ||teduae.com$all @@ -3769,6 +3787,7 @@ ||theprofinn.com$all ||thesummitpc.net$all ||theurbantutors.com$all +||theviewsdyjupcazfeqv.dns.army$all ||thosewebbs.com$all ||thriveink.com$all ||tianangdep.com$all @@ -3786,6 +3805,7 @@ ||toplevel.com.br$all ||topmask.co.za$all ||torresquinterocorp.com$all +||towme.services$all ||toyotacollege.ac.th$all ||tpke.hu$all ||translaterjemah.com$all @@ -3810,8 +3830,7 @@ ||umwelt-kirchhof.de$all ||unicorpbrunei.com$all ||uniengrisb.com$all -||unisoftcc.com$all -||unityindiversity.in$all +||unitedwsdykesokowskg.dns.army$all ||unyazitelecom.com$all ||upcbpta.com$all ||urbantrapfest.cl$all @@ -3820,6 +3839,7 @@ ||users.skynet.be/crisanar/defis/jek_crackme1.7.zip$all ||uss.ac.th$all ||uzzepay.com.br$all +||v2consultores.com$all ||vanzare.cabanabrazi2.ro$all ||vbcargo.hu$all ||vcah.co.uk$all @@ -3889,11 +3909,14 @@ ||woodsytech.com$all ||wordpress.saleensuporte.com.br$all ||workingsolutionsrome.org$all -||wozata.000webhostapp.com$all ||wp.readhere.in$all ||wpdemo.101clients.com.au$all ||writtendeer.com$all ||ws5588.f3322.net$all +||wsdyalgreenkelveskxz.dns.army$all +||wsdykungsb2talenwsjf.dns.army$all +||wsdyrkkrgorgiousejhd.dns.army$all +||wsdysara1investvwsfs.dns.army$all ||wsdysuresbonescagegp.dns.army$all ||wyklej.pl$all ||x2vn.com$all diff --git a/urlhaus-filter-ag.txt b/urlhaus-filter-ag.txt index 6c00b51a..303bba27 100644 --- a/urlhaus-filter-ag.txt +++ b/urlhaus-filter-ag.txt @@ -1,5 +1,5 @@ ! Title: Malicious URL Blocklist (AdGuard) -! Updated: Thu, 08 Apr 2021 00:12:42 UTC +! Updated: Thu, 08 Apr 2021 12:12:46 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/urlhaus-filter ! License: https://gitlab.com/curben/urlhaus-filter#license @@ -7235,6 +7235,7 @@ ||104.248.45.10$all ||104.248.46.116$all ||104.248.47.15$all +||104.248.48.18$all ||104.248.49.76$all ||104.248.5.108$all ||104.248.5.19$all @@ -8844,6 +8845,7 @@ ||107.173.222.122$all ||107.173.222.123$all ||107.173.222.153$all +||107.173.23.240$all ||107.173.24.139$all ||107.173.24.14$all ||107.173.24.145$all @@ -44052,6 +44054,7 @@ ||115.53.254.154$all ||115.53.254.163$all ||115.53.254.17$all +||115.53.254.187$all ||115.53.254.192$all ||115.53.254.217$all ||115.53.254.218$all @@ -131885,6 +131888,7 @@ ||119.123.216.171$all ||119.123.216.178$all ||119.123.216.184$all +||119.123.216.19$all ||119.123.216.206$all ||119.123.216.208$all ||119.123.216.218$all @@ -155794,6 +155798,7 @@ ||123.4.251.84$all ||123.4.252.12$all ||123.4.252.120$all +||123.4.252.144$all ||123.4.252.159$all ||123.4.252.170$all ||123.4.252.19$all @@ -161130,6 +161135,7 @@ ||123.9.193.144$all ||123.9.193.152$all ||123.9.193.154$all +||123.9.193.157$all ||123.9.193.164$all ||123.9.193.168$all ||123.9.193.179$all @@ -162516,7 +162522,7 @@ ||123moviesfx.com$all ||123sellfast.com$all ||123sex.co$all -||123tadi.com/invoice-status/invoice-0321355444-jun-20$all +||123tadi.com$all ||123xyz.xyz$all ||124.100.74.153$all ||124.105.105.222$all @@ -164896,6 +164902,7 @@ ||124.40.246.95$all ||124.43.216.1$all ||124.45.136.224$all +||124.5.112.43$all ||124.5.203.86$all ||124.5.24.59$all ||124.5.28.41$all @@ -184026,6 +184033,7 @@ ||125.99.220.27$all ||125.99.221.206$all ||125.99.222.152$all +||125.99.222.170$all ||125.99.222.2$all ||125.99.222.245$all ||125.99.222.76$all @@ -187651,6 +187659,7 @@ ||14.42.155.140$all ||14.42.206.204$all ||14.42.229.214$all +||14.42.237.237$all ||14.42.48.241$all ||14.42.53.134$all ||14.42.80.24$all @@ -195364,6 +195373,7 @@ ||172.105.247.88$all ||172.105.36.168$all ||172.105.61.165$all +||172.105.68.51$all ||172.105.69.5$all ||172.105.70.225$all ||172.105.79.99$all @@ -198096,6 +198106,7 @@ ||172.93.162.253$all ||172.93.165.221$all ||172.93.176.137$all +||172.93.176.142$all ||172.93.184.161$all ||172.93.184.71$all ||172.93.187.131$all @@ -202469,6 +202480,7 @@ ||178.169.165.90$all ||178.169.68.162$all ||178.17.170.28$all +||178.17.171.144$all ||178.17.174.43$all ||178.170.117.50$all ||178.170.117.8$all @@ -202490,6 +202502,7 @@ ||178.175.0.125$all ||178.175.0.129$all ||178.175.0.140$all +||178.175.0.143$all ||178.175.0.144$all ||178.175.0.146$all ||178.175.0.149$all @@ -202733,6 +202746,7 @@ ||178.175.10.6$all ||178.175.10.66$all ||178.175.10.71$all +||178.175.10.76$all ||178.175.10.78$all ||178.175.10.8$all ||178.175.10.85$all @@ -203129,6 +203143,7 @@ ||178.175.103.45$all ||178.175.103.48$all ||178.175.103.50$all +||178.175.103.52$all ||178.175.103.54$all ||178.175.103.58$all ||178.175.103.61$all @@ -203252,6 +203267,7 @@ ||178.175.104.62$all ||178.175.104.64$all ||178.175.104.66$all +||178.175.104.67$all ||178.175.104.69$all ||178.175.104.80$all ||178.175.104.85$all @@ -203592,6 +203608,7 @@ ||178.175.107.68$all ||178.175.107.7$all ||178.175.107.70$all +||178.175.107.71$all ||178.175.107.75$all ||178.175.107.76$all ||178.175.107.78$all @@ -204386,6 +204403,7 @@ ||178.175.114.138$all ||178.175.114.142$all ||178.175.114.145$all +||178.175.114.146$all ||178.175.114.15$all ||178.175.114.151$all ||178.175.114.152$all @@ -204642,6 +204660,7 @@ ||178.175.116.195$all ||178.175.116.196$all ||178.175.116.197$all +||178.175.116.20$all ||178.175.116.200$all ||178.175.116.201$all ||178.175.116.207$all @@ -205992,6 +206011,7 @@ ||178.175.127.216$all ||178.175.127.217$all ||178.175.127.219$all +||178.175.127.223$all ||178.175.127.224$all ||178.175.127.225$all ||178.175.127.228$all @@ -206150,6 +206170,7 @@ ||178.175.14.152$all ||178.175.14.153$all ||178.175.14.154$all +||178.175.14.155$all ||178.175.14.156$all ||178.175.14.157$all ||178.175.14.16$all @@ -206544,6 +206565,7 @@ ||178.175.18.202$all ||178.175.18.203$all ||178.175.18.205$all +||178.175.18.214$all ||178.175.18.215$all ||178.175.18.219$all ||178.175.18.22$all @@ -206600,6 +206622,7 @@ ||178.175.19.150$all ||178.175.19.157$all ||178.175.19.158$all +||178.175.19.160$all ||178.175.19.162$all ||178.175.19.163$all ||178.175.19.165$all @@ -206953,6 +206976,7 @@ ||178.175.21.38$all ||178.175.21.39$all ||178.175.21.40$all +||178.175.21.41$all ||178.175.21.42$all ||178.175.21.44$all ||178.175.21.53$all @@ -206979,6 +207003,7 @@ ||178.175.22.116$all ||178.175.22.117$all ||178.175.22.118$all +||178.175.22.120$all ||178.175.22.125$all ||178.175.22.129$all ||178.175.22.13$all @@ -207852,6 +207877,7 @@ ||178.175.3.80$all ||178.175.3.81$all ||178.175.3.85$all +||178.175.3.86$all ||178.175.3.87$all ||178.175.3.94$all ||178.175.3.98$all @@ -208095,6 +208121,7 @@ ||178.175.32.183$all ||178.175.32.184$all ||178.175.32.185$all +||178.175.32.186$all ||178.175.32.190$all ||178.175.32.196$all ||178.175.32.197$all @@ -208232,6 +208259,7 @@ ||178.175.33.26$all ||178.175.33.28$all ||178.175.33.30$all +||178.175.33.32$all ||178.175.33.38$all ||178.175.33.40$all ||178.175.33.50$all @@ -209043,6 +209071,7 @@ ||178.175.40.203$all ||178.175.40.204$all ||178.175.40.205$all +||178.175.40.209$all ||178.175.40.211$all ||178.175.40.218$all ||178.175.40.221$all @@ -209253,6 +209282,7 @@ ||178.175.42.42$all ||178.175.42.44$all ||178.175.42.45$all +||178.175.42.46$all ||178.175.42.48$all ||178.175.42.53$all ||178.175.42.55$all @@ -209771,6 +209801,7 @@ ||178.175.47.217$all ||178.175.47.218$all ||178.175.47.22$all +||178.175.47.220$all ||178.175.47.222$all ||178.175.47.224$all ||178.175.47.226$all @@ -209908,6 +209939,7 @@ ||178.175.48.6$all ||178.175.48.65$all ||178.175.48.66$all +||178.175.48.67$all ||178.175.48.71$all ||178.175.48.76$all ||178.175.48.80$all @@ -210186,6 +210218,7 @@ ||178.175.50.47$all ||178.175.50.48$all ||178.175.50.50$all +||178.175.50.54$all ||178.175.50.55$all ||178.175.50.57$all ||178.175.50.58$all @@ -210797,6 +210830,7 @@ ||178.175.56.57$all ||178.175.56.6$all ||178.175.56.61$all +||178.175.56.64$all ||178.175.56.66$all ||178.175.56.67$all ||178.175.56.69$all @@ -210864,6 +210898,7 @@ ||178.175.57.192$all ||178.175.57.20$all ||178.175.57.203$all +||178.175.57.204$all ||178.175.57.206$all ||178.175.57.209$all ||178.175.57.210$all @@ -211747,6 +211782,7 @@ ||178.175.65.181$all ||178.175.65.184$all ||178.175.65.186$all +||178.175.65.189$all ||178.175.65.19$all ||178.175.65.192$all ||178.175.65.193$all @@ -212233,6 +212269,7 @@ ||178.175.69.73$all ||178.175.69.74$all ||178.175.69.77$all +||178.175.69.79$all ||178.175.69.8$all ||178.175.69.82$all ||178.175.69.83$all @@ -213318,6 +213355,7 @@ ||178.175.79.188$all ||178.175.79.189$all ||178.175.79.196$all +||178.175.79.198$all ||178.175.79.199$all ||178.175.79.200$all ||178.175.79.204$all @@ -213628,6 +213666,7 @@ ||178.175.81.232$all ||178.175.81.235$all ||178.175.81.236$all +||178.175.81.240$all ||178.175.81.241$all ||178.175.81.244$all ||178.175.81.246$all @@ -214128,6 +214167,7 @@ ||178.175.86.106$all ||178.175.86.108$all ||178.175.86.11$all +||178.175.86.117$all ||178.175.86.119$all ||178.175.86.12$all ||178.175.86.122$all @@ -214153,6 +214193,7 @@ ||178.175.86.181$all ||178.175.86.182$all ||178.175.86.183$all +||178.175.86.184$all ||178.175.86.187$all ||178.175.86.188$all ||178.175.86.191$all @@ -214429,6 +214470,7 @@ ||178.175.88.8$all ||178.175.88.83$all ||178.175.88.84$all +||178.175.88.85$all ||178.175.88.95$all ||178.175.89.0$all ||178.175.89.10$all @@ -214829,6 +214871,7 @@ ||178.175.92.1$all ||178.175.92.100$all ||178.175.92.102$all +||178.175.92.105$all ||178.175.92.106$all ||178.175.92.108$all ||178.175.92.109$all @@ -215174,6 +215217,7 @@ ||178.175.95.102$all ||178.175.95.103$all ||178.175.95.104$all +||178.175.95.105$all ||178.175.95.111$all ||178.175.95.112$all ||178.175.95.114$all @@ -215367,6 +215411,7 @@ ||178.175.96.82$all ||178.175.96.87$all ||178.175.96.88$all +||178.175.96.93$all ||178.175.96.95$all ||178.175.96.96$all ||178.175.96.97$all @@ -215621,6 +215666,7 @@ ||178.175.99.207$all ||178.175.99.208$all ||178.175.99.209$all +||178.175.99.21$all ||178.175.99.214$all ||178.175.99.216$all ||178.175.99.22$all @@ -218640,6 +218686,7 @@ ||182.112.173.245$all ||182.112.173.8$all ||182.112.176.47$all +||182.112.177.134$all ||182.112.177.215$all ||182.112.177.93$all ||182.112.178.167$all @@ -261164,6 +261211,7 @@ ||183.83.0.112$all ||183.83.0.192$all ||183.83.0.230$all +||183.83.1.1$all ||183.83.1.221$all ||183.83.1.234$all ||183.83.1.239$all @@ -261276,6 +261324,7 @@ ||183.83.13.17$all ||183.83.13.69$all ||183.83.13.95$all +||183.83.14.20$all ||183.83.14.3$all ||183.83.14.35$all ||183.83.14.70$all @@ -263192,6 +263241,7 @@ ||185.8.202.254$all ||185.8.232.145$all ||185.80.92.4$all +||185.81.154.208$all ||185.81.157.124$all ||185.81.157.186$all ||185.81.98.78$all @@ -272554,6 +272604,7 @@ ||201.171.185.92$all ||201.171.204.13$all ||201.171.227.59$all +||201.171.40.215$all ||201.171.84.139$all ||201.175.63.186$all ||201.182.144.193$all @@ -279497,6 +279548,7 @@ ||213.183.63.124$all ||213.183.63.242$all ||213.186.35.153$all +||213.186.69.101$all ||213.189.178.163$all ||213.195.111.72$all ||213.200.133.18$all @@ -279784,6 +279836,7 @@ ||216.180.117.96$all ||216.180.117.98$all ||216.183.54.169$all +||216.183.54.196$all ||216.189.145.11$all ||216.189.177.221$all ||216.189.184.23$all @@ -279983,6 +280036,7 @@ ||217.12.199.179$all ||217.12.208.14$all ||217.12.209.74$all +||217.12.209.82$all ||217.12.210.156$all ||217.12.210.209$all ||217.12.221.244$all @@ -284477,6 +284531,7 @@ ||219.155.234.12$all ||219.155.234.155$all ||219.155.234.218$all +||219.155.234.33$all ||219.155.235.100$all ||219.155.235.145$all ||219.155.235.154$all @@ -292004,6 +292059,7 @@ ||220.81.201.7$all ||220.81.229.175$all ||220.81.30.193$all +||220.81.44.181$all ||220.81.44.92$all ||220.82.140.17$all ||220.82.182.150$all @@ -299949,6 +300005,7 @@ ||222.137.132.49$all ||222.137.133.110$all ||222.137.133.120$all +||222.137.133.125$all ||222.137.133.195$all ||222.137.133.212$all ||222.137.133.244$all @@ -310175,6 +310232,7 @@ ||222.142.210.122$all ||222.142.210.136$all ||222.142.210.138$all +||222.142.210.144$all ||222.142.210.146$all ||222.142.210.155$all ||222.142.210.163$all @@ -312101,6 +312159,7 @@ ||23.95.11.48$all ||23.95.116.135$all ||23.95.116.144$all +||23.95.122.24$all ||23.95.122.47$all ||23.95.13.131$all ||23.95.13.158$all @@ -326201,6 +326260,7 @@ ||27.5.39.115$all ||27.5.39.121$all ||27.5.39.122$all +||27.5.39.124$all ||27.5.39.127$all ||27.5.39.128$all ||27.5.39.140$all @@ -335139,6 +335199,7 @@ ||27.6.254.187$all ||27.6.254.232$all ||27.6.254.89$all +||27.6.255.101$all ||27.6.255.107$all ||27.6.255.121$all ||27.6.255.160$all @@ -356214,6 +356275,7 @@ ||42.2.137.29$all ||42.202.100.135$all ||42.202.100.233$all +||42.202.101.118$all ||42.202.101.133$all ||42.202.101.136$all ||42.202.101.138$all @@ -357620,6 +357682,7 @@ ||42.224.158.181$all ||42.224.158.206$all ||42.224.158.208$all +||42.224.158.22$all ||42.224.158.227$all ||42.224.158.231$all ||42.224.158.234$all @@ -360572,6 +360635,7 @@ ||42.224.51.213$all ||42.224.51.222$all ||42.224.51.223$all +||42.224.51.229$all ||42.224.51.23$all ||42.224.51.239$all ||42.224.51.75$all @@ -379711,6 +379775,7 @@ ||42.236.212.147$all ||42.236.212.154$all ||42.236.212.155$all +||42.236.212.157$all ||42.236.212.158$all ||42.236.212.159$all ||42.236.212.167$all @@ -389243,6 +389308,7 @@ ||4ele.pl$all ||4ertybhdfrt.gq$all ||4esports.de$all +||4et3ja.am.files.1drv.com$all ||4evakleen.com.au$all ||4eventfacilities.nl$all ||4evernails.nl$all @@ -397793,6 +397859,7 @@ ||59.25.9.121$all ||59.25.9.126$all ||59.26.12.115$all +||59.26.181.228$all ||59.26.20.177$all ||59.26.209.230$all ||59.26.214.148$all @@ -433568,6 +433635,7 @@ ||6481254.ru$all ||649924.nchsoftwarecom.com$all ||64x9bg.ch.files.1drv.com$all +||65.0.168.152$all ||65.0.173.107$all ||65.0.179.146$all ||65.0.55.192$all @@ -433613,6 +433681,8 @@ ||65k2.com$all ||66-gifts.com$all ||66.103.9.249$all +||66.108.199.144$all +||66.109.135.129$all ||66.11.110.27$all ||66.11.125.94$all ||66.110.228.60$all @@ -438425,6 +438495,7 @@ ||88.218.16.87$all ||88.218.16.9$all ||88.218.17.109$all +||88.218.17.110$all ||88.218.17.119$all ||88.218.17.149$all ||88.218.17.179$all @@ -438991,6 +439062,7 @@ ||89.239.96.164$all ||89.244.238.226$all ||89.245.110.35$all +||89.248.112.202$all ||89.248.166.171$all ||89.248.166.183$all ||89.248.167.133$all @@ -441804,7 +441876,7 @@ ||999.buzz$all ||999.co.id$all ||999.rajaojek.com$all -||999080321newfolder1002002131-service1002.space/2.exe$all +||999080321newfolder1002002131-service1002.space$all ||999102com.cn$all ||99bkx.com$all ||99centsdigitals.com$all @@ -444091,6 +444163,7 @@ ||ahiskatv.net$all ||ahitekniktarti.com$all ||ahiyangrup.com.tr$all +||ahjianlong.cf$all ||ahjuric.si$all ||ahk.smu8street.ru$all ||ahkha.com$all @@ -444534,6 +444607,7 @@ ||akivj07.top$all ||akktis.com$all ||akkurtmadencilik.com$all +||aklatdelmundo.com$all ||akleigh.com$all ||aklin.ir$all ||aklocalshop.com$all @@ -445256,7 +445330,8 @@ ||allainesconsultancyinc.com$all ||allamanolibrary.com$all ||allan-it.com$all -||allanabolicsteam.net$all +||allanabolicsteam.net/1301s.bin$all +||allanabolicsteam.net/nedfr_.exe$all ||allanelect.co.uk$all ||allangillphotography.com$all ||allanhollowell.com$all @@ -445539,8 +445614,7 @@ ||aloneintheweb.com$all ||aloneskisehir.com$all ||alongthelines.com$all -||alongwalker.com/flysystem/root/jw3lnl6/$all -||alongwalker.com/flysystem/root/vice4z/$all +||alongwalker.com$all ||alonhadat24h.vn$all ||alooshop.ir$all ||aloravan.com$all @@ -446329,7 +446403,7 @@ ||ana.plecko.eu$all ||anaaj.pk$all ||anabim.com$all -||anabolicsteroidsbuy.info$all +||anabolicsteroidsbuy.info/nedfr.exe$all ||anaceb.com$all ||anadearmas.net$all ||anadelgbt.org$all @@ -450448,7 +450522,7 @@ ||b97pm6.com$all ||ba3capital.com$all ||baacsetu.org$all -||baadababada.ru$all +||baadababada.ru/6jhfa478.exe$all ||baaders-namibia.com$all ||baakcafe.com$all ||baamiraan.ir$all @@ -450575,7 +450649,9 @@ ||backup.xn----8sba7bmrlhv0a.xn--p1ai$all ||backup2.robinandelaine.com$all ||backupcom.e-twow.uk$all -||backupez.com$all +||backupez.com/0902.bin$all +||backupez.com/0902s.bin$all +||backupez.com/6yudfgh.exe$all ||backupfashions.com$all ||backupsitedev.flywheelsites.com$all ||backupsql.datasiswebcontable.com$all @@ -451574,6 +451650,9 @@ ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/6f563873-15ee-468a-963c-db55a58d3c9c/betabotkas.exe?signature=gdqnralwhveftqtdsri62lt6n4a%3d&expires=1547724678&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=htnbcwgf1x8g66tof0fdmfcvqntq8j6s&response-content-disposition=attachment%3b%20filename%3d%22betabotkas.exe%22$all ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/a82aea2f-d076-4e1d-8fcb-8b79898a85be/kas919.exe?signature=8gqnlnixtn40dyz9kpkxenncni0%3d&expires=1547725024&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ft24jaolcop3da_7_ev5xcguooyhq0mq&response-content-disposition=attachment%3b%20filename%3d%22kas919.exe%22$all ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/a88d5da4-e34f-49d9-9c8f-f1576e65844b/bin.exe?signature=ilbhrxqfodu36rc7xziy5s9vtto%3d&expires=1547724674&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ygednlr3gkvc9bkfrgrsowc8pfk.awza&response-content-disposition=attachment%3b%20filename%3d%22bin.exe%22$all +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/62ab596d-a885-41d2-8876-b14668b5131e/test.exe?signature=o3aakhmr7kd9oxnuac8wb06is0a%3d&expires=1617867062&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=4_mbfbxzdu5kgeztrex1qrsberpz4m_z&response-content-disposition=attachment%3b%20filename%3d%22test.exe%22/$all +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/79aaba2e-49c6-496e-abf1-f26c32eb56e5/updatedata.exe?signature=4n9w1uqk%2b1lp%2ff3lekorwfww8ba%3d&expires=1617867048&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=ntaaekydhfciseav0ejmu_rdwfsfnpky&response-content-disposition=attachment%3b%20filename%3d%22updatedata.exe%22/$all +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/98b527aa-e517-43ca-bf97-61bc2c51d865/3.exe?signature=qizcxni%2bqskgnanrwlk6babc7gs%3d&expires=1617867059&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=hdqursidmznzrtifyejabx_aaqxteyx7&response-content-disposition=attachment%3b%20filename%3d%223.exe%22/$all ||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/ace278db-4135-41d0-9914-3840b10de6de/omar.exe?signature=zh8efir48pny30f9uatznyf7puy%3d&expires=1617787873&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=nmiv.lpuhma2umwgepxsqa6bjvoohvwj&response-content-disposition=attachment%3b%20filename%3d%22omar.exe%22/$all ||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/f5937654-faa6-44a4-939b-6632f91d8299/1.exe?signature=taz6uveuqvjuzvn2aucvklvyixg%3d&expires=1617787746&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=rbdipgvc.xku0.3vh3rdr2jjaah4y9ei&response-content-disposition=attachment%3b%20filename%3d%221.exe%22/$all ||bbuseruploads.s3.amazonaws.com/1ca1b493-e3b6-4b15-85b8-6446db1ece85/downloads/7ebfb5bd-7d4a-4f02-8ecf-5eec0bdca52c/encrypthei111.exe?signature=h0xssthbungwekotfbufgav%2fn4m%3d&expires=1540254951&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ug_edq2nmoosommijyajne8h9oqvpdyj&response-content-disposition=attachment%3b%20filename%3d%22encrypthei111.exe%22$all @@ -452072,7 +452151,7 @@ ||belaythakayni.com$all ||belboks.com$all ||belboy.in$all -||belcineloweek.ru$all +||belcineloweek.ru/6sufiuerfdvc.exe$all ||belconger.com$all ||belcorpisl.com$all ||belcvet.com$all @@ -453718,7 +453797,9 @@ ||bitbucket.org/mixmix2312/test1/downloads/2_5221939375847244827.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/1.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/12345.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/2.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/24.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/3.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/33333.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/5kmaraafterupdate.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/asyncclient.exe$all @@ -453726,14 +453807,21 @@ ||bitbucket.org/mminminminmin05/testtest/downloads/clr3.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/coohom.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/darting.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/dianthus.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/flesh.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/income.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/instaler.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/installer.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/jayson.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/looseboxes.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/n.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/newred.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/omar.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/petite.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/serv.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/test.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/updachrome.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/updatedata.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/updatej.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/updatev.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/work.exe$all @@ -455184,7 +455272,7 @@ ||bobbyworld.top$all ||bobcar.com.my$all ||bobcatofchico.com$all -||bobcatofredding.com$all +||bobcatofredding.com/6lavfdk.exe$all ||bobcook.ca$all ||bobdolph.com$all ||bobenstetter.net$all @@ -456460,7 +456548,9 @@ ||bucketstrong.s3-us-west-1.amazonaws.com$all ||buckeyechartershiltonhead.com$all ||buckeyeoptical.com$all -||buckeyesecurity.net$all +||buckeyesecurity.net/55.exe$all +||buckeyesecurity.net/6lajhbjyuk.exe$all +||buckeyesecurity.net/99.exe$all ||buckinghamandlloyds.com$all ||buckleman.co.id$all ||bucklindata.net$all @@ -456549,6 +456639,7 @@ ||buildcraftindia.com$all ||buildentconstructions.com$all ||builder.acasia.mx$all +||builder.makemoneywith.website$all ||buildersmerchantsfederation-my.sharepoint.com$all ||buildgreenindustries.com$all ||building-company.lt$all @@ -457100,7 +457191,19 @@ ||c.oooooooooo.ga$all ||c.pieshua.com$all ||c.teamworx.ph$all -||c.top4top.io$all +||c.top4top.io/p_147087hzx1.jpg$all +||c.top4top.io/p_1532pr67j1.jpg$all +||c.top4top.io/p_1540ryl6d1.jpg$all +||c.top4top.io/p_1546x5lcf1.jpg$all +||c.top4top.io/p_1549kf97p1.jpg$all +||c.top4top.io/p_1552ns6vj1.jpg$all +||c.top4top.io/p_1557q815n1.jpg$all +||c.top4top.io/p_1568qxo7y1.jpg$all +||c.top4top.io/p_1568qxo7y1.jpg%25temp%25/exploit.exe$all +||c.top4top.io/p_1568qxo7y1.jpg/,/%25temp%25/exploit.exe$all +||c.top4top.io/p_1568qxo7y1.jpg/,/demp8exploit.exe$all +||c.top4top.io/p_399718uh1.jpg$all +||c.top4top.io/p_769a2vuu1.jpg$all ||c.top4top.net$all ||c.vivi.casa$all ||c.vollar.ga$all @@ -457797,6 +457900,7 @@ ||capitalonefinanceltd.in$all ||capitalpellets.com$all ||capitalpremiumfinancinginc.com$all +||capitalprint.co.za$all ||capitalprivateasset.com$all ||capitalrealestate.us$all ||capitalrh.com.br$all @@ -463663,6 +463767,7 @@ ||covid19map.digital$all ||covid19quarantin.com$all ||covid19safety.myftp.org$all +||covid19vaccinations.hopto.org$all ||covid19vaccine.hopto.org$all ||covid2023.info$all ||covidbase.info$all @@ -465057,8 +465162,7 @@ ||daclim.ro$all ||daco-precision.thomaswebs.net$all ||daco.nyccomputerconsulting.com$all -||dacsancaonguyen.vn/zahlung/ihre-rechnung-vom-19.06.2018$all -||dacsancaonguyen.vn/zahlung/ihre-rechnung-vom-19.06.2018/$all +||dacsancaonguyen.vn$all ||dactridaudaday.com$all ||dactyltech.co.za$all ||dacviadokese.com$all @@ -470075,6 +470179,7 @@ ||docs.google.com/uc?export=download&id=1pznr49e9zygatrbyaapcstyynzufnemb$all ||docs.google.com/uc?export=download&id=1qct-px0g0tbmlh1an8zj5mvuerlpgbmc$all ||docs.google.com/uc?export=download&id=1qjmp0rortmdcx6iw6bwg2lgmarp7tm6p$all +||docs.google.com/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq$all ||docs.google.com/uc?export=download&id=1skyxw1azoujpviuqwekdcswpetys0r0x$all ||docs.google.com/uc?export=download&id=1svw14oszom6u2idng91npzvelpdedg9f$all ||docs.google.com/uc?export=download&id=1tm4rkvjulxvp7vd74irl9ffxc9crf9-t$all @@ -473649,6 +473754,7 @@ ||drive.google.com/uc?export=download&id=11gsxnbxefe18c1fayv9kpdessdsxuox3$all ||drive.google.com/uc?export=download&id=11hlymahuojfpno7tmmbv45n8f9vxrlo2$all ||drive.google.com/uc?export=download&id=11hywwyjrqpp_ikeacqo9vp_uwl1lacfv$all +||drive.google.com/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g$all ||drive.google.com/uc?export=download&id=11jvqxpsgamyxn2bs-mimud000fiblzol$all ||drive.google.com/uc?export=download&id=11m7m9sk_a6jz-zynoebg3_vllij8t9gl$all ||drive.google.com/uc?export=download&id=11mai5fg0ndvbucaqg1fmyjyzdbz45wos$all @@ -473969,6 +474075,7 @@ ||drive.google.com/uc?export=download&id=16wefm-laijdif5buz5gn5yzg2kqymuym$all ||drive.google.com/uc?export=download&id=16xqdz6demm6-fjhrkbvgicq7j3icwmqm$all ||drive.google.com/uc?export=download&id=16y49-qajyjh-yksifcv1whrhb3gh4mkx$all +||drive.google.com/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo$all ||drive.google.com/uc?export=download&id=16zaoyqq3hh_m8sovikos2t_1j31l8q-f$all ||drive.google.com/uc?export=download&id=16zoens9l0ihufsnqxrckemwyfryad8am$all ||drive.google.com/uc?export=download&id=171wawwgvyvp56ovqsiffcgiplgapv7du$all @@ -474526,6 +474633,7 @@ ||drive.google.com/uc?export=download&id=1czxia7zmban2iwm9g4eqal6baypcvjwp$all ||drive.google.com/uc?export=download&id=1czzcmluc-6sn5li9hscxypui517paxqk$all ||drive.google.com/uc?export=download&id=1d-imno2z1s3iutwb9trmwacjsxqc7hn4$all +||drive.google.com/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a$all ||drive.google.com/uc?export=download&id=1d0m4cqjbvfhzfitoubaunivmuwrcgyut$all ||drive.google.com/uc?export=download&id=1d0u_leb4wavx9sbumbjwf-fiatvzuyht$all ||drive.google.com/uc?export=download&id=1d1gdo27aqr62g77-u4jgszuiyky-3omp$all @@ -475473,6 +475581,7 @@ ||drive.google.com/uc?export=download&id=1lcwyjkohcqf8z_tzw5yppfdshn9qcgvp$all ||drive.google.com/uc?export=download&id=1ldin3nuq2pmmds2nu1m7yjguqvkjbn7b$all ||drive.google.com/uc?export=download&id=1ldre4vit7jc9ciscyyoy--ue8m6b3wet$all +||drive.google.com/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx$all ||drive.google.com/uc?export=download&id=1le0k4iifbtutn31lollip2ndnjjzwu3t$all ||drive.google.com/uc?export=download&id=1lenovtgyahbqrmdh4gvidedxsqsxcqng$all ||drive.google.com/uc?export=download&id=1lfbieysyp7ecko2wk6a_dxosuhah5gko$all @@ -476539,6 +476648,7 @@ ||drive.google.com/uc?export=download&id=1uiek1-hkcz_kuautcbha5obu2wyaicjj$all ||drive.google.com/uc?export=download&id=1uij6fctuvcj5sqfiw_6k6tvzuyyr0qvz$all ||drive.google.com/uc?export=download&id=1uiqfiaaur7lq7kghcs3ek0rmgaqcqipi$all +||drive.google.com/uc?export=download&id=1uiymxywv0cam8b_bx3ifheiccdwrpsgl$all ||drive.google.com/uc?export=download&id=1uiypry6ez_orivyk4tvmdwyu4_tjjrkz$all ||drive.google.com/uc?export=download&id=1ujel8erdfkvprr1raazydwk6zt7oz17c$all ||drive.google.com/uc?export=download&id=1ujh009daen23wkjfrimopajys9egkz_q$all @@ -476711,6 +476821,7 @@ ||drive.google.com/uc?export=download&id=1vnrnjgf4nyvltipw_ami0pwriq385owf$all ||drive.google.com/uc?export=download&id=1vofmbumt47vaguwg3pofrgr-fcnncwqz$all ||drive.google.com/uc?export=download&id=1vol90krth76axaj0aec6buewa_gltmnl$all +||drive.google.com/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy$all ||drive.google.com/uc?export=download&id=1vp4zqvjtszxigadqtb-8xcgg41xwtq1o$all ||drive.google.com/uc?export=download&id=1vp7dvftbhbukky4gboj74otqegmterpy$all ||drive.google.com/uc?export=download&id=1vpbvepuxtchttkdn778iui6z0f3qb17j$all @@ -484109,6 +484220,7 @@ ||dropbox.com/s/3eouwywbww75819/firefox_67.3.49.js?dl=1$all ||dropbox.com/s/3gs4b28h0fwnu8n/document%23092372.zip?dl=1$all ||dropbox.com/s/3h6rm65zh1fxpma/view_presentation%23812016.zip?dl=1$all +||dropbox.com/s/3h8r4ocqh538jqb/gnl_309383_98484984_fil.ace?dl=1$all ||dropbox.com/s/3hcdcs4ry1onngu/job_presentation3-o4o%23739818.zip?dl=1$all ||dropbox.com/s/3j3s5bx0l92k26u/presentation%23028315.zip?dl=1$all ||dropbox.com/s/3jkdlvraflp3n4j/revised%20purchase%20order-1271.pdf.z?dl=1$all @@ -484141,6 +484253,7 @@ ||dropbox.com/s/3we3su2myn86btk/tesla%20test%20drive%20form_069.xlsm?dl=1$all ||dropbox.com/s/3xawa42sndz31d9/payment.exe?dl=1$all ||dropbox.com/s/3y14090hgs5m0sq/job_presentation-v8b%23499627.zip?dl=1$all +||dropbox.com/s/3yznspctui3k8zl/ma_i303987365367_39873663.dwg.z?dl=1$all ||dropbox.com/s/3z82nworc51b233/w.exe?dl=1$all ||dropbox.com/s/3zevj1sodcingo1/job_attach-a0y%23608602.zip?dl=1$all ||dropbox.com/s/3zjaltv8uar3icz/job_attach-o6o%23113013.zip?dl=1$all @@ -484529,6 +484642,7 @@ ||dropbox.com/s/8ucyd7r1qdi36dt/sale%20info_7696.doc?dl=1/$all ||dropbox.com/s/8ukquaz8h4xdx7n/presentation2-y3w%23946922.zip?dl=1$all ||dropbox.com/s/8uwp9x8u1rwysr9/presentation1-g6v%23145582.zip?dl=1$all +||dropbox.com/s/8v69kjai7vmvb40/acg_08376335_98tv.zdx.z?dl=1$all ||dropbox.com/s/8vcilbzyndbn5yi/job_presentation3-f5l%23783807.zip?dl=1$all ||dropbox.com/s/8vf1x8wwevbt6ys/job_presentation2-j8f%23856887.zip?dl=1$all ||dropbox.com/s/8vkcwcctx60hmo5/view_attach1-l1s%23332381.zip?dl=1$all @@ -484879,6 +484993,7 @@ ||dropbox.com/s/ch14in78gw2rhvu/document%23065239.zip?dl=1$all ||dropbox.com/s/ch7b5csbjb9pc7d/as_984498_04984498.xls.z?dl=1$all ||dropbox.com/s/chcld4b17zi0syr/view_presentation2-d4g%23742135.zip?dl=1$all +||dropbox.com/s/chpdzsp7nxbzh7n/ga_39848_3098559858tg.ace?dl=1$all ||dropbox.com/s/chqs02hqmmxw5gg/view_attach-t8k%23476796.zip?dl=1$all ||dropbox.com/s/chvagrgoasst0o6/job_attach1-b1q%23061922.zip?dl=1$all ||dropbox.com/s/cizaigubmr6oyoe/job_presentation%23985151.zip?dl=1$all @@ -484939,6 +485054,7 @@ ||dropbox.com/s/d42kueksf898va0/job_presentation2-j8f%23181888.zip?dl=1$all ||dropbox.com/s/d4bxv7inwn32lz2/swift_a09af.pdf.z?dl=1$all ||dropbox.com/s/d4iqffd15212s06/view_attach%23990300.zip?dl=1$all +||dropbox.com/s/d5efh42pwwz6j0g/tkas_9387635_93876353pmnb.ace?dl=1$all ||dropbox.com/s/d5gmgo0y48zfffu/presentation2-c6m%23417932.zip?dl=1$all ||dropbox.com/s/d5hx06nobawy5oo/job_attach%23751825.zip?dl=1$all ||dropbox.com/s/d67zrpka5ahro1e/my_presentation1-y5p%23783447.zip?dl=1$all @@ -484965,6 +485081,7 @@ ||dropbox.com/s/ddiu5wa7pu9pbbs/my_attach1-w3n%23509754.zip?dl=1$all ||dropbox.com/s/de7cvnotolldsry/my_presentation2-s5o%23937289.zip?dl=1$all ||dropbox.com/s/df3azbvw9jjp7st/job_attach2-q6k%23845555.zip?dl=1$all +||dropbox.com/s/dfcp3j7tx3jod54/nvc_039387367_03987783_remi.ace?dl=1$all ||dropbox.com/s/dfgnzlyx9tyqy73/psd_0398763pf_0398763.jpg.z?dl=1$all ||dropbox.com/s/dfku3gn9k792xcj/job_attach-m4j%23948073.zip?dl=1$all ||dropbox.com/s/dfytqktkuux7x8z/shipment_inv14012020_8349462174917197.zip?dl=1$all @@ -485569,6 +485686,7 @@ ||dropbox.com/s/iuhsc0w4lcrlxu1/job_attach3-j3a%23912834.zip?dl=1$all ||dropbox.com/s/iv3ntusd5ramxmm/view_presentation2-e5l%23020200.zip?dl=1$all ||dropbox.com/s/iw827thar5ojsmx/shipment_inv14012020_2117170331383099.zip?dl=1$all +||dropbox.com/s/iwijqd0727v498t/brd_039837635tr.xqd.z?dl=1$all ||dropbox.com/s/iwvd2hj1natp6x9/shipment_inv14012020_0622285188305203.zip?dl=1$all ||dropbox.com/s/ixzb0pn24kk8tkf/my_presentation1-d4r%23765170.zip?dl=1$all ||dropbox.com/s/iywgs1vgbluhwd7/view_attach2-m5m%23071565.zip?dl=1$all @@ -485577,6 +485695,7 @@ ||dropbox.com/s/j0hkz3yl0trmgo4/scan00121payment%20advice.pdf.z?dl=1$all ||dropbox.com/s/j0whqr8w70hyl81/my_attach-y2q%23418191.zip?dl=1$all ||dropbox.com/s/j0zlq5s3r0anso1/view_presentation-o8w%23103520.zip?dl=1$all +||dropbox.com/s/j1f32ta7ne2afpt/m0987655678_0098765456789.pdf.z?dl=1$all ||dropbox.com/s/j26bp911xqr9f49/presentation1-i8d%23940410.zip?dl=1$all ||dropbox.com/s/j2xpr3dy5thu2wr/quotation.zip?dl=1$all ||dropbox.com/s/j36iy9wmxvpkyhi/please%20quote.pdf.z?dl=1$all @@ -485958,6 +486077,7 @@ ||dropbox.com/s/o40cbmvywx9dvoh/shipment_inv14012020_42720565334420.zip?dl=1$all ||dropbox.com/s/o4ertlnxsqga5e1/my_presentation2%23076148.zip?dl=1$all ||dropbox.com/s/o4i7eo876zf2m2h/my_presentation1-y9c%23495955.zip?dl=1$all +||dropbox.com/s/o52jtgaurbr0psg/ga_39848_3098559858tg.xyz.z?dl=1$all ||dropbox.com/s/o5d4h3o8ny7mizb/job_attach-o2i%23251881.zip?dl=1$all ||dropbox.com/s/o5qrg7hha11t37f/invoice.zip?dl=1$all ||dropbox.com/s/o6e58l1m3xsxrby/scan_0023.pdf.z?dl=1$all @@ -486217,6 +486337,7 @@ ||dropbox.com/s/rlt9yeyuds5k957/my_attach-z3r%23383174.zip?dl=1$all ||dropbox.com/s/rmabkd6y1l83u25/view_attach1-q4t%23572679.zip?dl=1$all ||dropbox.com/s/rmo8rji173i1cat/q~20939876467_039876373.xls.z?dl=1$all +||dropbox.com/s/rmum3v29ojs3jjl/frg_039873653_0398736gb.xl.z?dl=1$all ||dropbox.com/s/rmw5gw1frkxegnd/document%23134519.zip?dl=1$all ||dropbox.com/s/rnhqz4sklt052q9/my_presentation-e5i%23917388.zip?dl=1$all ||dropbox.com/s/ro9loec8bdadiu6/outstandingpayment1.pdf.z?dl=1$all @@ -486234,6 +486355,7 @@ ||dropbox.com/s/rzqibz0q7ef37q4/job_presentation-u1o%23972507.zip?dl=1$all ||dropbox.com/s/s03fa34t6uob3h8/view_attach3-j7n%23364470.zip?dl=1$all ||dropbox.com/s/s07zqja5t5qb8kq/presentation1-p3c%23753652.zip?dl=1$all +||dropbox.com/s/s0irg599646bovm/dg~00856876789-99023467890.pdf.z?dl=1$all ||dropbox.com/s/s19lgurhguz8b01/shipment_inv14012020_641001405594.zip?dl=1$all ||dropbox.com/s/s23n0jjsjzy4wa8/po-280717888.zip?dl=1$all ||dropbox.com/s/s2yfo0ez7lq1ev7/shipment_inv14012020_8059855817809796.zip?dl=1$all @@ -490589,6 +490711,7 @@ ||estimating.training$all ||estimatorfind.com$all ||estimetercume.com$all +||estjh05.top$all ||estomedic.com/dlt_ge5pemsy_qdvlz3/$all ||estore.qurvex.com$all ||estoyadieta.com$all @@ -490772,7 +490895,8 @@ ||etysu02scnabr03wzaxue.com$all ||eu-central-1.protection.sophos.com/?d=shenovacengineers.com&u=ahr0cdovl3nozw5vdmfjzw5naw5lzxjzlmnvbs9jz2ktymlul3bhew1lbnqvotfuenjhl3eyaxjqd281mdazmta3mdc3mzi0nzk2otq2ehnrdtdndzb5zxnklw==&e=aw5mb0bpbmdlbmlldxjidwvyby13zw56zwwuzgu=&t=rfrkuwv2s2lmz2u5a21qdgfvt1fjv3lwowddexe0bjnruxu2ry9jqwp4nd0=&h=87530880db9148fc91a5d1ba1d0c8718/$all ||eu-easy.com$all -||eu.wildfire.paloaltonetworks.com$all +||eu.wildfire.paloaltonetworks.com/panos/sample/cloud/wi9nuhhlykdoowr2yteyqkh4ulhluzrcqjhuudvqwxnhynbgrelsr2prsjjlk3zpq3bhoe1yqnbubnjsnvmxqlm0wmevevhttgpdr29fv0e1du9dv0w1vtzzwtzzl01srm1fugtwuwjjmwwrtusyzjfdmhpwbuthm0h5ectkekmvsexwvwprznnhbkq1wnddrepwv0fvrjvaznnicfdzszh0dflszw5samxnb0kybuvdykrstnf3dc9hwxl5l3l6/$all +||eu.wildfire.paloaltonetworks.com/report/box/bfc63aa44052b156fa742965595beb250276fbb18c6011d9f06f5b6059f336b7/19668968921/$all ||eu1.salesforce.com$all ||eu283iwoqodjspqisjdf.com$all ||eu5-cdn.devid.info$all @@ -493084,7 +493208,9 @@ ||files.gamebanana.com/tools/enchanced_server_picker.exe$all ||files.gamebanana.com/tools/tagconverter.exe$all ||files.gathercdn.com$all -||files.hrloo.com$all +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc$all +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc?n=w+eyvuwtgv3lkzjlt6xln7norq3nrqhnkiblilbluqyuzg9j$all +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc?n=weyvuwtgv3lkzjlt6xln7norq3nrqhnkiblilbluqyuzg9j$all ||files.jivosite.com/file-transfer/1621967/2021-03-16/55ec600e4e6500e080c5.doc$all ||files.l-d.tech$all ||files.lashawnbarber.com/$all @@ -494871,6 +494997,7 @@ ||friendzonecafe.com$all ||frietfun.be$all ||frigolutasima.net$all +||frigoprehrana.com$all ||frigoriferivignola.it$all ||frigosistem.com.tr/olj7rnst1.jpg$all ||frigotechniek.be$all @@ -495447,7 +495574,8 @@ ||fv13.failiem.lv$all ||fv15.failiem.lv$all ||fv2-1.failiem.lv/down.php?cf&i=hyg2rxaa&n=new_payment.doc&download_checksum=afa67b9a5998eca281cda22f5585e9dcf764128a&download_timestamp=1547330846$all -||fv2-2.failiem.lv$all +||fv2-2.failiem.lv/down.php?cf&i=my59dhhv&n=2562.xls$all +||fv2-2.failiem.lv/down.php?cf&i=redm59qf&n=dfg-016.xls$all ||fv2-7.failiem.lv$all ||fv3.failiem.lv$all ||fv6.failiem.lv$all @@ -495528,7 +495656,7 @@ ||g0zh8lb3.com$all ||g15aocbenedict.com$all ||g1ba4tt4ngq5nl7w.xyz$all -||g1smurt.ru$all +||g1smurt.ru/6jiuu8934u.exe$all ||g20digital.com.br$all ||g237.cn$all ||g2creditsolutions.com$all @@ -495619,9 +495747,10 @@ ||gadaniya-magiya.site$all ||gadcoafrica.com$all ||gaddco.com$all -||gade4senate.com$all -||gadebrigade.com$all -||gadeforussenate.com$all +||gade4senate.com/dfgg45g.exe$all +||gade4senate.com/m.dll$all +||gadebrigade.com/783s.exe$all +||gadeforussenate.com/163.exe$all ||gadem.ug$all ||gadesoluciones.pe$all ||gadget-plaza.ru$all @@ -497953,7 +498082,7 @@ ||gomitra.com$all ||gomovies.cl$all ||gomsubattrangxuatkhau.com$all -||gomsuminhlongthainguyen.vn/wp-includes/statement/trb4t-2766-65677976-vlvfxh32a-yg8z93/$all +||gomsuminhlongthainguyen.vn$all ||gomus.com.br$all ||gomyfiles.info$all ||gomypass.com$all @@ -499518,7 +499647,8 @@ ||h.epelcdn.com$all ||h.eurotrading.com.pl$all ||h.j990981.ru$all -||h.top4top.io$all +||h.top4top.io/p_14754cwzr1.jpg$all +||h.top4top.io/p_1593skpl71.jpg$all ||h.valerana44.ru$all ||h002295863.nichost.ru$all ||h0h.org$all @@ -501824,7 +501954,160 @@ ||home.99eurowebsite.ie$all ||home.barley-plus.com$all ||home.dawang.ink$all -||home.earthlink.net$all +||home.earthlink.net/~4winds1/dec3th.exe$all +||home.earthlink.net/~4winds1/imortantdocument.exe$all +||home.earthlink.net/~adminawg/usps/shipping-label/shipping-label(e-copy).jar$all +||home.earthlink.net/~archbarrett/adobe/0.37646700%201523567821.jar$all +||home.earthlink.net/~archbarrett/amazon-order-copy.jar$all +||home.earthlink.net/~archbarrett/donation/donation.jar$all +||home.earthlink.net/~archbarrett/dropbox/reference~ecopy.jar$all +||home.earthlink.net/~archbarrett/file2018.jar$all +||home.earthlink.net/~banderso1066/e~label.jar$all +||home.earthlink.net/~baysidejetdrive/shipment-label.jar$all +||home.earthlink.net/~bigrose26/12-21-2017.jar$all +||home.earthlink.net/~bigrose26/shipment/shipment-label.jar$all +||home.earthlink.net/~captaindiego/amazon/amazon.jar$all +||home.earthlink.net/~captaindiego/ecopy/ecopy.jar$all +||home.earthlink.net/~captaindiego/fedex/ecopy.jar$all +||home.earthlink.net/~captaindiego/fedex/fedex-shipping-label.jar$all +||home.earthlink.net/~captaindiego/software/ecopy.jar$all +||home.earthlink.net/~carwashregional/ship/ups~label.jar$all +||home.earthlink.net/~cathygrellet/data/saved/order.jar$all +||home.earthlink.net/~cathygrellet/dropbox/saved/artwork.jar$all +||home.earthlink.net/~cathygrellet/filemanager/order.jar$all +||home.earthlink.net/~cathygrellet/javto/print.jar$all +||home.earthlink.net/~cathygrellet/ship/info/usps%20order.jar$all +||home.earthlink.net/~craigbayhi/1-9-2018.jar$all +||home.earthlink.net/~craigslane/fedex-shipment~label.jar$all +||home.earthlink.net/~cvaleallen/delivery-report.jar$all +||home.earthlink.net/~cvaleallen/ups-shipping-details.jar$all +||home.earthlink.net/~cvaleallen/your-shipping-details.jar$all +||home.earthlink.net/~dalegibson/shipping-label.jar$all +||home.earthlink.net/~dalegibson/shipping_details.jar$all +||home.earthlink.net/~damturney/invoice/invoice_05122017_outputcca6aaf.scr$all +||home.earthlink.net/~damturney/invoice27112017/invoice_output68cf6b0.scr$all +||home.earthlink.net/~damturney/invoice27112017/newinvoice/invoice_04122017_output7bca030.scr$all +||home.earthlink.net/~damturney/specification/invoice04122017_output13026b0.scr$all +||home.earthlink.net/~davidtrojan/ups/ecopy.jar$all +||home.earthlink.net/~dcamjr/invoice20180205.exe$all +||home.earthlink.net/~dcmusicbox/usp/tracking~details.jar$all +||home.earthlink.net/~decalgene/ups_tracking.jar$all +||home.earthlink.net/~dvidmar1/shipment-label.jar$all +||home.earthlink.net/~ebony319/shippinglabel(e-copy).jar$all +||home.earthlink.net/~edclarkortho/label/e~label.jar$all +||home.earthlink.net/~edclarkortho/shipmentlabel.jar$all +||home.earthlink.net/~ellenweiss/new_message.jar$all +||home.earthlink.net/~ersinc/0.06213400%201521213842.jar$all +||home.earthlink.net/~ersinc/directory/ecopy.jar$all +||home.earthlink.net/~ersinc/ebay/ecopy00017717.jar$all +||home.earthlink.net/~ersinc/ecopy/ups.jar$all +||home.earthlink.net/~ersinc/order/order.jar$all +||home.earthlink.net/~ersinc/usps/order.jar$all +||home.earthlink.net/~fahertydoc/data/qrypted.janvy.jar$all +||home.earthlink.net/~fahertydoc/return-label.jar$all +||home.earthlink.net/~fahertydoc/usps~label.jar$all +||home.earthlink.net/~flajobs/e~label.jar$all +||home.earthlink.net/~flajobs/fedex/ecopy.jar$all +||home.earthlink.net/~flajobs/fedex~e~label.jar$all +||home.earthlink.net/~flajobs/shipment~label.jar$all +||home.earthlink.net/~freshourglen/5-2-2018.jar$all +||home.earthlink.net/~g.rhoads/dhl(view_shipping_label).jar$all +||home.earthlink.net/~g.rhoads/fedex/fedex.jar$all +||home.earthlink.net/~g.rhoads/ups(view-delivery-copy).jar$all +||home.earthlink.net/~georgejagels/usps-shipment-label.jar$all +||home.earthlink.net/~gouette/%20corel%20digital/%20license.jar$all +||home.earthlink.net/~gouette/data/license.jar$all +||home.earthlink.net/~gouette/docusign/documentfile.jar$all +||home.earthlink.net/~gouette/fedex/fedexcopy.jar$all +||home.earthlink.net/~gouette/invoice/document.jar$all +||home.earthlink.net/~gouette/trade/tradecopy.jar$all +||home.earthlink.net/~gouette/trade/tradecopy.zip$all +||home.earthlink.net/~grabanski/cve2017jar.zip$all +||home.earthlink.net/~itshq/usps_tracking.jar$all +||home.earthlink.net/~james.pender/shipping-label.jar$all +||home.earthlink.net/~jmzegan/your-order.jar$all +||home.earthlink.net/~joserealty/ecopy/ecopy.jar$all +||home.earthlink.net/~joserealty/webdocs/01/11-28-2017.jar$all +||home.earthlink.net/~joserealty/webdocs/02/11-30-2017.jar$all +||home.earthlink.net/~joserealty/webdocs/03/12-8-2017.jar$all +||home.earthlink.net/~kentscott4643/trk_fedex_46866461644881255.jar$all +||home.earthlink.net/~kmc2read/paypal/ecopy.jar$all +||home.earthlink.net/~kmc2read/ups/ups.jar$all +||home.earthlink.net/~ksak/fedex/shipping-label(e-copy).jar$all +||home.earthlink.net/~ksak/fedex/tobeused300.jar_javacrypt2.jar$all +||home.earthlink.net/~lorrainebubar/usps-shipping-label.jar$all +||home.earthlink.net/~loubill/ups.jar$all +||home.earthlink.net/~macjanutol/01-29-2019.jar$all +||home.earthlink.net/~macjanutol/01-29-20199.jar$all +||home.earthlink.net/~macjanutol/02-2-2019.jar$all +||home.earthlink.net/~macjanutol/cdv%20book%20k-2%20pag47.zip$all +||home.earthlink.net/~margolisme/12.16.17.jar$all +||home.earthlink.net/~margolisme/eopy/e-copy.jar$all +||home.earthlink.net/~michlee/trk_fedex_46866461644881255.jar$all +||home.earthlink.net/~mkramer65/dropbox_upgrade.jar$all +||home.earthlink.net/~mkramer65/fedex_shippinglabel.jar$all +||home.earthlink.net/~mkramer65/scan-copy.exe$all +||home.earthlink.net/~mnludvik/01-21-2019.jar$all +||home.earthlink.net/~mnludvik/1-21-2019.jar$all +||home.earthlink.net/~morrisonb/date/fedex.jar$all +||home.earthlink.net/~morrisonb/ecopy/fedex.jar$all +||home.earthlink.net/~morrisonb/softcopy/e-copy.jar$all +||home.earthlink.net/~narcisocortez/shipping_verification.1.0.1.1.1.1.0.jar$all +||home.earthlink.net/~ncfire/usps-shipping-label.jar$all +||home.earthlink.net/~ncgreen2/e-log.jar$all +||home.earthlink.net/~ngardels/112220188.exe$all +||home.earthlink.net/~ngardels/26112018.exe$all +||home.earthlink.net/~p3nd3r/shipment~label.jar$all +||home.earthlink.net/~p3nd3r/shipping-label.jar$all +||home.earthlink.net/~palmermusic/1-04-2018.jar$all +||home.earthlink.net/~peggylegault/june-25-2018.jar$all +||home.earthlink.net/~pepper12/shipping-label.jar$all +||home.earthlink.net/~pepper12/ups_invoice.jar$all +||home.earthlink.net/~pgregory2/ups/upstracker.jar$all +||home.earthlink.net/~phwilson/case_details.jar$all +||home.earthlink.net/~phwilson/e~label.jar$all +||home.earthlink.net/~phwilson/paypal_credit_info.jar$all +||home.earthlink.net/~prislen/ups_z10023838484.exe$all +||home.earthlink.net/~rclaws35/245646572983677974505708.jar$all +||home.earthlink.net/~rclaws35/61234567.jar$all +||home.earthlink.net/~rclaws35/package~label.jar$all +||home.earthlink.net/~rclaws35/re/shipment~label.jar$all +||home.earthlink.net/~rclaws35/shipment~label.jar$all +||home.earthlink.net/~roib/usps/usps~order~copy.jar$all +||home.earthlink.net/~roib/usps/usps~tracking~receipt.jar$all +||home.earthlink.net/~rsellsema/fedex/fedex.jar$all +||home.earthlink.net/~rsellsema/ups/ups.jar$all +||home.earthlink.net/~ruthtraa/shipment-label.jar$all +||home.earthlink.net/~rwhall38/01/3-28-2018.jar$all +||home.earthlink.net/~sallyhansen1/usps-shipment~label.jar$all +||home.earthlink.net/~sallyhansen1/usps_delivery.jar$all +||home.earthlink.net/~sherylhagen/usps-shipment-label.jar$all +||home.earthlink.net/~sherylhagen/usps~label.jar$all +||home.earthlink.net/~sidewinder4/comfirm(delivery-details).jar$all +||home.earthlink.net/~sidewinder4/ecopy/ups.jar$all +||home.earthlink.net/~sltdmd/ebay01.jar$all +||home.earthlink.net/~sltdmd/ups-shipping-label.jar$all +||home.earthlink.net/~suzystar/brief/invoice/order/ratata.qrypted.jar$all +||home.earthlink.net/~suzystar/cgggihfdyjojok/ecopy.jar$all +||home.earthlink.net/~suzystar/ecopy/e-copy.jar$all +||home.earthlink.net/~suzystar/pp/luv.qrypted.jar$all +||home.earthlink.net/~suzystar/ups~costomer~service.jar$all +||home.earthlink.net/~suzystar/usps-shipment-label.jar$all +||home.earthlink.net/~thfenner/shipping-label-ecopy.jar$all +||home.earthlink.net/~timstaacke/ecopy/ecopy.jar$all +||home.earthlink.net/~timstaacke/fedex(efile).jar$all +||home.earthlink.net/~tom12345678/return-label.jar$all +||home.earthlink.net/~tom12345678/shipment~label.jar$all +||home.earthlink.net/~tom12345678/shipping-label.jar$all +||home.earthlink.net/~twwjr/usps_delivery.jar$all +||home.earthlink.net/~vehanes/12-20-17.jar$all +||home.earthlink.net/~veteransmemorial/usps/trackingorder.jar$all +||home.earthlink.net/~wisebob/shipment~e~label.jar$all +||home.earthlink.net/~wisebob/shipping-label.jar$all +||home.earthlink.net/~youngcl/shipping-label101.jar$all +||home.earthlink.net/~zrippeto/invoice.jar$all +||home.earthlink.net/~zrippeto/order-comfirmation.jar$all +||home.earthlink.net/~zrippeto/pal/payment~details.jar$all ||home.evrstudio.com$all ||home.healthiestu.com$all ||home.isdes.com$all @@ -502199,7 +502482,7 @@ ||hostfleek.com$all ||hostgo.com.br$all ||hostile-gaming.fr$all -||hostimpel.com/js/q/$all +||hostimpel.com$all ||hosting-c.iuro.nl$all ||hosting.drupwayinfotech.in$all ||hosting.mrsofttech.com$all @@ -508916,6 +509199,7 @@ ||kabelinieseti.ru$all ||kabiguru.org$all ||kabiledans.com$all +||kabimmo.com$all ||kabinarf.ru$all ||kabiru.ru$all ||kabiryogashramlimbdi.com$all @@ -510361,7 +510645,9 @@ ||kilnrefractory.com$all ||kilolo.site$all ||kilop.goodvibeskickin.com$all -||kilopaskal.ru$all +||kilopaskal.ru/0203.bin$all +||kilopaskal.ru/0203s.bin$all +||kilopaskal.ru/6jhfa478.exe$all ||kimaco.com$all ||kimberly.digital$all ||kimberly5esthetique.com$all @@ -510707,7 +510993,7 @@ ||klaus-moersch.de$all ||klausnerlaw.com$all ||klaussen.net$all -||klaustrofebia.ru$all +||klaustrofebia.ru/6jhfa478.exe$all ||klavze28.com$all ||klbay.net$all ||kldatabase.com$all @@ -513772,10 +514058,7 @@ ||library.cifor.org$all ||library.dhl-xom.com$all ||library.iainbengkulu.ac.id$all -||library.mju.ac.th/2018/cfjdes/$all -||library.mju.ac.th/2018/mnnw0cr-ptv5a-370268/$all -||library.mju.ac.th/2018/rn-72c-0657/$all -||library.mju.ac.th/2018/zoipdun1a0/$all +||library.mju.ac.th$all ||library.phibi.my.id$all ||library.piet.co.in$all ||library.strophicmusic.com$all @@ -515590,7 +515873,8 @@ ||luminouspla.net$all ||luminouspneuma.com$all ||lumnus.com.br$all -||lumoura.com$all +||lumoura.com/0496giif/payroll/commercial$all +||lumoura.com/0496giif/payroll/commercial/$all ||lumperpush.com$all ||lumsdancorp.com$all ||lun.otrweb.ru$all @@ -515757,7 +516041,7 @@ ||lykangblog.com$all ||lykusglobal.com$all ||lylevr.com$all -||lyllacarter.com/3578001584444_ycu75_resource/personal-box/interior-warehouse/arfilpvie-v6v1ws6tt/$all +||lyllacarter.com$all ||lylydressforless.com$all ||lymcomercial.cl$all ||lymfodrenaze.eu$all @@ -519163,6 +519447,7 @@ ||medicinadellavoromb.it$all ||medicinaesteticaorlandini.it$all ||medicinageriatrica.com.br$all +||medicinainterna-critica.com$all ||medicinaonline.rjsrwaco.watchdogdns.duckdns.org$all ||medicine.softberg.ro$all ||mediclaim.odhavnidhi.org$all @@ -522426,8 +522711,7 @@ ||mtcinteriordesign.co.uk$all ||mtcr.co.za$all ||mtcuadrado.com$all -||mtdc.com.my/csm/mtdc_tenant/uploadedimages/file/o3xzk5h347jxshu8k73a66d4j0k087_aid8t27-174416710418/$all -||mtdc.com.my/csm/mtdc_tenant/uploadedimages/inc/erfrjwbgc5k/$all +||mtdc.com.my$all ||mte1.cn$all ||mtechagency.com$all ||mteestore.com$all @@ -523146,7 +523430,7 @@ ||myimmigrationlawmarketingpartner.com$all ||myimmogroup.be$all ||myinfoart.online$all -||myinstabuzzz.co$all +||myinstabuzzz.co/6hyuyj.exe$all ||myinstantguru.com$all ||myinternetjobs.com$all ||myintromationsz.win$all @@ -523172,6 +523456,7 @@ ||mylinkguard.com$all ||mylistbuildingtraffic.com$all ||mylisting.martinface.com$all +||myliverpoolnews.cf$all ||myloanbaazar.com$all ||myloanexpert.in$all ||mylocal.dk$all @@ -524822,6 +525107,7 @@ ||news.intertours.org.rs$all ||news.leta.com.vn$all ||news.lwinmoenaing.me$all +||news.makemoneywith.website$all ||news.medicaid.ir$all ||news.omumusic.net$all ||news.palette69.com$all @@ -525638,6 +525924,7 @@ ||nmsk.online$all ||nmsr.info$all ||nmvconstructions.com$all +||nmxwllwsdyminoragenw.dns.army$all ||nn-webdesign.be$all ||nn.5ctelematics.com$all ||nnasout.com$all @@ -526444,7 +526731,9 @@ ||nvdweb.azurewebsites.net$all ||nveeusa.com$all ||nvelj12qyyfi03kqxy.xyz$all -||nvgeeforsegt.ru$all +||nvgeeforsegt.ru/0303.bin$all +||nvgeeforsegt.ru/0303s.bin$all +||nvgeeforsegt.ru/6jhfa478.exe$all ||nvgp.com.au$all ||nvi.edu.vn$all ||nvl.netsmartz.net$all @@ -527600,6 +527889,8 @@ ||onedrive.live.com/download?%20cid=6bf4bc82222119f1&resid=6bf4bc82222119f1%21146&authkey=adpxoamsqubznpo$all ||onedrive.live.com/download?%20cid=86515363ec4e1d86&resid=86515363ec4e1d86!230&authkey=acct5emtpwqk2pk$all ||onedrive.live.com/download?%20cid=86515363ec4e1d86&resid=86515363ec4e1d86%21230&authkey=acct5emtpwqk2pk$all +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm$all +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$all ||onedrive.live.com/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa$all ||onedrive.live.com/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq$all ||onedrive.live.com/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe$all @@ -527857,9 +528148,17 @@ ||onedrive.live.com/download?cid=208d58450f73ce00&resid=208d58450f73ce00%21121&authkey=ac_pc9_txxg1knu$all ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4$all ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc$all ||onedrive.live.com/download?cid=20dee8b81c08a987&resid=20dee8b81c08a987%21298&authkey=aj9kqwsgcfz-_hs$all ||onedrive.live.com/download?cid=2156ca1e52db3c63&resid=2156ca1e52db3c63!133&authkey=aoandx4a2on7qms$all ||onedrive.live.com/download?cid=2156ca1e52db3c63&resid=2156ca1e52db3c63%21133&authkey=aoandx4a2on7qms$all +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom$all +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom$all ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!105&authkey=!absbumceicuzi2o$all ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!108&authkey=!ajhg3v4jcff7_ja$all ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!109&authkey=!anhbzybkg3mekig$all @@ -527960,6 +528259,10 @@ ||onedrive.live.com/download?cid=2a486306c325f908&resid=2a486306c325f908%21111&authkey=affiexy2cqzci_et1$all ||onedrive.live.com/download?cid=2a486306c325f908&resid=2a486306c325f908%21113&authkey=ahqsrzlqf0ufb-w$all ||onedrive.live.com/download?cid=2a4a2d5d947e1370&resid=2a4a2d5d947e1370%21108&authkey=amv_prbtm21h9cw$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk$all ||onedrive.live.com/download?cid=2ad47a1c2578bc9d&resid=2ad47a1c2578bc9d!109&authkey=!aimagsabj48hkvc$all ||onedrive.live.com/download?cid=2ad9152585a10979&resid=2ad9152585a10979%21263&authkey=ajckc28yc3ipv20$all ||onedrive.live.com/download?cid=2b099f9549ffb495&resid=2b099f9549ffb495%21120&authkey=abiwvt9gevnrdko$all @@ -528217,6 +528520,7 @@ ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21137&authkey=ai0mrummy_5dvngl$all ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21139&authkey=aizxtnwpadmihus$all ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0$all +||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0$all ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw$all ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw$all ||onedrive.live.com/download?cid=47366308b4485d1f&resid=47366308b4485d1f!122&authkey=acz6efuryflte_u$all @@ -528370,6 +528674,7 @@ ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21270&authkey=anrpgfgppanni2m$all ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21282&authkey=ahmiyfvsdq29oyct$all ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21306&authkey=aax3ppfvza6zr2y!w$all +||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21104&authkey=ah1rwakpsbjkvg8$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0$all @@ -528603,6 +528908,8 @@ ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21130&authkey=anw-ddr7601fex8$all ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21133&authkey=ajujzgibyp0njn4$all ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8$all +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq$all +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s$all ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b!330&authkey=akerwhui2attmd0$all ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b!332&authkey=alf8w-tcidmmiaw$all ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b%21330&authkey=akerwhui2attmd0$all @@ -529040,9 +529347,11 @@ ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21106&authkey=akfcfq3zq5oof2i$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21108&authkey=amfbkmapqbvzpvk$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21110&authkey=aov1iwhtxtdchie$all +||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21114&authkey=aootzdl0ufej408!w$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21115&authkey=aigiblfwx-m-sf0$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21117&authkey=akq2ufr3rag9vrw$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21118&authkey=agbhxyxdkrvcvo0$all +||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21119&authkey=ai2fryyoppe4_hm$all ||onedrive.live.com/download?cid=896080f2b56fcb9c&resid=896080f2b56fcb9c%21105&authkey=aathdxz2aww0jkm$all ||onedrive.live.com/download?cid=8983011c6ecfb1d8&resid=8983011c6ecfb1d8%21132&authkey=ah0vja7wpyfjj84$all ||onedrive.live.com/download?cid=89c2283e219d084b&resid=89c2283e219d084b%21715&authkey=al6csxgxuywk1bs$all @@ -529070,6 +529379,8 @@ ||onedrive.live.com/download?cid=8ca507baa15fdb5c&resid=8ca507baa15fdb5c%21184&authkey=aeek7ofguvsjqwe$all ||onedrive.live.com/download?cid=8d14d74eb13b02d0&resid=8d14d74eb13b02d0%21158&authkey=angcyyr-keximec$all ||onedrive.live.com/download?cid=8d14d74eb13b02d0&resid=8d14d74eb13b02d0%21165&authkey=ak9xkr3bswk3pso$all +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y$all +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y$all ||onedrive.live.com/download?cid=8db649572ecd3a9a&resid=8db649572ecd3a9a%21235&authkey=akc-pr82u6uhq3o$all ||onedrive.live.com/download?cid=8db649572ecd3a9a&resid=8db649572ecd3a9a%21255&authkey=ameysz-ajuakv_i$all ||onedrive.live.com/download?cid=8e778d4a23c91a07&resid=8e778d4a23c91a07%21109&authkey=amsqkmfaht5lg9s$all @@ -529349,6 +529660,7 @@ ||onedrive.live.com/download?cid=aca36329f96145e7&resid=aca36329f96145e7%21108&authkey=aig30xmo50hun6s$all ||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21111&authkey=aczey5fkpwajy-a$all ||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21114&authkey=afetsliuakyqj5a$all +||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21115&authkey=ap7w_ryx7dsh--4$all ||onedrive.live.com/download?cid=ad9ac90c6da9c574&resid=ad9ac90c6da9c574!202&authkey=ajnelcik0ivjcvm$all ||onedrive.live.com/download?cid=ae1f8ba4b67f2e7b&resid=ae1f8ba4b67f2e7b%21111&authkey=aoudc31yiw3xahw$all ||onedrive.live.com/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw$all @@ -529454,6 +529766,7 @@ ||onedrive.live.com/download?cid=b9e0bf86d3bee8e7&resid=b9e0bf86d3bee8e7%21182&authkey=abo_l9b2wjewd5w$all ||onedrive.live.com/download?cid=b9e0bf86d3bee8e7&resid=b9e0bf86d3bee8e7%21189&authkey=agaoq4of9yuqxqe$all ||onedrive.live.com/download?cid=b9f97974937af42d&resid=b9f97974937af42d%21183&authkey=apzbr8b3xgtai1y$all +||onedrive.live.com/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$all ||onedrive.live.com/download?cid=bada6e9b193308e5&resid=bada6e9b193308e5!107&authkey=ajyxxwmnlvllxc8$all ||onedrive.live.com/download?cid=bada6e9b193308e5&resid=bada6e9b193308e5%21115&authkey=aohc9j6cj1s-dp4$all ||onedrive.live.com/download?cid=badaf4192eeddcdc&resid=badaf4192eeddcdc!3724&authkey=agywwcss9tb9x5g$all @@ -529517,6 +529830,7 @@ ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai$all ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk$all ||onedrive.live.com/download?cid=c1bc60e9d8507226&resid=c1bc60e9d8507226%21146&authkey=afqh6zg990rdk7w$all +||onedrive.live.com/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta$all ||onedrive.live.com/download?cid=c2f597e8f3af4bc2&resid=c2f597e8f3af4bc2%2164846&authkey=aocl-frlas3c6v4$all ||onedrive.live.com/download?cid=c333554726f00e84&resid=c333554726f00e84%21242&authkey=adizb0tcuo6pvxm$all ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa$all @@ -529914,7 +530228,9 @@ ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21139&authkey=an3wktzxopu6ktq$all ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21140&authkey=ag-kppl_uvownco$all ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21142&authkey=aad-nuysvlhc-i4$all +||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8!124&authkey=anbjbhqwzwajouc$all ||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8%21108&authkey=anmpeqm9gm_zv9m$all +||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8%21124&authkey=anbjbhqwzwajouc$all ||onedrive.live.com/download?cid=efa0769fcf42dbd8&resid=efa0769fcf42dbd8%21108&authkey=ab3oob0eydsxowg$all ||onedrive.live.com/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4$all ||onedrive.live.com/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8$all @@ -530330,7 +530646,10 @@ ||only4atalg.ml$all ||onlyapteka.ru$all ||onlyart.in$all -||onlybamboofabrics.com$all +||onlybamboofabrics.com/2601.bin$all +||onlybamboofabrics.com/2701.bin$all +||onlybamboofabrics.com/2701s.bin$all +||onlybamboofabrics.com/6gdwwv.exe$all ||onlycane.in$all ||onlychild.org$all ||onlycocktaildresses.com$all @@ -538439,6 +538758,7 @@ ||pazarcheto.com$all ||pazargezer.com$all ||pazcomau-my.sharepoint.com$all +||pazpus.com$all ||pb-xt.com$all ||pb.divaasolutions.com$all ||pb128o6c2favwk.com$all @@ -540234,6 +540554,7 @@ ||pmrimestdylimtdvenst.dns.army$all ||pmrimestdylimtdvests.dns.army$all ||pmrimestdylimtstwork.dns.army$all +||pmrimewsdylimtewsogh.dns.army$all ||pmrimewsdylimtwswods.dns.army$all ||pms.stercomagento.com$all ||pmsports.de$all @@ -541988,6 +542309,7 @@ ||prosupport.cl$all ||prosvyaz.kz$all ||prosyarmakassar.com$all +||prosystemsug.com$all ||prosysvinorosso.com$all ||prot.drupal8.softikom.lv$all ||protaciohospital.com$all @@ -542005,7 +542327,9 @@ ||protect-us.mimecast.com/s/7ihcc82oqycqx96qh15qw5$all ||protect-us.mimecast.com/s/c27ac0rx9ru80p3fw0bgj$all ||protect-us.mimecast.com/s/qki9c73wxjupxq5ps8qcm_$all -||protect.mimecast-offshore.com$all +||protect.mimecast-offshore.com/s/ip17cn9blzfnq4n4h4tudd?domain=meraqsa.com/$all +||protect.mimecast-offshore.com/s/loqwcg5rvpcjndxqc76apn?domain=ronakfence.ir/$all +||protect.mimecast-offshore.com/s/rd0zcjqxyvf8w6o3igppxq?domain=ronakfence.ir/$all ||protect2.fireeye.com/v1/url?k=59eacb3c-0560e9d5-59ed97de-0cc47ad93e2e-0f5e34e79adab692&q=1&e=e7991bbc-cc93-4814-a8f2-fd6d6950b0d5&u=https%3a%2f%2fwww.mediafire.com%2ffile%2fs2uyxs8t8kbuyye%2fdocumentos_de_env%25cdo.7z%2ffile$all ||protect2.fireeye.com/v1/url?k=6d0c09d2-33bdd2b2-6d0f7943-86e2237f51fb-ab55eb53c2dfee1f&q=1&e=358c9b57-d351-4b0f-80cf-d0755ec21127&u=https://pottershousedurban.co.za/cgi-bin/file/xzbx0cb5wywuw5/179vj6b9dpsp7advozp/$all ||protectiadatelor.biz$all @@ -543240,7 +543564,7 @@ ||quatanghoanglong.com$all ||quatangluuniemhue.com$all ||quatangtaynguyen.com$all -||quatangtaynguyen.vn/egw5/inc/ixgcfpguvzhumrl/$all +||quatangtaynguyen.vn$all ||quatest.sixstarsent.com$all ||quatet365.com$all ||quatram.de$all @@ -543314,6 +543638,7 @@ ||quickbookstechnicalsupportphonenumber.com$all ||quickboooks.host$all ||quickboooks.space$all +||quickcompanyreg.co.za$all ||quickfingers.net$all ||quickinsolutions.com$all ||quicklifecare.com$all @@ -546120,7 +546445,7 @@ ||roadscompass.com$all ||roadtravelcars.com$all ||roanokecellphonerepair.com$all -||roanokemortgages.com$all +||roanokemortgages.com/6lhjgfdghj.exe$all ||roastedguarmeal.com$all ||roba.nu$all ||robaitec.com$all @@ -548758,6 +549083,7 @@ ||savasaachi.systems$all ||savaspark.com.tr$all ||save-room.info$all +||save.makemoneywith.website$all ||save24x7.com$all ||saveanimal.org$all ||savecannabis.org$all @@ -552595,7 +552921,7 @@ ||slrpros.com$all ||sls-eg.com$all ||sls-security.ru$all -||slsbearings.com.sg/en/corporation/cdiih-tcjn3_vdroc-dsx/$all +||slsbearings.com.sg$all ||slservicebd.com$all ||slubnefury.pl$all ||slugard.5gbfree.com$all @@ -554594,7 +554920,7 @@ ||srnirob.com$all ||srno.hu$all ||sromano.it$all -||sromecorlduce.ru$all +||sromecorlduce.ru/6sfsgfsgqwert.exe$all ||sroomf70nasiru.duckdns.org$all ||srooooiva.ru$all ||srpresse.fr$all @@ -558101,7 +558427,7 @@ ||sunflowerschoolandcollege.com$all ||sunfruit.com.tn$all ||sunganak.in$all -||sungardspo.com$all +||sungardspo.com/6lhjgfdghj.exe$all ||sungazer.com.au$all ||sunglasses2020.com$all ||sungvalopkhongsam.com$all @@ -561604,7 +561930,7 @@ ||thefragrancefreeshop.com$all ||thefranssons.com$all ||thefreelancerschool.com$all -||thefrees.com/.docs/jtvrvznswjba/nbar_6606_29052020.zip$all +||thefrees.com$all ||thefreewaterfoundation.org.za$all ||thefront.in$all ||thefuel.be$all @@ -562219,6 +562545,7 @@ ||theviestdyjupcafgmcn.dns.army$all ||theviestdyjupcafgsvb.dns.army$all ||theviestdyjupcazfest.dns.navy$all +||theviewsdyjupcazfeqv.dns.army$all ||theviewsdyjupcazwsgv.dns.army$all ||thevilla46.com$all ||thevine-organizasyon.com$all @@ -562735,7 +563062,7 @@ ||timelyrain.top$all ||timenard.top$all ||timenotbesea.xyz$all -||timenow.pw/api/files/stub.exe$all +||timenow.pw$all ||timenowis1.top$all ||timeoffer.site$all ||timeofvape.tk$all @@ -564577,7 +564904,9 @@ ||trustinspect.com$all ||trustlancers.com$all ||trustorbit.com$all -||trustpilot-scam.com$all +||trustpilot-scam.com/1612.bin$all +||trustpilot-scam.com/1612s.bin$all +||trustpilot-scam.com/32453.exe$all ||trustpropertyholdings.com$all ||trustrambusinesssolutions.com$all ||trustrobins.info$all @@ -564643,7 +564972,7 @@ ||ts.7rb.xyz$all ||ts0ev73.com$all ||tsal.com$all -||tsapparel.com.my/fd66e6.php$all +||tsapparel.com.my$all ||tsareva-garden.ru$all ||tsatsi.co.za$all ||tsauctions.com$all @@ -565396,7 +565725,19 @@ ||u0707115.cp.regruhosting.ru$all ||u0746219.cp.regruhosting.ru$all ||u0774849.cp.regruhosting.ru$all -||u1.huatu.com$all +||u1.huatu.com/fuzhou/2012/6yue/20120626009_hlq.rar$all +||u1.huatu.com/guizhou/fujian/wendang/2012071006.rar$all +||u1.huatu.com/guizhou/fujian/wendang/2012082801.rar$all +||u1.huatu.com/guizhou/fujian/wendang/2012102205.rar$all +||u1.huatu.com/henan/2012-08/2012bishi.rar$all +||u1.huatu.com/henan/201211/121127054744.rar$all +||u1.huatu.com/jinan/fujian/%e4%b8%b4%e6%9c%90%e6%9a%91%e6%9c%9f%e6%95%99%e5%b8%88%e7%ac%94%e8%af%95%e6%88%90%e7%bb%a9.rar$all +||u1.huatu.com/jinan/fujian/20130710153845754ba1c09b3695e0.rar$all +||u1.huatu.com/nmg/20120716001.rar$all +||u1.huatu.com/tianjin/201212/20131218zwb_tjxds.rar$all +||u1.huatu.com/wuhu/fujian/201205/20120522104242271.rar$all +||u1.huatu.com/wuhu/fujian/20120507110444635.rar$all +||u1.huatu.com/wuhu/fujian/20120814113927927.rar$all ||u1.innerpeer.com$all ||u11123p7833.web0104.zxcs.nl$all ||u1141p8807.web0103.zxcs.nl$all @@ -566612,6 +566953,7 @@ ||unitedwsdy5defenceforgorvermentsocialeme.duckdns.org$all ||unitedwsdykesokowsbv.dns.army$all ||unitedwsdykesokowsgs.dns.army$all +||unitedwsdykesokowskg.dns.army$all ||unitedwsdykesokowsku.dns.army$all ||unitedwsdykesokowsri.dns.navy$all ||unitedyfl.com$all @@ -567089,7 +567431,7 @@ ||urldefense.proofpoint.com/v2/url?u=http-3a__www.noelportelles.com_acuerdos-2d07_&d=dwmfaq&c=-nidxp95v38whwnfcom0huicxh-zv-kamxwytub8tka&r=f0qlnmvt4h0nwhscbkmzens5pw6nb16ectkdmouq3rg&m=h6onp5vzujslfrkq8uluja-svkxy727zj0hv6bgi7kg&s=_giuui9mytwjmdqu0aojwj59ycacwqnzlfvb1g055lm&e=/$all ||urldefense.proofpoint.com/v2/url?u=http-3a__www.sindquimsuzano.com.br_payment_zzn34252g_aug-2d07-2d2018-2d4493466_hul-2dgsmu&d=dwmgaq&c=zwy66qcyutyucoev9c2gldeckuykzowdvnr_l93z9mq&r=niwg9z1drtcbkwjfypvhoyqckwxpvcuznakuz4s8tqi&m=dvgau9m2j67nnjvwqltpdwr1secpedjmnf6k8tdvhce&s=bcniagjeltt_ln_3efp3jjggw-kxw0a1v5wthm1wysi&e=$all ||urldefense.proofpoint.com/v2/url?u=http-3a__www.sx-2dzj.net_default_us-5fus_doc_hri-2dmonthly-2dinvoice_&d=dwifaq&c=eugzstcatdllvimen8b7jxrwqof-v5a_cdpgnvfiimm&r=ftodw-zjb1u6omhnvdnv5xpe4nk-1jws78c28vgfogapkvxv5mlulnefw3g60a0o&m=qs8izqf3b77bbbv4ce5xetvb_lj3d6tp8yc7h7b_j_4&s=hgfffu7ph5qurvwxahcnjcn8_j3-kc-vy2u6javehtq&e/$all -||urldefense.us$all +||urldefense.us/v2/url?u=http-3a__facanha.com.br_temp_parts-5fservice_s9baz8isbijg0xhd7z0n_&d=dwmfaq&c=qtsr2lo3xh19jsonxq96-b_j2zkvnyyojwvjnv4r9is&r=iouefzkkvlfqwzcan5qausnvmpi9hiz9pebs6ko1o94&m=gyxbuywhcwmdgd9tipsfye4sd4mhyexdiwsgp_6fkhg&s=qoq4llc83hmmkungnrsxiof9m8vzk0asnj8uej2oiaq&e=/$all ||urleddrug.at$all ||urlfrance.fr$all ||urlm.ir$all @@ -567238,7 +567580,8 @@ ||usrubber.com/wp-admin/0in/$all ||uss.ac.th$all ||uss21.com$all -||ussbd.net$all +||ussbd.net/content/scan/271459/ojyq8by38-28/$all +||ussbd.net/wp-admin/scan/xlhuy5brujs4c4sbq/$all ||usselfstoragenetwork.com$all ||ussrback.com$all ||ussrgun.000webhostapp.com$all @@ -567355,18 +567698,7 @@ ||uyaiblog.com$all ||uycqawua.applekid.cn$all ||uydu.antalyaelektrikariza.net$all -||uyen.vn/rxmln/06521/servicecontractagreement_06521_04292020.zip$all -||uyen.vn/rxmln/0944160/servicecontractagreement_0944160_04292020.zip$all -||uyen.vn/rxmln/719658340/servicecontractagreement_719658340_04292020.zip$all -||uyen.vn/rxmln/92790700/servicecontractagreement_92790700_04292020.zip$all -||uyen.vn/rxmln/servicecontractagreement_23932918_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/192074507/servicecontractagreement_192074507_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/26862161/servicecontractagreement_26862161_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/30940317/servicecontractagreement_30940317_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/80951402/servicecontractagreement_80951402_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/899028826/servicecontractagreement_899028826_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/servicecontractagreement_127640399_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/servicecontractagreement_22521330_04292020.zip$all +||uyen.vn$all ||uyencometics.bmt.city$all ||uyencuentra.com$all ||uyf.com.ua$all @@ -571978,7 +572310,7 @@ ||wotehb.com$all ||wotsuper.pw$all ||wotsuper3.exe$all -||wouatiareves.ru$all +||wouatiareves.ru/6hy67438ue.exe$all ||wourionlion.ru$all ||woutaalexp.com$all ||wouterwolf.com$all @@ -572204,6 +572536,7 @@ ||wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org$all ||wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org$all ||wsdyalgreenkeghewsmq.dns.army$all +||wsdyalgreenkelveskxz.dns.army$all ||wsdyalhjchfonlinedws.dns.navy$all ||wsdyalhjchfonlinwsdf.dns.army$all ||wsdyalhjchfonlinwsed.dns.army$all @@ -572227,10 +572560,12 @@ ||wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org$all ||wsdyibgreenkegheedws.dns.navy$all ||wsdyibgreenkeghewsyt.dns.army$all +||wsdyibgreenventureqx.dns.army$all ||wsdykalamikonlinedeliverystoreservwspmq.ydns.eu$all ||wsdykung38communicationtarisupliermgapc.duckdns.org$all ||wsdykungsb2gotchtsub.dns.army$all ||wsdykungsb2gotchtwsp.dns.army$all +||wsdykungsb2talenwsjf.dns.army$all ||wsdykungsb2talenwsmz.dns.army$all ||wsdymsloginvestmwsqd.dns.army$all ||wsdymsloginvestmwsrw.dns.army$all @@ -572243,9 +572578,11 @@ ||wsdynitengymndynatin.dns.army$all ||wsdypmrimelimtdvenws.dns.army$all ||wsdypmrimelimtdvewsd.dns.army$all +||wsdyrkkrgorgiousejhd.dns.army$all ||wsdyrkkrsuccessmorev.dns.army$all ||wsdyrkkrsuccessmoven.dns.army$all ||wsdyrmtcntlfarmtwsvb.dns.army$all +||wsdysara1investvwsfs.dns.army$all ||wsdyshgshg2induswsjg.dns.army$all ||wsdyshgshgnationalindustrialandgoogledns.duckdns.org$all ||wsdyshgshgnationalobjindustrialat23fty.duckdns.org$all @@ -573329,7 +573666,7 @@ ||xnk.jbzie.com$all ||xnkwintech.com$all ||xnxxchannel.com$all -||xnxxfullhd.com$all +||xnxxfullhd.com/wp-admin/nak/$all ||xo4z0sl.com$all ||xo57.com$all ||xoangyduong.com.vn$all @@ -573912,7 +574249,16 @@ ||yeu81.com$all ||yeu82.com$all ||yeuhang.tk$all -||yeumoitruong.vn$all +||yeumoitruong.vn/install/cqblnc/$all +||yeumoitruong.vn/install/document/$all +||yeumoitruong.vn/install/esp/gkh96px4g19/$all +||yeumoitruong.vn/install/esp/gkh96px4g19//$all +||yeumoitruong.vn/install/esp/gkh96px4g19///$all +||yeumoitruong.vn/install/lm/k9238129131598300n5b5sb4mhqb/$all +||yeumoitruong.vn/install/tbn/$all +||yeumoitruong.vn/src/09j/$all +||yeumoitruong.vn/src/attachments/kryx1iotp3u/$all +||yeumoitruong.vn/src/invoice/2m1r3dh36j/$all ||yeuromndy.cf$all ||yeutocviet.com$all ||yewonder.com$all diff --git a/urlhaus-filter-agh-online.txt b/urlhaus-filter-agh-online.txt index 5a158488..e38cb7db 100644 --- a/urlhaus-filter-agh-online.txt +++ b/urlhaus-filter-agh-online.txt @@ -1,5 +1,5 @@ ! Title: Online Malicious URL Blocklist (AdGuard Home) -! Updated: Thu, 08 Apr 2021 00:12:42 UTC +! Updated: Thu, 08 Apr 2021 12:12:46 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/urlhaus-filter ! License: https://gitlab.com/curben/urlhaus-filter#license @@ -7,7 +7,6 @@ ||0-24bpautomentes.hu^ ||0cl.sldov.ru^ ||1.10.147.48^ -||1.207.196.135^ ||1.222.196.60^ ||1.245.4.163^ ||1.246.222.107^ @@ -17,10 +16,10 @@ ||1.246.222.134^ ||1.246.222.138^ ||1.246.222.14^ +||1.246.222.153^ ||1.246.222.165^ ||1.246.222.16^ ||1.246.222.20^ -||1.246.222.228^ ||1.246.222.234^ ||1.246.222.237^ ||1.246.222.245^ @@ -48,12 +47,11 @@ ||1.246.223.151^ ||1.246.223.15^ ||1.246.223.223^ -||1.246.223.22^ ||1.246.223.48^ ||1.246.223.4^ -||1.246.223.54^ ||1.246.223.58^ ||1.246.223.59^ +||1.246.223.61^ ||1.246.223.6^ ||1.246.223.71^ ||1.246.223.83^ @@ -80,7 +78,6 @@ ||102.141.240.139^ ||103.113.99.79^ ||103.125.218.107^ -||103.141.138.118^ ||103.16.145.25^ ||103.204.168.34^ ||103.217.215.21^ @@ -93,15 +90,11 @@ ||103.4.117.26^ ||103.79.112.254^ ||103.82.98.170^ -||103.91.123.92^ +||103.84.240.228^ +||103.84.241.94^ ||103.91.245.12^ ||103.91.245.14^ ||103.91.245.16^ -||103.91.245.17^ -||103.91.245.23^ -||103.91.245.25^ -||103.91.245.28^ -||103.91.245.36^ ||103.91.245.46^ ||103.91.245.47^ ||103.92.25.90^ @@ -121,6 +114,7 @@ ||107.172.193.132^ ||107.172.249.148^ ||107.173.219.80^ +||107.173.23.240^ ||107.174.250.107^ ||107.174.61.139^ ||107.175.197.135^ @@ -134,44 +128,41 @@ ||108.190.201.37^ ||108.190.250.48^ ||108.249.194.121^ -||109.104.151.108^ ||109.124.90.229^ ||109.233.196.232^ ||109.235.7.228^ +||109.248.58.238^ ||109.86.85.253^ -||109.88.185.119^ ||109.95.200.102^ ||109.95.200.230^ ||109.96.127.90^ ||109.96.57.246^ ||109.99.37.97^ ||110.14.58.190^ -||110.187.229.182^ ||110.228.195.46^ ||110.248.124.254^ ||110.248.175.141^ ||110.248.251.194^ ||110.251.10.18^ -||110.253.150.248^ ||110.253.213.198^ ||110.255.101.184^ ||110.35.145.127^ ||110.35.208.21^ ||110.35.221.77^ ||110.35.223.92^ -||110.35.225.24^ +||110.35.233.147^ ||110.35.235.57^ ||110.35.4.2^ ||110.89.10.147^ ||110.89.222.213^ -||111.118.111.207^ +||111.118.41.173^ +||111.118.88.128^ ||111.118.88.61^ ||111.119.245.114^ ||111.125.67.125^ ||111.163.50.120^ ||111.170.86.31^ ||111.172.57.20^ -||111.182.235.252^ ||111.185.171.111^ ||111.185.177.85^ ||111.185.23.84^ @@ -186,7 +177,6 @@ ||111.38.121.223^ ||111.38.121.226^ ||111.38.121.228^ -||111.38.123.136^ ||111.38.26.243^ ||111.38.8.81^ ||112.111.108.184^ @@ -211,7 +201,6 @@ ||112.236.171.69^ ||112.237.141.241^ ||112.237.144.226^ -||112.237.209.30^ ||112.237.75.157^ ||112.237.99.207^ ||112.238.143.135^ @@ -241,6 +230,7 @@ ||112.254.208.123^ ||112.255.6.129^ ||112.255.8.235^ +||112.26.212.80^ ||112.27.124.111^ ||112.27.124.117^ ||112.27.124.131^ @@ -277,6 +267,7 @@ ||112.30.1.219^ ||112.30.1.229^ ||112.30.1.230^ +||112.30.1.245^ ||112.30.1.247^ ||112.30.1.90^ ||112.30.1.91^ @@ -284,6 +275,7 @@ ||112.30.110.38^ ||112.30.110.43^ ||112.30.110.48^ +||112.30.110.62^ ||112.30.38.19^ ||112.30.4.103^ ||112.30.4.124^ @@ -293,16 +285,20 @@ ||112.30.97.184^ ||112.31.0.113^ ||112.31.176.16^ +||112.31.177.39^ ||112.31.240.239^ ||112.31.87.98^ ||112.53.224.79^ +||112.53.227.66^ ||112.65.53.175^ ||112.72.153.37^ +||112.72.162.159^ ||112.72.162.49^ ||112.72.175.147^ ||112.72.176.112^ ||112.72.176.84^ ||112.72.226.202^ +||112.72.231.35^ ||112.78.45.158^ ||112.80.127.91^ ||112.80.215.101^ @@ -314,23 +310,20 @@ ||113.122.238.68^ ||113.161.58.249^ ||113.161.78.185^ -||113.226.42.250^ ||113.227.194.172^ ||113.227.35.229^ ||113.231.211.131^ ||113.254.169.251^ ||113.59.128.133^ ||113.59.133.16^ +||113.59.136.39^ ||113.59.144.42^ -||113.59.154.21^ +||113.59.191.47^ ||113.61.204.205^ -||113.87.226.255^ ||113.87.32.93^ ||113.89.43.185^ ||114.111.242.3^ ||114.224.203.128^ -||114.226.100.56^ -||114.228.205.101^ ||114.229.165.194^ ||114.30.54.64^ ||114.79.172.42^ @@ -338,28 +331,27 @@ ||115.201.38.185^ ||115.42.47.36^ ||115.50.227.209^ -||115.50.92.195^ +||115.53.254.187^ ||115.55.158.93^ ||115.56.131.242^ ||115.56.133.96^ -||115.56.135.210^ ||115.56.152.194^ ||115.58.132.140^ ||115.59.233.160^ -||115.61.112.199^ ||115.73.3.11^ ||115.92.174.231^ +||115.97.142.58^ ||116.124.219.2^ ||116.132.151.60^ ||116.206.164.46^ ||116.211.100.26^ -||117.196.50.5^ +||116.75.197.220^ ||117.20.204.138^ ||117.20.204.5^ -||117.20.210.52^ ||117.20.220.126^ ||117.20.243.40^ ||117.200.76.54^ +||117.251.59.16^ ||117.26.104.74^ ||117.63.113.146^ ||117.63.195.140^ @@ -384,7 +376,6 @@ ||118.233.65.93^ ||118.42.125.246^ ||118.43.180.33^ -||118.79.125.92^ ||118.79.50.203^ ||118.79.58.82^ ||118.99.179.164^ @@ -396,7 +387,6 @@ ||119.123.238.52^ ||119.14.143.145^ ||119.147.213.57^ -||119.163.93.191^ ||119.164.18.235^ ||119.164.218.229^ ||119.165.107.93^ @@ -435,8 +425,9 @@ ||119.56.144.75^ ||119.56.148.115^ ||119.56.155.57^ -||119.56.173.24^ ||119.56.195.90^ +||119.56.206.43^ +||119.56.220.170^ ||12.132.113.2^ ||12.15.69.83^ ||12.178.187.6^ @@ -462,10 +453,10 @@ ||120.193.91.233^ ||120.209.126.235^ ||120.209.126.239^ +||120.209.126.250^ ||120.209.126.60^ ||120.209.127.187^ ||120.209.99.127^ -||120.210.89.79^ ||120.50.66.60^ ||120.50.93.115^ ||120.6.8.11^ @@ -492,6 +483,7 @@ ||122.100.150.204^ ||122.160.147.53^ ||122.188.86.225^ +||122.199.66.28^ ||122.199.72.23^ ||122.199.79.27^ ||122.202.37.85^ @@ -502,6 +494,7 @@ ||123.110.170.237^ ||123.110.182.187^ ||123.110.19.248^ +||123.110.200.98^ ||123.110.238.188^ ||123.129.2.28^ ||123.129.84.36^ @@ -538,9 +531,8 @@ ||123.241.148.58^ ||123.241.184.124^ ||123.28.217.23^ -||123.4.44.113^ ||123.5.5.242^ -||123.8.17.78^ +||123.9.193.157^ ||124.129.221.150^ ||124.129.76.230^ ||124.129.78.176^ @@ -553,6 +545,7 @@ ||124.132.110.150^ ||124.135.34.49^ ||124.152.26.45^ +||124.153.136.175^ ||124.153.236.6^ ||124.160.126.238^ ||124.163.65.64^ @@ -561,6 +554,7 @@ ||124.199.56.198^ ||124.230.174.233^ ||124.254.251.54^ +||124.5.112.43^ ||124.5.92.20^ ||124.6.0.4^ ||124.67.89.28^ @@ -571,7 +565,6 @@ ||125.128.28.161^ ||125.142.93.34^ ||125.191.113.212^ -||125.209.71.6^ ||125.40.1.235^ ||125.40.73.68^ ||125.43.23.193^ @@ -580,6 +573,7 @@ ||128.116.133.92^ ||130.255.159.133^ ||134.195.139.4^ +||134.236.252.28^ ||135.148.36.127^ ||138.99.204.224^ ||139.159.226.180^ @@ -592,6 +586,7 @@ ||14.189.247.118^ ||14.232.33.212^ ||14.37.222.190^ +||14.42.237.237^ ||14.45.127.110^ ||14.46.25.17^ ||14.46.98.241^ @@ -624,7 +619,6 @@ ||163.53.206.228^ ||165.90.16.5^ ||167.114.172.177^ -||168.205.223.254^ ||170.81.238.178^ ||171.120.222.98^ ||171.121.255.12^ @@ -634,11 +628,13 @@ ||171.35.162.156^ ||171.35.174.198^ ||172.105.36.168^ +||172.105.68.51^ ||172.114.244.127^ ||172.245.186.107^ ||172.245.5.185^ ||172.245.5.190^ ||172.245.81.19^ +||172.93.176.142^ ||172.93.194.114^ ||173.167.85.89^ ||173.169.46.85^ @@ -651,14 +647,11 @@ ||173.56.119.108^ ||173.56.92.166^ ||173.63.64.213^ -||174.106.33.85^ ||174.61.3.149^ -||174.61.48.94^ ||174.73.246.193^ ||174.81.78.7^ ||174.83.73.163^ ||175.10.147.167^ -||175.11.193.66^ ||175.11.65.112^ ||175.117.66.74^ ||175.169.13.182^ @@ -679,38 +672,40 @@ ||176.113.161.76^ ||176.113.161.84^ ||176.113.161.91^ +||176.113.174.139^ ||176.12.117.70^ ||176.123.7.115^ ||176.123.7.127^ -||176.123.9.243^ ||176.124.7.225^ -||176.221.188.251^ -||176.221.251.238^ ||176.240.84.106^ ||177.11.92.78^ ||177.131.226.235^ ||177.54.82.154^ ||178.124.182.187^ -||178.134.185.112^ ||178.150.174.65^ ||178.151.143.2^ ||178.165.122.141^ +||178.17.171.144^ +||178.175.0.143^ ||178.175.1.179^ ||178.175.10.164^ +||178.175.10.76^ ||178.175.10.94^ ||178.175.101.51^ ||178.175.102.138^ ||178.175.102.142^ ||178.175.102.162^ ||178.175.102.25^ -||178.175.103.143^ ||178.175.103.173^ +||178.175.103.52^ ||178.175.104.112^ +||178.175.104.67^ ||178.175.104.69^ ||178.175.105.213^ ||178.175.105.238^ ||178.175.105.7^ ||178.175.107.0^ +||178.175.107.71^ ||178.175.108.173^ ||178.175.108.87^ ||178.175.109.118^ @@ -718,57 +713,56 @@ ||178.175.111.135^ ||178.175.111.171^ ||178.175.111.190^ -||178.175.112.111^ ||178.175.112.135^ ||178.175.112.159^ ||178.175.112.198^ ||178.175.112.85^ +||178.175.114.146^ ||178.175.114.151^ -||178.175.114.178^ ||178.175.114.57^ ||178.175.115.166^ ||178.175.116.101^ ||178.175.116.138^ +||178.175.116.20^ ||178.175.116.242^ ||178.175.118.112^ -||178.175.118.116^ -||178.175.118.244^ ||178.175.119.69^ ||178.175.12.135^ ||178.175.120.154^ -||178.175.121.0^ ||178.175.121.228^ +||178.175.121.54^ ||178.175.122.28^ ||178.175.123.213^ -||178.175.123.223^ ||178.175.123.232^ ||178.175.123.248^ ||178.175.123.26^ ||178.175.123.91^ ||178.175.124.4^ +||178.175.125.149^ ||178.175.125.14^ ||178.175.126.129^ -||178.175.126.254^ ||178.175.126.46^ ||178.175.127.202^ -||178.175.127.63^ +||178.175.127.223^ ||178.175.14.14^ +||178.175.14.155^ ||178.175.15.199^ ||178.175.15.232^ ||178.175.15.44^ -||178.175.17.194^ +||178.175.16.26^ ||178.175.17.236^ -||178.175.18.75^ +||178.175.19.160^ ||178.175.19.163^ ||178.175.2.158^ ||178.175.2.217^ ||178.175.2.225^ +||178.175.2.254^ ||178.175.2.59^ ||178.175.20.126^ ||178.175.20.74^ ||178.175.20.7^ -||178.175.21.149^ -||178.175.23.119^ +||178.175.21.41^ +||178.175.22.120^ ||178.175.24.166^ ||178.175.24.232^ ||178.175.25.129^ @@ -776,9 +770,15 @@ ||178.175.27.32^ ||178.175.27.46^ ||178.175.29.233^ +||178.175.3.86^ +||178.175.30.109^ ||178.175.30.133^ ||178.175.30.151^ +||178.175.31.55^ ||178.175.32.146^ +||178.175.32.186^ +||178.175.33.179^ +||178.175.33.32^ ||178.175.34.230^ ||178.175.35.170^ ||178.175.35.193^ @@ -792,108 +792,109 @@ ||178.175.38.12^ ||178.175.4.227^ ||178.175.4.29^ +||178.175.40.209^ +||178.175.42.46^ ||178.175.43.121^ ||178.175.43.217^ -||178.175.43.238^ ||178.175.44.186^ -||178.175.44.241^ ||178.175.45.125^ ||178.175.45.26^ -||178.175.46.41^ ||178.175.46.59^ -||178.175.47.15^ -||178.175.47.181^ +||178.175.47.220^ ||178.175.47.222^ ||178.175.47.80^ -||178.175.48.40^ +||178.175.48.140^ +||178.175.48.223^ +||178.175.48.67^ ||178.175.5.254^ ||178.175.5.44^ -||178.175.5.74^ ||178.175.50.217^ ||178.175.50.42^ +||178.175.50.54^ ||178.175.53.101^ ||178.175.54.186^ -||178.175.54.234^ ||178.175.54.58^ ||178.175.55.99^ -||178.175.56.11^ ||178.175.56.185^ ||178.175.56.56^ -||178.175.57.134^ +||178.175.56.64^ ||178.175.57.14^ ||178.175.57.183^ +||178.175.57.204^ ||178.175.58.230^ ||178.175.58.234^ ||178.175.58.235^ ||178.175.59.106^ ||178.175.60.247^ ||178.175.61.103^ -||178.175.61.210^ -||178.175.62.241^ ||178.175.62.60^ ||178.175.64.156^ -||178.175.64.17^ ||178.175.64.35^ +||178.175.65.189^ ||178.175.65.208^ +||178.175.66.186^ ||178.175.68.123^ -||178.175.68.209^ ||178.175.68.44^ ||178.175.68.57^ +||178.175.69.79^ ||178.175.7.156^ ||178.175.70.218^ ||178.175.70.250^ ||178.175.70.74^ -||178.175.72.148^ +||178.175.72.126^ ||178.175.72.158^ ||178.175.72.75^ ||178.175.73.238^ ||178.175.75.181^ ||178.175.75.205^ +||178.175.75.214^ +||178.175.77.248^ ||178.175.77.47^ ||178.175.78.242^ -||178.175.78.243^ ||178.175.78.2^ ||178.175.79.146^ +||178.175.79.198^ ||178.175.79.66^ -||178.175.8.248^ ||178.175.8.85^ +||178.175.8.93^ ||178.175.80.142^ +||178.175.80.167^ ||178.175.81.185^ ||178.175.81.192^ ||178.175.81.226^ -||178.175.83.224^ +||178.175.81.240^ ||178.175.84.195^ ||178.175.84.215^ +||178.175.86.117^ ||178.175.86.182^ -||178.175.86.47^ ||178.175.86.59^ -||178.175.87.146^ ||178.175.87.16^ ||178.175.87.207^ ||178.175.87.42^ ||178.175.88.102^ -||178.175.88.207^ +||178.175.88.85^ ||178.175.89.121^ +||178.175.89.132^ ||178.175.89.45^ ||178.175.89.69^ ||178.175.91.223^ ||178.175.92.144^ -||178.175.92.33^ ||178.175.93.113^ -||178.175.93.200^ ||178.175.93.234^ ||178.175.93.98^ ||178.175.94.224^ +||178.175.94.248^ ||178.175.94.27^ ||178.175.94.32^ ||178.175.94.40^ -||178.175.95.60^ -||178.175.96.106^ +||178.175.95.105^ +||178.175.95.188^ ||178.175.96.125^ +||178.175.96.93^ ||178.175.97.127^ -||178.175.97.227^ ||178.175.99.106^ ||178.175.99.209^ +||178.175.99.21^ ||178.19.183.14^ ||178.205.101.33^ ||178.21.164.68^ @@ -904,7 +905,6 @@ ||178.48.235.59^ ||178.95.136.35^ ||179.159.58.134^ -||179.4.187.39^ ||179.43.176.41^ ||179.43.176.48^ ||179.60.84.7^ @@ -941,6 +941,7 @@ ||181.49.236.4^ ||181.49.59.162^ ||181.80.69.94^ +||182.112.177.134^ ||182.115.179.201^ ||182.119.206.219^ ||182.119.225.221^ @@ -953,13 +954,14 @@ ||182.233.0.252^ ||182.235.252.31^ ||182.53.197.62^ -||183.105.104.83^ ||183.105.225.154^ ||183.109.169.45^ ||183.143.148.105^ ||183.188.50.93^ -||183.83.8.225^ +||183.83.1.1^ +||183.83.14.20^ ||184.164.185.41^ +||184.175.115.10^ ||184.74.149.230^ ||184.82.15.135^ ||185.106.209.68^ @@ -974,7 +976,6 @@ ||185.215.113.93^ ||185.221.3.244^ ||185.222.58.152^ -||185.224.129.224^ ||185.228.141.74^ ||185.233.186.151^ ||185.245.96.94^ @@ -984,6 +985,7 @@ ||185.55.1.182^ ||185.68.230.207^ ||185.8.173.159^ +||185.81.154.208^ ||185.81.157.186^ ||185.82.217.185^ ||185.82.217.213^ @@ -1011,6 +1013,8 @@ ||188.152.41.141^ ||188.169.178.50^ ||188.169.179.127^ +||188.169.199.59^ +||188.169.30.30^ ||188.169.36.163^ ||188.242.167.159^ ||188.242.242.144^ @@ -1040,6 +1044,7 @@ ||190.216.140.123^ ||190.65.206.162^ ||190.85.213.51^ +||190.92.4.231^ ||190.98.37.135^ ||190.98.37.200^ ||190.98.41.33^ @@ -1053,7 +1058,6 @@ ||192.227.230.72^ ||192.227.230.74^ ||192.227.230.76^ -||192.236.147.58^ ||192.99.240.77^ ||194.113.107.243^ ||194.147.142.230^ @@ -1065,11 +1069,10 @@ ||195.24.94.187^ ||195.5.3.87^ ||196.202.26.182^ +||196.218.48.82^ ||196.221.148.90^ ||196.221.166.203^ ||197.50.27.115^ -||198.23.133.218^ -||198.23.174.104^ ||198.23.213.61^ ||198.23.251.105^ ||198.46.132.132^ @@ -1077,6 +1080,7 @@ ||2.239.22.188^ ||2.36.231.201^ ||2.37.149.230^ +||2.37.203.65^ ||2.45.111.158^ ||2.45.4.24^ ||2.55.125.182^ @@ -1090,32 +1094,29 @@ ||200.194.4.24^ ||200.30.132.50^ ||201.170.46.2^ +||201.171.40.215^ ||201.184.163.170^ ||201.187.102.73^ ||201.200.254.86^ ||201.203.221.20^ ||201.203.27.37^ ||202.107.233.41^ -||202.150.176.100^ ||202.166.217.54^ ||202.175.103.10^ ||202.29.95.12^ ||202.4.124.58^ ||202.51.176.114^ ||202.51.191.174^ -||202.74.236.9^ ||203.109.201.243^ ||203.159.80.128^ ||203.159.80.129^ +||203.159.80.164^ ||203.170.123.78^ ||203.189.156.107^ ||203.204.232.18^ ||203.229.21.56^ ||203.236.190.28^ -||203.238.86.202^ -||203.243.142.132^ ||203.70.166.107^ -||203.77.80.159^ ||203.80.119.166^ ||203.80.171.138^ ||203.82.36.34^ @@ -1130,7 +1131,6 @@ ||209.141.40.31^ ||209.146.98.50^ ||210.124.149.19^ -||210.180.17.140^ ||210.216.152.122^ ||210.216.153.142^ ||210.57.234.93^ @@ -1139,19 +1139,20 @@ ||210.68.242.114^ ||211.187.132.204^ ||211.187.75.220^ -||211.200.160.239^ ||211.204.215.157^ ||211.210.66.179^ ||211.210.93.93^ ||211.216.66.105^ ||211.237.114.96^ ||211.237.120.13^ +||211.237.246.137^ ||211.238.83.238^ ||211.247.5.96^ ||211.32.122.110^ ||211.93.191.153^ ||212.122.86.105^ ||212.143.227.22^ +||212.156.215.178^ ||212.46.197.114^ ||212.56.197.230^ ||213.123.206.197^ @@ -1162,28 +1163,30 @@ ||213.163.104.99^ ||213.163.111.201^ ||213.163.114.136^ -||213.163.114.165^ -||213.163.115.104^ ||213.163.116.153^ +||213.163.118.10^ +||213.163.118.216^ ||213.163.126.201^ ||213.163.126.20^ -||213.163.126.243^ ||213.163.126.7^ +||213.186.69.101^ ||213.189.178.163^ ||213.240.218.15^ ||213.249.156.189^ -||213.91.244.58^ ||213.92.254.52^ ||216.158.238.236^ ||216.170.240.98^ ||216.183.54.169^ +||216.183.54.196^ ||216.36.12.98^ ||217.11.75.162^ +||217.12.209.82^ ||218.12.181.110^ -||218.161.69.135^ ||218.2.40.34^ ||218.234.165.18^ ||218.238.246.3^ +||218.255.226.166^ +||218.32.118.1^ ||218.35.207.119^ ||218.35.227.133^ ||218.35.68.35^ @@ -1193,11 +1196,10 @@ ||218.79.103.159^ ||218.93.102.63^ ||218.93.102.75^ +||219.155.234.33^ ||219.155.29.165^ ||219.155.64.104^ ||219.157.139.165^ -||219.157.202.92^ -||219.157.214.235^ ||219.241.6.180^ ||219.68.1.148^ ||219.68.1.84^ @@ -1211,8 +1213,8 @@ ||21robo.com^ ||220.118.168.155^ ||220.126.237.74^ -||220.132.89.154^ ||220.200.22.163^ +||220.81.44.181^ ||220.90.159.188^ ||221.0.133.84^ ||221.124.78.15^ @@ -1238,11 +1240,13 @@ ||222.132.125.138^ ||222.133.103.120^ ||222.135.9.5^ +||222.137.133.125^ ||222.137.139.86^ ||222.137.73.214^ -||222.138.201.129^ ||222.140.17.245^ +||222.142.210.144^ ||222.185.116.233^ +||222.186.20.19^ ||222.187.9.178^ ||222.211.72.66^ ||222.236.85.220^ @@ -1265,6 +1269,7 @@ ||23.24.213.121^ ||23.243.149.13^ ||23.243.21.167^ +||23.95.122.24^ ||23.95.89.21^ ||24.103.74.180^ ||24.11.141.134^ @@ -1299,7 +1304,6 @@ ||27.147.40.128^ ||27.184.251.135^ ||27.193.217.210^ -||27.194.149.142^ ||27.194.192.66^ ||27.197.23.215^ ||27.199.232.65^ @@ -1329,7 +1333,6 @@ ||27.208.247.130^ ||27.208.25.59^ ||27.208.34.2^ -||27.209.208.122^ ||27.209.231.15^ ||27.21.151.205^ ||27.210.107.125^ @@ -1372,10 +1375,10 @@ ||27.223.242.164^ ||27.35.129.198^ ||27.35.154.13^ -||27.35.2.30^ +||27.35.171.36^ ||27.35.212.124^ ||27.35.58.5^ -||27.7.204.255^ +||27.6.255.101^ ||31.0.98.131^ ||31.11.51.57^ ||31.13.23.180^ @@ -1402,7 +1405,6 @@ ||31.30.119.23^ ||31.32.120.79^ ||32.208.157.193^ -||32792.prolocksmithwinterpark.com^ ||34.122.44.188^ ||35.184.169.169^ ||36.108.231.218^ @@ -1418,6 +1420,7 @@ ||36.66.105.159^ ||36.66.133.125^ ||36.66.139.36^ +||36.67.152.161^ ||36.89.18.133^ ||36.91.89.187^ ||360.lcy2zzx.pw^ @@ -1494,33 +1497,32 @@ ||40.88.2.151^ ||41.139.209.46^ ||41.165.130.43^ -||41.190.63.174^ ||41.193.192.100^ ||41.219.185.171^ ||41.226.60.115^ ||41.72.203.82^ ||41.76.157.2^ ||41.86.18.200^ -||41.86.18.201^ +||41.86.5.164^ ||41.86.5.197^ +||42.202.101.118^ ||42.202.101.199^ +||42.224.51.229^ ||42.228.60.114^ ||42.229.173.80^ ||42.230.91.1^ ||42.231.208.64^ +||42.236.212.157^ ||42.56.15.227^ ||42.61.99.155^ -||42.82.217.241^ +||43.230.207.204^ ||43.241.106.183^ -||43.241.108.134^ -||43.252.8.94^ ||45.133.1.242^ ||45.133.203.192^ ||45.135.134.228^ ||45.14.149.178^ ||45.14.149.182^ ||45.14.149.204^ -||45.141.84.182^ ||45.141.84.184^ ||45.144.225.118^ ||45.144.225.135^ @@ -1530,6 +1532,7 @@ ||45.144.225.27^ ||45.148.10.47^ ||45.148.10.94^ +||45.156.22.230^ ||45.176.109.205^ ||45.176.111.159^ ||45.176.111.35^ @@ -1547,7 +1550,6 @@ ||45.92.108.35^ ||45.95.169.153^ ||46.114.28.132^ -||46.161.185.15^ ||46.172.75.231^ ||46.20.63.218^ ||46.214.27.4^ @@ -1579,6 +1581,7 @@ ||49.213.170.49^ ||49.213.178.183^ ||49.213.179.129^ +||4et3ja.am.files.1drv.com^ ||5.14.122.233^ ||5.188.62.111^ ||5.2.70.50^ @@ -1597,10 +1600,8 @@ ||58.115.174.4^ ||58.125.191.4^ ||58.126.247.118^ -||58.141.122.109^ ||58.142.166.120^ ||58.142.200.124^ -||58.218.67.253^ ||58.22.212.107^ ||58.226.129.29^ ||58.229.194.122^ @@ -1611,7 +1612,6 @@ ||58.241.78.55^ ||58.243.126.133^ ||58.72.165.153^ -||58.72.165.39^ ||58.76.151.51^ ||58.97.206.33^ ||59.0.211.161^ @@ -1622,6 +1622,7 @@ ||59.151.246.125^ ||59.173.193.208^ ||59.23.114.97^ +||59.26.181.228^ ||59.30.12.254^ ||60.13.61.12^ ||60.208.135.42^ @@ -1645,7 +1646,6 @@ ||60.253.44.99^ ||60.253.51.127^ ||60.253.60.174^ -||60.253.8.81^ ||60.7.10.121^ ||60.7.8.43^ ||61.164.96.98^ @@ -1676,17 +1676,19 @@ ||62.141.73.58^ ||62.219.131.205^ ||62.219.143.46^ -||62.219.227.31^ ||62.31.126.33^ ||62.38.149.66^ ||62.38.222.98^ ||62.43.207.148^ ||62.90.165.236^ ||63.245.122.93^ +||64.233.154.99^ +||65.0.168.152^ ||65.125.128.196^ ||65.21.58.252^ ||65.26.155.131^ ||65.35.61.255^ +||66.108.199.144^ ||66.229.214.115^ ||66.57.55.210^ ||66.74.7.197^ @@ -1747,7 +1749,6 @@ ||73.70.164.42^ ||74.101.1.159^ ||74.108.224.112^ -||74.119.195.101^ ||74.194.117.165^ ||74.195.115.176^ ||74.199.84.77^ @@ -1851,6 +1852,7 @@ ||84.40.127.242^ ||84.42.20.217^ ||8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com^ +||85.105.11.216^ ||85.105.123.251^ ||85.105.135.187^ ||85.105.180.33^ @@ -1863,13 +1865,13 @@ ||85.74.215.180^ ||85.97.130.227^ ||86.35.43.220^ -||87.110.105.250^ +||87.117.11.46^ ||87.172.19.130^ ||87.61.89.40^ -||87du.vip^ ||88.119.171.253^ ||88.2.208.71^ ||88.2.219.179^ +||88.218.17.110^ ||88.218.17.149^ ||88.225.222.128^ ||88.247.96.19^ @@ -1878,10 +1880,12 @@ ||88.249.244.180^ ||88.250.204.12^ ||88.250.226.26^ +||88.250.240.245^ ||88.250.254.90^ ||89.122.183.130^ ||89.136.197.170^ ||89.22.152.244^ +||89.248.112.202^ ||89.29.213.33^ ||89.40.85.166^ ||8poieq.bn.files.1drv.com^ @@ -1957,7 +1961,6 @@ ||aceeprc.com.aceeprc.com^ ||acellr.co.uk^ ||acteon.com.ar^ -||activecost.com.au^ ||addahealingmusic.com^ ||adithimedia.com^ ||adithimedia.memengers.com^ @@ -2018,11 +2021,14 @@ ||artedibujoyarquitectura.com^ ||arwenyapi.com^ ||ask-regard.call-save.biz^ +||asucssa.live^ ||atfile.com^ ||athenacapsg.com^ +||atlasconcreteworks.com^ ||attach.66rpg.com^ ||atteuqpotentialunlimited.com^ ||augustair.com^ +||aulist.com^ ||automaticrefreshments.com^ ||avadhanagames.com^ ||ayahuascasp.com.br^ @@ -2038,6 +2044,7 @@ ||bary.sz4h.com^ ||bash.givemexyz.in^ ||bausch.kr-atlas.monaxikoslykos@zytrox.tk^ +||bavhome.com^ ||bbia.co.uk^ ||bcmt.elin.co.za^ ||bcrg.co.za^ @@ -2089,7 +2096,6 @@ ||bt2.elin.co.za^ ||btdapi.robotake.com^ ||buigiaphat.com.vn^ -||bulkyfoodja.com^ ||bullseyemedia.in^ ||busandvanrentalmalaysia.com^ ||buscascolegios.diit.cl^ @@ -2103,11 +2109,8 @@ ||calgaryautorepairservice.com^ ||callbury.in^ ||camminachetipassa.it^ -||canadianwork.cc^ ||capitalgroup-kw.com^ ||capoeiraventrelivre.com^ -||carlsbadre.com^ -||carsidecor.com^ ||cashyinvestment.org^ ||catchperch.com^ ||catchpoolshetlands.co.uk^ @@ -2144,7 +2147,6 @@ ||colorpak.pl^ ||columbia.aula-web.net^ ||community.reimclub.com^ -||comosairdoburaco.com.br^ ||competancy.indigoconsult.net^ ||conceptimagine.ro^ ||config.cqhbkjzx.com^ @@ -2153,12 +2155,14 @@ ||consulateins.solucioneslink.com^ ||contributeindustry.com^ ||copelandscapes.com^ +||corwin-tommie06f.ru.com^ ||coulsongraphics.com^ ||count.mail.163.com.impactmedfoundation.com^ ||covid19.cyberschool.or.id^ ||cpanel.shivay.net^ ||cr-sq.com^ ||craftech.nxtnet.ga^ +||crearechile.cl^ ||creationskateboards.com^ ||crecerco.com^ ||crittersbythebay.com^ @@ -2168,6 +2172,7 @@ ||crscorretordeimoveis.com.br^ ||cse-engineer.com^ ||csnserver.com^ +||ctracknxt.in^ ||cubescargoexpress.com^ ||curasoles.co.za^ ||currantmedia.com^ @@ -2186,7 +2191,6 @@ ||dating.khokhas.co.za^ ||datsom.vn^ ||davethompson.me.uk^ -||davidmcguinness.info^ ||dayspringdaisies.com^ ||dd.qiyuea.cn^ ||ddns.cyberium.cc^ @@ -2220,14 +2224,11 @@ ||dl.installcdn-aws.com^ ||dl.packetstormsecurity.net^ ||dl.rina-roleplay.com^ -||dnn.alibuf.com^ -||dns.alibuf.com^ ||dockerupdate.anondns.net^ ||docman.orientalservices.in^ ||dodsonimaging.com^ ||doitunlimited.com^ ||dokan.blueberrytec.com^ -||dom-chel74.ru^ ||dom.daf.free.fr^ ||doncedyhall.com^ ||donghobinhminh.com^ @@ -2237,6 +2238,7 @@ ||dosman.pl^ ||dovberger.com^ ||down.pcclear.com^ +||down.udashi.com^ ||down.webbora.com^ ||down1.arpun.com^ ||download.caihong.com^ @@ -2267,6 +2269,7 @@ ||eandgdesign.com.ng^ ||eastsheen-glaziers.co.uk^ ||ebruyatkin.com^ +||edu.saicraftsman.com^ ||eedo.ee^ ||efficientegroup.com^ ||elbauldenora.com^ @@ -2281,8 +2284,8 @@ ||erp.zilymax.com^ ||escola.probommar.org.br^ ||esnconsultants.com^ -||esrhf04.top^ ||essentia.org.br^ +||estjh05.top^ ||ethereality.info^ ||eubanks7.com^ ||europeanzonexxi.com^ @@ -2351,9 +2354,11 @@ ||goldcoastoffice365.com^ ||golden-memories-funerals.yourpageserver.com^ ||goldenasiacapital.com^ +||goldmen.in^ ||gpotecnosystems.com^ ||gracejukes.com^ ||grupoinmare.com^ +||gruposelt.000webhostapp.com^ ||gs.monerorx.com^ ||guide-to-cell-phones.com^ ||gulfac-house.com^ @@ -2381,6 +2386,7 @@ ||hmpmall.co.kr^ ||hoagietesting10.com^ ||hoayeuthuong-my.sharepoint.com^ +||holmesservices.mobiledevsite.co^ ||homefindersolutions.com^ ||hongluosi.com^ ||hookedupboatclub.com^ @@ -2393,6 +2399,7 @@ ||htownbars.com^ ||hubtech.co.za^ ||huellacero.cl^ +||hunchomusichub.com^ ||hunggiang.vn^ ||husamiyahschool.com^ ||iabmixx2020.rayadigital.online^ @@ -2444,7 +2451,6 @@ ||jay.diamondrelationscrm.us^ ||jebs.net.au^ ||jeffdahlke.com^ -||jhayesconsulting.com^ ||jiaoyuzixun.cn^ ||jing-da.com.tw^ ||jmtc.91756.cn^ @@ -2458,7 +2464,6 @@ ||jupiter.toxsl.in^ ||justinscott.com.au^ ||kadigital.co.uk^ -||kaizenjanitorial.com^ ||kalawatihomes.com^ ||kalogirosfinance.com^ ||kaptaanchapal.com^ @@ -2469,17 +2474,15 @@ ||ketofitnessexpert.com^ ||kevinjewelry.com.co^ ||keywatch.yourpageserver.com^ -||khmerosja.net^ ||kingssa.co.za^ ||kizitox.ga^ ||kjcpromo.com^ -||kldatabase.com^ ||kleinendeli.co.za^ ||korrectconceptservices.com^ ||krisbadminton.com^ ||ktb.sch.id^ ||kubatoglubaklava.com.tr^ -||kullumanalitours.com^ +||kumaralok.in^ ||kwanfromhongkong.com^ ||kz.sldov.ru^ ||lacasadelosalebrijes.com^ @@ -2488,7 +2491,6 @@ ||laodongnhat.vn^ ||laravel.pointersoftwares.com.br^ ||lasermobilesounds.co.uk^ -||laura9630fr.com^ ||lauratomismith.com^ ||lautarosanmiguel.com^ ||lawforall.edu.lk^ @@ -2590,14 +2592,12 @@ ||misterson.com^ ||mkontakt.az^ ||mktf.mx^ -||mmdx.com^ ||mmogollon.com.mx^ ||mncarteam.com^ ||modelhouseturkey.com^ ||modernmanna.org^ ||monetization.business^ ||moninediy.com^ -||mopai.sg^ ||motorcomunicacion.com^ ||moumitas.com^ ||msacontabil.com.br^ @@ -2616,7 +2616,7 @@ ||nap.mgsservers.com^ ||navayurveda.in^ ||nec-i.com^ -||nellaimasthanbiryani.com^ +||nelitrianggraeni.000webhostapp.com^ ||nerve.untergrund.net^ ||nettube.com.br^ ||networkwheels.co.za^ @@ -2635,6 +2635,7 @@ ||nilinkeji.com^ ||nimboohomes.com^ ||njtiledesigncenter.com^ +||nmxwllwsdyminoragenw.dns.army^ ||nobius.org^ ||nocalnoodle.elin.co.za^ ||nomadicbees.com^ @@ -2648,6 +2649,7 @@ ||nyeh2o.com.au^ ||obseques-conseils.com^ ||oecteam.com^ +||ohe.ie^ ||ohsewgorgeous.co.uk^ ||oknoplastik.sk^ ||oleholeh.memangbeda.website^ @@ -2680,6 +2682,7 @@ ||pagos.krayem.com.mx^ ||palbas.cl^ ||palochusvet.szm.com^ +||panslimiterd.com^ ||parallel.rockvideos.at^ ||parejasfelices.mi-fs.com^ ||parkhussion.com^ @@ -2710,6 +2713,7 @@ ||plasfan.ind.br^ ||playground2.grupoaliadasca.com^ ||pmglance.startwriteup.com^ +||pmrimewsdylimtewsogh.dns.army^ ||pokojewewladyslawowie.pl^ ||pole.com.vc^ ||pool.phxdir.com^ @@ -2723,7 +2727,6 @@ ||prishaartcreations.com^ ||production.sparshims.com^ ||programaoperadoronline.com.br^ -||project.exquitec.com^ ||promotoradescomplica.com.br^ ||promoversdubai.com^ ||propertiq.elin.co.za^ @@ -2733,7 +2736,6 @@ ||prosyarmakassar.com^ ||provence.elin.co.za^ ||prox.realunix.cc^ -||prueba.danielluza.com^ ||pujashoppe.in^ ||punchdialogues.com^ ||punjabdevelopersassociation.com.pk^ @@ -2748,7 +2750,6 @@ ||rainbowisp.info^ ||rajeshtailang.com^ ||rakeshkhatri.in^ -||raodigitalmedia.com^ ||raquelhelena.com.br^ ||rarlabarchiver.ac^ ||rasadbar.ir^ @@ -2762,7 +2763,6 @@ ||readymmade.com^ ||recyclethesurplus.com^ ||redbats.co.in^ -||redboxmultimedia.com^ ||redchillicrackers.com^ ||reifenquick.de^ ||relaxindulge.co.nz^ @@ -2846,7 +2846,6 @@ ||sibernetix.fr^ ||sigapresschennai.com^ ||sige.brisainformatica.com.br^ -||signatureads.co.in^ ||siili.net^ ||simoneporzi.it^ ||simorsint.com^ @@ -2882,7 +2881,6 @@ ||spetsesyachtcharter.gr^ ||spititourism.com^ ||spittinfire.com^ -||springbedspetroleum.com^ ||src1.minibai.com^ ||sreenivasapaintingworks.com^ ||sriglobalit.com^ @@ -2924,12 +2922,12 @@ ||tajushariya.com^ ||tallyinvoicecustomization.com^ ||taltus.co.uk^ -||tapalkoedacoffee.com^ ||tarravalleyfoods.com.au^ ||tavo.cl^ ||tc.snpsresidential.com^ ||tcy.198424.com^ ||tdsp.yngw518.com^ +||tech332.synology.me^ ||techgms.com^ ||teduae.com^ ||teleargentina.com^ @@ -2968,6 +2966,7 @@ ||theprofinn.com^ ||thesummitpc.net^ ||theurbantutors.com^ +||theviewsdyjupcazfeqv.dns.army^ ||thosewebbs.com^ ||thriveink.com^ ||tianangdep.com^ @@ -2985,6 +2984,7 @@ ||toplevel.com.br^ ||topmask.co.za^ ||torresquinterocorp.com^ +||towme.services^ ||toyotacollege.ac.th^ ||tpke.hu^ ||translaterjemah.com^ @@ -3008,8 +3008,7 @@ ||umwelt-kirchhof.de^ ||unicorpbrunei.com^ ||uniengrisb.com^ -||unisoftcc.com^ -||unityindiversity.in^ +||unitedwsdykesokowskg.dns.army^ ||unyazitelecom.com^ ||upcbpta.com^ ||urbantrapfest.cl^ @@ -3017,6 +3016,7 @@ ||useformoney.000webhostapp.com^ ||uss.ac.th^ ||uzzepay.com.br^ +||v2consultores.com^ ||vanzare.cabanabrazi2.ro^ ||vbcargo.hu^ ||vcah.co.uk^ @@ -3076,11 +3076,14 @@ ||woodsytech.com^ ||wordpress.saleensuporte.com.br^ ||workingsolutionsrome.org^ -||wozata.000webhostapp.com^ ||wp.readhere.in^ ||wpdemo.101clients.com.au^ ||writtendeer.com^ ||ws5588.f3322.net^ +||wsdyalgreenkelveskxz.dns.army^ +||wsdykungsb2talenwsjf.dns.army^ +||wsdyrkkrgorgiousejhd.dns.army^ +||wsdysara1investvwsfs.dns.army^ ||wsdysuresbonescagegp.dns.army^ ||wyklej.pl^ ||x2vn.com^ diff --git a/urlhaus-filter-agh.txt b/urlhaus-filter-agh.txt index 6d7b784a..1df7abbc 100644 --- a/urlhaus-filter-agh.txt +++ b/urlhaus-filter-agh.txt @@ -1,5 +1,5 @@ ! Title: Malicious URL Blocklist (AdGuard Home) -! Updated: Thu, 08 Apr 2021 00:12:42 UTC +! Updated: Thu, 08 Apr 2021 12:12:46 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/urlhaus-filter ! License: https://gitlab.com/curben/urlhaus-filter#license @@ -7235,6 +7235,7 @@ ||104.248.45.10^ ||104.248.46.116^ ||104.248.47.15^ +||104.248.48.18^ ||104.248.49.76^ ||104.248.5.108^ ||104.248.5.19^ @@ -8844,6 +8845,7 @@ ||107.173.222.122^ ||107.173.222.123^ ||107.173.222.153^ +||107.173.23.240^ ||107.173.24.139^ ||107.173.24.145^ ||107.173.24.14^ @@ -44051,6 +44053,7 @@ ||115.53.254.154^ ||115.53.254.163^ ||115.53.254.17^ +||115.53.254.187^ ||115.53.254.192^ ||115.53.254.217^ ||115.53.254.218^ @@ -131883,6 +131886,7 @@ ||119.123.216.171^ ||119.123.216.178^ ||119.123.216.184^ +||119.123.216.19^ ||119.123.216.206^ ||119.123.216.208^ ||119.123.216.218^ @@ -155791,6 +155795,7 @@ ||123.4.251.84^ ||123.4.252.120^ ||123.4.252.12^ +||123.4.252.144^ ||123.4.252.159^ ||123.4.252.170^ ||123.4.252.198^ @@ -161126,6 +161131,7 @@ ||123.9.193.14^ ||123.9.193.152^ ||123.9.193.154^ +||123.9.193.157^ ||123.9.193.164^ ||123.9.193.168^ ||123.9.193.179^ @@ -162513,6 +162519,7 @@ ||123moviesfx.com^ ||123sellfast.com^ ||123sex.co^ +||123tadi.com^ ||123xyz.xyz^ ||124.100.74.153^ ||124.105.105.222^ @@ -164892,6 +164899,7 @@ ||124.40.246.95^ ||124.43.216.1^ ||124.45.136.224^ +||124.5.112.43^ ||124.5.203.86^ ||124.5.24.59^ ||124.5.28.41^ @@ -184022,6 +184030,7 @@ ||125.99.220.27^ ||125.99.221.206^ ||125.99.222.152^ +||125.99.222.170^ ||125.99.222.245^ ||125.99.222.2^ ||125.99.222.76^ @@ -187647,6 +187656,7 @@ ||14.42.155.140^ ||14.42.206.204^ ||14.42.229.214^ +||14.42.237.237^ ||14.42.48.241^ ||14.42.53.134^ ||14.42.80.24^ @@ -195359,6 +195369,7 @@ ||172.105.247.88^ ||172.105.36.168^ ||172.105.61.165^ +||172.105.68.51^ ||172.105.69.5^ ||172.105.70.225^ ||172.105.79.99^ @@ -198091,6 +198102,7 @@ ||172.93.162.253^ ||172.93.165.221^ ||172.93.176.137^ +||172.93.176.142^ ||172.93.184.161^ ||172.93.184.71^ ||172.93.187.131^ @@ -202464,6 +202476,7 @@ ||178.169.165.90^ ||178.169.68.162^ ||178.17.170.28^ +||178.17.171.144^ ||178.17.174.43^ ||178.170.117.50^ ||178.170.117.8^ @@ -202485,6 +202498,7 @@ ||178.175.0.125^ ||178.175.0.129^ ||178.175.0.140^ +||178.175.0.143^ ||178.175.0.144^ ||178.175.0.146^ ||178.175.0.149^ @@ -202728,6 +202742,7 @@ ||178.175.10.66^ ||178.175.10.6^ ||178.175.10.71^ +||178.175.10.76^ ||178.175.10.78^ ||178.175.10.85^ ||178.175.10.87^ @@ -203124,6 +203139,7 @@ ||178.175.103.48^ ||178.175.103.4^ ||178.175.103.50^ +||178.175.103.52^ ||178.175.103.54^ ||178.175.103.58^ ||178.175.103.61^ @@ -203247,6 +203263,7 @@ ||178.175.104.62^ ||178.175.104.64^ ||178.175.104.66^ +||178.175.104.67^ ||178.175.104.69^ ||178.175.104.80^ ||178.175.104.85^ @@ -203586,6 +203603,7 @@ ||178.175.107.68^ ||178.175.107.6^ ||178.175.107.70^ +||178.175.107.71^ ||178.175.107.75^ ||178.175.107.76^ ||178.175.107.78^ @@ -204381,6 +204399,7 @@ ||178.175.114.13^ ||178.175.114.142^ ||178.175.114.145^ +||178.175.114.146^ ||178.175.114.151^ ||178.175.114.152^ ||178.175.114.155^ @@ -204640,6 +204659,7 @@ ||178.175.116.200^ ||178.175.116.201^ ||178.175.116.207^ +||178.175.116.20^ ||178.175.116.211^ ||178.175.116.212^ ||178.175.116.214^ @@ -205986,6 +206006,7 @@ ||178.175.127.216^ ||178.175.127.217^ ||178.175.127.219^ +||178.175.127.223^ ||178.175.127.224^ ||178.175.127.225^ ||178.175.127.228^ @@ -206145,6 +206166,7 @@ ||178.175.14.152^ ||178.175.14.153^ ||178.175.14.154^ +||178.175.14.155^ ||178.175.14.156^ ||178.175.14.157^ ||178.175.14.160^ @@ -206538,6 +206560,7 @@ ||178.175.18.203^ ||178.175.18.205^ ||178.175.18.20^ +||178.175.18.214^ ||178.175.18.215^ ||178.175.18.219^ ||178.175.18.223^ @@ -206595,6 +206618,7 @@ ||178.175.19.150^ ||178.175.19.157^ ||178.175.19.158^ +||178.175.19.160^ ||178.175.19.162^ ||178.175.19.163^ ||178.175.19.165^ @@ -206948,6 +206972,7 @@ ||178.175.21.38^ ||178.175.21.39^ ||178.175.21.40^ +||178.175.21.41^ ||178.175.21.42^ ||178.175.21.44^ ||178.175.21.53^ @@ -206973,6 +206998,7 @@ ||178.175.22.117^ ||178.175.22.118^ ||178.175.22.11^ +||178.175.22.120^ ||178.175.22.125^ ||178.175.22.129^ ||178.175.22.134^ @@ -207847,6 +207873,7 @@ ||178.175.3.80^ ||178.175.3.81^ ||178.175.3.85^ +||178.175.3.86^ ||178.175.3.87^ ||178.175.3.94^ ||178.175.3.98^ @@ -208089,6 +208116,7 @@ ||178.175.32.183^ ||178.175.32.184^ ||178.175.32.185^ +||178.175.32.186^ ||178.175.32.190^ ||178.175.32.196^ ||178.175.32.197^ @@ -208227,6 +208255,7 @@ ||178.175.33.28^ ||178.175.33.2^ ||178.175.33.30^ +||178.175.33.32^ ||178.175.33.38^ ||178.175.33.40^ ||178.175.33.50^ @@ -209036,6 +209065,7 @@ ||178.175.40.203^ ||178.175.40.204^ ||178.175.40.205^ +||178.175.40.209^ ||178.175.40.20^ ||178.175.40.211^ ||178.175.40.218^ @@ -209247,6 +209277,7 @@ ||178.175.42.42^ ||178.175.42.44^ ||178.175.42.45^ +||178.175.42.46^ ||178.175.42.48^ ||178.175.42.4^ ||178.175.42.53^ @@ -209765,6 +209796,7 @@ ||178.175.47.217^ ||178.175.47.218^ ||178.175.47.21^ +||178.175.47.220^ ||178.175.47.222^ ||178.175.47.224^ ||178.175.47.226^ @@ -209902,6 +209934,7 @@ ||178.175.48.59^ ||178.175.48.65^ ||178.175.48.66^ +||178.175.48.67^ ||178.175.48.6^ ||178.175.48.71^ ||178.175.48.76^ @@ -210181,6 +210214,7 @@ ||178.175.50.47^ ||178.175.50.48^ ||178.175.50.50^ +||178.175.50.54^ ||178.175.50.55^ ||178.175.50.57^ ||178.175.50.58^ @@ -210791,6 +210825,7 @@ ||178.175.56.56^ ||178.175.56.57^ ||178.175.56.61^ +||178.175.56.64^ ||178.175.56.66^ ||178.175.56.67^ ||178.175.56.69^ @@ -210858,6 +210893,7 @@ ||178.175.57.192^ ||178.175.57.19^ ||178.175.57.203^ +||178.175.57.204^ ||178.175.57.206^ ||178.175.57.209^ ||178.175.57.20^ @@ -211741,6 +211777,7 @@ ||178.175.65.181^ ||178.175.65.184^ ||178.175.65.186^ +||178.175.65.189^ ||178.175.65.18^ ||178.175.65.192^ ||178.175.65.193^ @@ -212228,6 +212265,7 @@ ||178.175.69.73^ ||178.175.69.74^ ||178.175.69.77^ +||178.175.69.79^ ||178.175.69.82^ ||178.175.69.83^ ||178.175.69.86^ @@ -213312,6 +213350,7 @@ ||178.175.79.189^ ||178.175.79.18^ ||178.175.79.196^ +||178.175.79.198^ ||178.175.79.199^ ||178.175.79.1^ ||178.175.79.200^ @@ -213622,6 +213661,7 @@ ||178.175.81.232^ ||178.175.81.235^ ||178.175.81.236^ +||178.175.81.240^ ||178.175.81.241^ ||178.175.81.244^ ||178.175.81.246^ @@ -214121,6 +214161,7 @@ ||178.175.86.105^ ||178.175.86.106^ ||178.175.86.108^ +||178.175.86.117^ ||178.175.86.119^ ||178.175.86.11^ ||178.175.86.122^ @@ -214147,6 +214188,7 @@ ||178.175.86.181^ ||178.175.86.182^ ||178.175.86.183^ +||178.175.86.184^ ||178.175.86.187^ ||178.175.86.188^ ||178.175.86.191^ @@ -214423,6 +214465,7 @@ ||178.175.88.79^ ||178.175.88.83^ ||178.175.88.84^ +||178.175.88.85^ ||178.175.88.8^ ||178.175.88.95^ ||178.175.89.0^ @@ -214823,6 +214866,7 @@ ||178.175.91.99^ ||178.175.92.100^ ||178.175.92.102^ +||178.175.92.105^ ||178.175.92.106^ ||178.175.92.108^ ||178.175.92.109^ @@ -215169,6 +215213,7 @@ ||178.175.95.102^ ||178.175.95.103^ ||178.175.95.104^ +||178.175.95.105^ ||178.175.95.111^ ||178.175.95.112^ ||178.175.95.114^ @@ -215362,6 +215407,7 @@ ||178.175.96.87^ ||178.175.96.88^ ||178.175.96.8^ +||178.175.96.93^ ||178.175.96.95^ ||178.175.96.96^ ||178.175.96.97^ @@ -215618,6 +215664,7 @@ ||178.175.99.209^ ||178.175.99.214^ ||178.175.99.216^ +||178.175.99.21^ ||178.175.99.221^ ||178.175.99.222^ ||178.175.99.223^ @@ -218635,6 +218682,7 @@ ||182.112.173.245^ ||182.112.173.8^ ||182.112.176.47^ +||182.112.177.134^ ||182.112.177.215^ ||182.112.177.93^ ||182.112.178.167^ @@ -261159,6 +261207,7 @@ ||183.83.0.112^ ||183.83.0.192^ ||183.83.0.230^ +||183.83.1.1^ ||183.83.1.221^ ||183.83.1.234^ ||183.83.1.239^ @@ -261271,6 +261320,7 @@ ||183.83.13.1^ ||183.83.13.69^ ||183.83.13.95^ +||183.83.14.20^ ||183.83.14.35^ ||183.83.14.3^ ||183.83.14.70^ @@ -263187,6 +263237,7 @@ ||185.8.202.254^ ||185.8.232.145^ ||185.80.92.4^ +||185.81.154.208^ ||185.81.157.124^ ||185.81.157.186^ ||185.81.98.78^ @@ -272154,6 +272205,7 @@ ||201.171.185.92^ ||201.171.204.13^ ||201.171.227.59^ +||201.171.40.215^ ||201.171.84.139^ ||201.175.63.186^ ||201.182.144.193^ @@ -279093,6 +279145,7 @@ ||213.183.63.124^ ||213.183.63.242^ ||213.186.35.153^ +||213.186.69.101^ ||213.189.178.163^ ||213.195.111.72^ ||213.200.133.18^ @@ -279380,6 +279433,7 @@ ||216.180.117.98^ ||216.180.117.9^ ||216.183.54.169^ +||216.183.54.196^ ||216.189.145.11^ ||216.189.177.221^ ||216.189.184.23^ @@ -279579,6 +279633,7 @@ ||217.12.199.179^ ||217.12.208.14^ ||217.12.209.74^ +||217.12.209.82^ ||217.12.210.156^ ||217.12.210.209^ ||217.12.221.244^ @@ -284073,6 +284128,7 @@ ||219.155.234.12^ ||219.155.234.155^ ||219.155.234.218^ +||219.155.234.33^ ||219.155.235.100^ ||219.155.235.145^ ||219.155.235.154^ @@ -291595,6 +291651,7 @@ ||220.81.201.7^ ||220.81.229.175^ ||220.81.30.193^ +||220.81.44.181^ ||220.81.44.92^ ||220.82.140.17^ ||220.82.182.150^ @@ -299540,6 +299597,7 @@ ||222.137.132.49^ ||222.137.133.110^ ||222.137.133.120^ +||222.137.133.125^ ||222.137.133.195^ ||222.137.133.212^ ||222.137.133.244^ @@ -309765,6 +309823,7 @@ ||222.142.210.122^ ||222.142.210.136^ ||222.142.210.138^ +||222.142.210.144^ ||222.142.210.146^ ||222.142.210.155^ ||222.142.210.163^ @@ -311692,6 +311751,7 @@ ||23.95.11.48^ ||23.95.116.135^ ||23.95.116.144^ +||23.95.122.24^ ||23.95.122.47^ ||23.95.13.131^ ||23.95.13.158^ @@ -325790,6 +325850,7 @@ ||27.5.39.11^ ||27.5.39.121^ ||27.5.39.122^ +||27.5.39.124^ ||27.5.39.127^ ||27.5.39.128^ ||27.5.39.140^ @@ -334728,6 +334789,7 @@ ||27.6.254.187^ ||27.6.254.232^ ||27.6.254.89^ +||27.6.255.101^ ||27.6.255.107^ ||27.6.255.121^ ||27.6.255.160^ @@ -355793,6 +355855,7 @@ ||42.2.137.29^ ||42.202.100.135^ ||42.202.100.233^ +||42.202.101.118^ ||42.202.101.133^ ||42.202.101.136^ ||42.202.101.138^ @@ -357200,6 +357263,7 @@ ||42.224.158.206^ ||42.224.158.208^ ||42.224.158.227^ +||42.224.158.22^ ||42.224.158.231^ ||42.224.158.234^ ||42.224.158.24^ @@ -360151,6 +360215,7 @@ ||42.224.51.213^ ||42.224.51.222^ ||42.224.51.223^ +||42.224.51.229^ ||42.224.51.239^ ||42.224.51.23^ ||42.224.51.75^ @@ -379290,6 +379355,7 @@ ||42.236.212.147^ ||42.236.212.154^ ||42.236.212.155^ +||42.236.212.157^ ||42.236.212.158^ ||42.236.212.159^ ||42.236.212.167^ @@ -388820,6 +388886,7 @@ ||4ele.pl^ ||4ertybhdfrt.gq^ ||4esports.de^ +||4et3ja.am.files.1drv.com^ ||4evakleen.com.au^ ||4eventfacilities.nl^ ||4evernails.nl^ @@ -397354,6 +397421,7 @@ ||59.25.9.121^ ||59.25.9.126^ ||59.26.12.115^ +||59.26.181.228^ ||59.26.20.177^ ||59.26.209.230^ ||59.26.214.148^ @@ -433128,6 +433196,7 @@ ||6481254.ru^ ||649924.nchsoftwarecom.com^ ||64x9bg.ch.files.1drv.com^ +||65.0.168.152^ ||65.0.173.107^ ||65.0.179.146^ ||65.0.55.192^ @@ -433173,6 +433242,8 @@ ||65k2.com^ ||66-gifts.com^ ||66.103.9.249^ +||66.108.199.144^ +||66.109.135.129^ ||66.11.110.27^ ||66.11.125.94^ ||66.110.228.60^ @@ -437959,6 +438030,7 @@ ||88.218.16.87^ ||88.218.16.9^ ||88.218.17.109^ +||88.218.17.110^ ||88.218.17.119^ ||88.218.17.149^ ||88.218.17.179^ @@ -438525,6 +438597,7 @@ ||89.239.96.164^ ||89.244.238.226^ ||89.245.110.35^ +||89.248.112.202^ ||89.248.166.171^ ||89.248.166.183^ ||89.248.167.133^ @@ -441334,6 +441407,7 @@ ||999.buzz^ ||999.co.id^ ||999.rajaojek.com^ +||999080321newfolder1002002131-service1002.space^ ||999102com.cn^ ||99bkx.com^ ||99centsdigitals.com^ @@ -443521,6 +443595,7 @@ ||ahiskatv.net^ ||ahitekniktarti.com^ ||ahiyangrup.com.tr^ +||ahjianlong.cf^ ||ahjuric.si^ ||ahk.smu8street.ru^ ||ahkha.com^ @@ -443945,6 +444020,7 @@ ||akivj07.top^ ||akktis.com^ ||akkurtmadencilik.com^ +||aklatdelmundo.com^ ||akleigh.com^ ||aklin.ir^ ||aklocalshop.com^ @@ -444657,7 +444733,6 @@ ||allainesconsultancyinc.com^ ||allamanolibrary.com^ ||allan-it.com^ -||allanabolicsteam.net^ ||allanelect.co.uk^ ||allangillphotography.com^ ||allanhollowell.com^ @@ -444931,6 +445006,7 @@ ||aloneintheweb.com^ ||aloneskisehir.com^ ||alongthelines.com^ +||alongwalker.com^ ||alonhadat24h.vn^ ||alooshop.ir^ ||aloravan.com^ @@ -445689,7 +445765,6 @@ ||ana.plecko.eu^ ||anaaj.pk^ ||anabim.com^ -||anabolicsteroidsbuy.info^ ||anaceb.com^ ||anadearmas.net^ ||anadelgbt.org^ @@ -449662,7 +449737,6 @@ ||b97pm6.com^ ||ba3capital.com^ ||baacsetu.org^ -||baadababada.ru^ ||baaders-namibia.com^ ||baakcafe.com^ ||baamiraan.ir^ @@ -449784,7 +449858,6 @@ ||backup.xn----8sba7bmrlhv0a.xn--p1ai^ ||backup2.robinandelaine.com^ ||backupcom.e-twow.uk^ -||backupez.com^ ||backupfashions.com^ ||backupsitedev.flywheelsites.com^ ||backupsql.datasiswebcontable.com^ @@ -451167,7 +451240,6 @@ ||belaythakayni.com^ ||belboks.com^ ||belboy.in^ -||belcineloweek.ru^ ||belconger.com^ ||belcorpisl.com^ ||belcvet.com^ @@ -453726,7 +453798,6 @@ ||bobbyworld.top^ ||bobcar.com.my^ ||bobcatofchico.com^ -||bobcatofredding.com^ ||bobcook.ca^ ||bobdolph.com^ ||bobenstetter.net^ @@ -454978,7 +455049,6 @@ ||bucketstrong.s3-us-west-1.amazonaws.com^ ||buckeyechartershiltonhead.com^ ||buckeyeoptical.com^ -||buckeyesecurity.net^ ||buckinghamandlloyds.com^ ||buckleman.co.id^ ||bucklindata.net^ @@ -455067,6 +455137,7 @@ ||buildcraftindia.com^ ||buildentconstructions.com^ ||builder.acasia.mx^ +||builder.makemoneywith.website^ ||buildersmerchantsfederation-my.sharepoint.com^ ||buildgreenindustries.com^ ||building-company.lt^ @@ -455610,7 +455681,6 @@ ||c.oooooooooo.ga^ ||c.pieshua.com^ ||c.teamworx.ph^ -||c.top4top.io^ ||c.top4top.net^ ||c.vivi.casa^ ||c.vollar.ga^ @@ -456282,6 +456352,7 @@ ||capitalonefinanceltd.in^ ||capitalpellets.com^ ||capitalpremiumfinancinginc.com^ +||capitalprint.co.za^ ||capitalprivateasset.com^ ||capitalrealestate.us^ ||capitalrh.com.br^ @@ -461122,6 +461193,7 @@ ||covid19map.digital^ ||covid19quarantin.com^ ||covid19safety.myftp.org^ +||covid19vaccinations.hopto.org^ ||covid19vaccine.hopto.org^ ||covid2023.info^ ||covidbase.info^ @@ -462480,6 +462552,7 @@ ||daclim.ro^ ||daco-precision.thomaswebs.net^ ||daco.nyccomputerconsulting.com^ +||dacsancaonguyen.vn^ ||dactridaudaday.com^ ||dactyltech.co.za^ ||dacviadokese.com^ @@ -471124,6 +471197,7 @@ ||estimating.training^ ||estimatorfind.com^ ||estimetercume.com^ +||estjh05.top^ ||estore.qurvex.com^ ||estoyadieta.com^ ||estrategias-corporativas.com^ @@ -471299,7 +471373,6 @@ ||etxse.xyz^ ||etysu02scnabr03wzaxue.com^ ||eu-easy.com^ -||eu.wildfire.paloaltonetworks.com^ ||eu1.salesforce.com^ ||eu283iwoqodjspqisjdf.com^ ||eu5-cdn.devid.info^ @@ -473443,7 +473516,6 @@ ||files.dropmybin.me^ ||files.enjin.com^ ||files.gathercdn.com^ -||files.hrloo.com^ ||files.l-d.tech^ ||files.martellexpress.us^ ||files.mirai-2viv.vn^ @@ -475176,6 +475248,7 @@ ||friendzonecafe.com^ ||frietfun.be^ ||frigolutasima.net^ +||frigoprehrana.com^ ||frigoriferivignola.it^ ||frigotechniek.be^ ||frigsales.com^ @@ -475657,7 +475730,6 @@ ||fv1-2.failiem.lv^ ||fv13.failiem.lv^ ||fv15.failiem.lv^ -||fv2-2.failiem.lv^ ||fv2-7.failiem.lv^ ||fv3.failiem.lv^ ||fv6.failiem.lv^ @@ -475735,7 +475807,6 @@ ||g0zh8lb3.com^ ||g15aocbenedict.com^ ||g1ba4tt4ngq5nl7w.xyz^ -||g1smurt.ru^ ||g20digital.com.br^ ||g237.cn^ ||g2creditsolutions.com^ @@ -475823,9 +475894,6 @@ ||gadaniya-magiya.site^ ||gadcoafrica.com^ ||gaddco.com^ -||gade4senate.com^ -||gadebrigade.com^ -||gadeforussenate.com^ ||gadem.ug^ ||gadesoluciones.pe^ ||gadget-plaza.ru^ @@ -477973,6 +478041,7 @@ ||gomitra.com^ ||gomovies.cl^ ||gomsubattrangxuatkhau.com^ +||gomsuminhlongthainguyen.vn^ ||gomus.com.br^ ||gomyfiles.info^ ||gomypass.com^ @@ -479471,7 +479540,6 @@ ||h.epelcdn.com^ ||h.eurotrading.com.pl^ ||h.j990981.ru^ -||h.top4top.io^ ||h.valerana44.ru^ ||h002295863.nichost.ru^ ||h0h.org^ @@ -481701,7 +481769,6 @@ ||home.99eurowebsite.ie^ ||home.barley-plus.com^ ||home.dawang.ink^ -||home.earthlink.net^ ||home.evrstudio.com^ ||home.healthiestu.com^ ||home.isdes.com^ @@ -482071,6 +482138,7 @@ ||hostfleek.com^ ||hostgo.com.br^ ||hostile-gaming.fr^ +||hostimpel.com^ ||hosting-c.iuro.nl^ ||hosting.drupwayinfotech.in^ ||hosting.mrsofttech.com^ @@ -488527,6 +488595,7 @@ ||kabelinieseti.ru^ ||kabiguru.org^ ||kabiledans.com^ +||kabimmo.com^ ||kabinarf.ru^ ||kabiru.ru^ ||kabiryogashramlimbdi.com^ @@ -489944,7 +490013,6 @@ ||kilnrefractory.com^ ||kilolo.site^ ||kilop.goodvibeskickin.com^ -||kilopaskal.ru^ ||kimaco.com^ ||kimberly.digital^ ||kimberly5esthetique.com^ @@ -490276,7 +490344,6 @@ ||klaus-moersch.de^ ||klausnerlaw.com^ ||klaussen.net^ -||klaustrofebia.ru^ ||klavze28.com^ ||klbay.net^ ||kldatabase.com^ @@ -493178,6 +493245,7 @@ ||library.cifor.org^ ||library.dhl-xom.com^ ||library.iainbengkulu.ac.id^ +||library.mju.ac.th^ ||library.phibi.my.id^ ||library.piet.co.in^ ||library.strophicmusic.com^ @@ -494950,7 +495018,6 @@ ||luminouspla.net^ ||luminouspneuma.com^ ||lumnus.com.br^ -||lumoura.com^ ||lumperpush.com^ ||lumsdancorp.com^ ||lun.otrweb.ru^ @@ -495112,6 +495179,7 @@ ||lykangblog.com^ ||lykusglobal.com^ ||lylevr.com^ +||lyllacarter.com^ ||lylydressforless.com^ ||lymcomercial.cl^ ||lymfodrenaze.eu^ @@ -498268,6 +498336,7 @@ ||medicinadellavoromb.it^ ||medicinaesteticaorlandini.it^ ||medicinageriatrica.com.br^ +||medicinainterna-critica.com^ ||medicinaonline.rjsrwaco.watchdogdns.duckdns.org^ ||medicine.softberg.ro^ ||mediclaim.odhavnidhi.org^ @@ -501438,6 +501507,7 @@ ||mtcinteriordesign.co.uk^ ||mtcr.co.za^ ||mtcuadrado.com^ +||mtdc.com.my^ ||mte1.cn^ ||mtechagency.com^ ||mteestore.com^ @@ -502134,7 +502204,6 @@ ||myimmigrationlawmarketingpartner.com^ ||myimmogroup.be^ ||myinfoart.online^ -||myinstabuzzz.co^ ||myinstantguru.com^ ||myinternetjobs.com^ ||myintromationsz.win^ @@ -502160,6 +502229,7 @@ ||mylinkguard.com^ ||mylistbuildingtraffic.com^ ||mylisting.martinface.com^ +||myliverpoolnews.cf^ ||myloanbaazar.com^ ||myloanexpert.in^ ||mylocal.dk^ @@ -503749,6 +503819,7 @@ ||news.intertours.org.rs^ ||news.leta.com.vn^ ||news.lwinmoenaing.me^ +||news.makemoneywith.website^ ||news.medicaid.ir^ ||news.omumusic.net^ ||news.palette69.com^ @@ -504532,6 +504603,7 @@ ||nmsk.online^ ||nmsr.info^ ||nmvconstructions.com^ +||nmxwllwsdyminoragenw.dns.army^ ||nn-webdesign.be^ ||nn.5ctelematics.com^ ||nnasout.com^ @@ -505312,7 +505384,6 @@ ||nvdweb.azurewebsites.net^ ||nveeusa.com^ ||nvelj12qyyfi03kqxy.xyz^ -||nvgeeforsegt.ru^ ||nvgp.com.au^ ||nvi.edu.vn^ ||nvl.netsmartz.net^ @@ -506530,7 +506601,6 @@ ||only4atalg.ml^ ||onlyapteka.ru^ ||onlyart.in^ -||onlybamboofabrics.com^ ||onlycane.in^ ||onlychild.org^ ||onlycocktaildresses.com^ @@ -508520,6 +508590,7 @@ ||pazarcheto.com^ ||pazargezer.com^ ||pazcomau-my.sharepoint.com^ +||pazpus.com^ ||pb-xt.com^ ||pb.divaasolutions.com^ ||pb128o6c2favwk.com^ @@ -510265,6 +510336,7 @@ ||pmrimestdylimtdvenst.dns.army^ ||pmrimestdylimtdvests.dns.army^ ||pmrimestdylimtstwork.dns.army^ +||pmrimewsdylimtewsogh.dns.army^ ||pmrimewsdylimtwswods.dns.army^ ||pms.stercomagento.com^ ||pmsports.de^ @@ -511983,6 +512055,7 @@ ||prosupport.cl^ ||prosvyaz.kz^ ||prosyarmakassar.com^ +||prosystemsug.com^ ||prosysvinorosso.com^ ||prot.drupal8.softikom.lv^ ||protaciohospital.com^ @@ -511993,7 +512066,6 @@ ||protech.mn^ ||protechcarpetcare.com^ ||protechgroup1.com^ -||protect.mimecast-offshore.com^ ||protectiadatelor.biz^ ||protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org^ ||protection.pecol.eu^ @@ -513193,6 +513265,7 @@ ||quatanghoanglong.com^ ||quatangluuniemhue.com^ ||quatangtaynguyen.com^ +||quatangtaynguyen.vn^ ||quatest.sixstarsent.com^ ||quatet365.com^ ||quatram.de^ @@ -513258,6 +513331,7 @@ ||quickbookstechnicalsupportphonenumber.com^ ||quickboooks.host^ ||quickboooks.space^ +||quickcompanyreg.co.za^ ||quickfingers.net^ ||quickinsolutions.com^ ||quicklifecare.com^ @@ -515859,7 +515933,6 @@ ||roadscompass.com^ ||roadtravelcars.com^ ||roanokecellphonerepair.com^ -||roanokemortgages.com^ ||roastedguarmeal.com^ ||roba.nu^ ||robaitec.com^ @@ -518232,6 +518305,7 @@ ||savasaachi.systems^ ||savaspark.com.tr^ ||save-room.info^ +||save.makemoneywith.website^ ||save24x7.com^ ||saveanimal.org^ ||savecannabis.org^ @@ -521892,6 +521966,7 @@ ||slrpros.com^ ||sls-eg.com^ ||sls-security.ru^ +||slsbearings.com.sg^ ||slservicebd.com^ ||slubnefury.pl^ ||slugard.5gbfree.com^ @@ -523824,7 +523899,6 @@ ||srnirob.com^ ||srno.hu^ ||sromano.it^ -||sromecorlduce.ru^ ||sroomf70nasiru.duckdns.org^ ||srooooiva.ru^ ||srpresse.fr^ @@ -525656,7 +525730,6 @@ ||sunflowerschoolandcollege.com^ ||sunfruit.com.tn^ ||sunganak.in^ -||sungardspo.com^ ||sungazer.com.au^ ||sunglasses2020.com^ ||sungvalopkhongsam.com^ @@ -529056,6 +529129,7 @@ ||thefragrancefreeshop.com^ ||thefranssons.com^ ||thefreelancerschool.com^ +||thefrees.com^ ||thefreewaterfoundation.org.za^ ||thefront.in^ ||thefuel.be^ @@ -529640,6 +529714,7 @@ ||theviestdyjupcafgmcn.dns.army^ ||theviestdyjupcafgsvb.dns.army^ ||theviestdyjupcazfest.dns.navy^ +||theviewsdyjupcazfeqv.dns.army^ ||theviewsdyjupcazwsgv.dns.army^ ||thevilla46.com^ ||thevine-organizasyon.com^ @@ -530143,6 +530218,7 @@ ||timelyrain.top^ ||timenard.top^ ||timenotbesea.xyz^ +||timenow.pw^ ||timenowis1.top^ ||timeoffer.site^ ||timeofvape.tk^ @@ -531908,7 +531984,6 @@ ||trustinspect.com^ ||trustlancers.com^ ||trustorbit.com^ -||trustpilot-scam.com^ ||trustpropertyholdings.com^ ||trustrambusinesssolutions.com^ ||trustrobins.info^ @@ -531955,6 +532030,7 @@ ||ts.7rb.xyz^ ||ts0ev73.com^ ||tsal.com^ +||tsapparel.com.my^ ||tsareva-garden.ru^ ||tsatsi.co.za^ ||tsauctions.com^ @@ -532516,7 +532592,6 @@ ||u0707115.cp.regruhosting.ru^ ||u0746219.cp.regruhosting.ru^ ||u0774849.cp.regruhosting.ru^ -||u1.huatu.com^ ||u1.innerpeer.com^ ||u11123p7833.web0104.zxcs.nl^ ||u1141p8807.web0103.zxcs.nl^ @@ -533259,6 +533334,7 @@ ||unitedwsdy5defenceforgorvermentsocialeme.duckdns.org^ ||unitedwsdykesokowsbv.dns.army^ ||unitedwsdykesokowsgs.dns.army^ +||unitedwsdykesokowskg.dns.army^ ||unitedwsdykesokowsku.dns.army^ ||unitedwsdykesokowsri.dns.navy^ ||unitedyfl.com^ @@ -533659,7 +533735,6 @@ ||url675.textilmallorca.com^ ||url9823.ville.labrecque.qc.ca^ ||urlac.de^ -||urldefense.us^ ||urleddrug.at^ ||urlfrance.fr^ ||urlm.ir^ @@ -533786,7 +533861,6 @@ ||uspslabel.itemdb.com^ ||uss.ac.th^ ||uss21.com^ -||ussbd.net^ ||usselfstoragenetwork.com^ ||ussrback.com^ ||ussrgun.000webhostapp.com^ @@ -533901,6 +533975,7 @@ ||uyaiblog.com^ ||uycqawua.applekid.cn^ ||uydu.antalyaelektrikariza.net^ +||uyen.vn^ ||uyencometics.bmt.city^ ||uyencuentra.com^ ||uyf.com.ua^ @@ -538373,7 +538448,6 @@ ||wotehb.com^ ||wotsuper.pw^ ||wotsuper3.exe^ -||wouatiareves.ru^ ||wourionlion.ru^ ||woutaalexp.com^ ||wouterwolf.com^ @@ -538594,6 +538668,7 @@ ||wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org^ ||wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org^ ||wsdyalgreenkeghewsmq.dns.army^ +||wsdyalgreenkelveskxz.dns.army^ ||wsdyalhjchfonlinedws.dns.navy^ ||wsdyalhjchfonlinwsdf.dns.army^ ||wsdyalhjchfonlinwsed.dns.army^ @@ -538617,10 +538692,12 @@ ||wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org^ ||wsdyibgreenkegheedws.dns.navy^ ||wsdyibgreenkeghewsyt.dns.army^ +||wsdyibgreenventureqx.dns.army^ ||wsdykalamikonlinedeliverystoreservwspmq.ydns.eu^ ||wsdykung38communicationtarisupliermgapc.duckdns.org^ ||wsdykungsb2gotchtsub.dns.army^ ||wsdykungsb2gotchtwsp.dns.army^ +||wsdykungsb2talenwsjf.dns.army^ ||wsdykungsb2talenwsmz.dns.army^ ||wsdymsloginvestmwsqd.dns.army^ ||wsdymsloginvestmwsrw.dns.army^ @@ -538633,9 +538710,11 @@ ||wsdynitengymndynatin.dns.army^ ||wsdypmrimelimtdvenws.dns.army^ ||wsdypmrimelimtdvewsd.dns.army^ +||wsdyrkkrgorgiousejhd.dns.army^ ||wsdyrkkrsuccessmorev.dns.army^ ||wsdyrkkrsuccessmoven.dns.army^ ||wsdyrmtcntlfarmtwsvb.dns.army^ +||wsdysara1investvwsfs.dns.army^ ||wsdyshgshg2induswsjg.dns.army^ ||wsdyshgshgnationalindustrialandgoogledns.duckdns.org^ ||wsdyshgshgnationalobjindustrialat23fty.duckdns.org^ @@ -539682,7 +539761,6 @@ ||xnk.jbzie.com^ ||xnkwintech.com^ ||xnxxchannel.com^ -||xnxxfullhd.com^ ||xo4z0sl.com^ ||xo57.com^ ||xoangyduong.com.vn^ @@ -540231,7 +540309,6 @@ ||yeu81.com^ ||yeu82.com^ ||yeuhang.tk^ -||yeumoitruong.vn^ ||yeuromndy.cf^ ||yeutocviet.com^ ||yewonder.com^ diff --git a/urlhaus-filter-bind-online.conf b/urlhaus-filter-bind-online.conf index d187f235..eaa4322d 100644 --- a/urlhaus-filter-bind-online.conf +++ b/urlhaus-filter-bind-online.conf @@ -1,5 +1,5 @@ # Title: Online Malicious Domains BIND Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -10,12 +10,11 @@ zone "1008691.com" { type master; notify no; file "null.zone.file"; }; zone "14karatvisions.com" { type master; notify no; file "null.zone.file"; }; zone "1am.co.nz" { type master; notify no; file "null.zone.file"; }; zone "21robo.com" { type master; notify no; file "null.zone.file"; }; -zone "32792.prolocksmithwinterpark.com" { type master; notify no; file "null.zone.file"; }; zone "360.lcy2zzx.pw" { type master; notify no; file "null.zone.file"; }; zone "360down7.miiyun.cn" { type master; notify no; file "null.zone.file"; }; +zone "4et3ja.am.files.1drv.com" { type master; notify no; file "null.zone.file"; }; zone "77st.net" { type master; notify no; file "null.zone.file"; }; zone "8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com" { type master; notify no; file "null.zone.file"; }; -zone "87du.vip" { type master; notify no; file "null.zone.file"; }; zone "8poieq.bn.files.1drv.com" { type master; notify no; file "null.zone.file"; }; zone "aatreefelling.co.za" { type master; notify no; file "null.zone.file"; }; zone "abcd.bg" { type master; notify no; file "null.zone.file"; }; @@ -29,7 +28,6 @@ zone "accesslinksgroup.com" { type master; notify no; file "null.zone.file"; }; zone "aceeprc.com.aceeprc.com" { type master; notify no; file "null.zone.file"; }; zone "acellr.co.uk" { type master; notify no; file "null.zone.file"; }; zone "acteon.com.ar" { type master; notify no; file "null.zone.file"; }; -zone "activecost.com.au" { type master; notify no; file "null.zone.file"; }; zone "addahealingmusic.com" { type master; notify no; file "null.zone.file"; }; zone "adithimedia.com" { type master; notify no; file "null.zone.file"; }; zone "adithimedia.memengers.com" { type master; notify no; file "null.zone.file"; }; @@ -89,11 +87,14 @@ zone "aps-sv.com" { type master; notify no; file "null.zone.file"; }; zone "artedibujoyarquitectura.com" { type master; notify no; file "null.zone.file"; }; zone "arwenyapi.com" { type master; notify no; file "null.zone.file"; }; zone "ask-regard.call-save.biz" { type master; notify no; file "null.zone.file"; }; +zone "asucssa.live" { type master; notify no; file "null.zone.file"; }; zone "atfile.com" { type master; notify no; file "null.zone.file"; }; zone "athenacapsg.com" { type master; notify no; file "null.zone.file"; }; +zone "atlasconcreteworks.com" { type master; notify no; file "null.zone.file"; }; zone "attach.66rpg.com" { type master; notify no; file "null.zone.file"; }; zone "atteuqpotentialunlimited.com" { type master; notify no; file "null.zone.file"; }; zone "augustair.com" { type master; notify no; file "null.zone.file"; }; +zone "aulist.com" { type master; notify no; file "null.zone.file"; }; zone "automaticrefreshments.com" { type master; notify no; file "null.zone.file"; }; zone "avadhanagames.com" { type master; notify no; file "null.zone.file"; }; zone "ayahuascasp.com.br" { type master; notify no; file "null.zone.file"; }; @@ -109,6 +110,7 @@ zone "bangladeshunbound.com" { type master; notify no; file "null.zone.file"; }; zone "bary.sz4h.com" { type master; notify no; file "null.zone.file"; }; zone "bash.givemexyz.in" { type master; notify no; file "null.zone.file"; }; zone "bausch.kr-atlas.monaxikoslykos@zytrox.tk" { type master; notify no; file "null.zone.file"; }; +zone "bavhome.com" { type master; notify no; file "null.zone.file"; }; zone "bbia.co.uk" { type master; notify no; file "null.zone.file"; }; zone "bcmt.elin.co.za" { type master; notify no; file "null.zone.file"; }; zone "bcrg.co.za" { type master; notify no; file "null.zone.file"; }; @@ -160,7 +162,6 @@ zone "browardinsurancemiami.solucioneslink.com" { type master; notify no; file " zone "bt2.elin.co.za" { type master; notify no; file "null.zone.file"; }; zone "btdapi.robotake.com" { type master; notify no; file "null.zone.file"; }; zone "buigiaphat.com.vn" { type master; notify no; file "null.zone.file"; }; -zone "bulkyfoodja.com" { type master; notify no; file "null.zone.file"; }; zone "bullseyemedia.in" { type master; notify no; file "null.zone.file"; }; zone "busandvanrentalmalaysia.com" { type master; notify no; file "null.zone.file"; }; zone "buscascolegios.diit.cl" { type master; notify no; file "null.zone.file"; }; @@ -174,11 +175,8 @@ zone "cacaoprojects.com" { type master; notify no; file "null.zone.file"; }; zone "calgaryautorepairservice.com" { type master; notify no; file "null.zone.file"; }; zone "callbury.in" { type master; notify no; file "null.zone.file"; }; zone "camminachetipassa.it" { type master; notify no; file "null.zone.file"; }; -zone "canadianwork.cc" { type master; notify no; file "null.zone.file"; }; zone "capitalgroup-kw.com" { type master; notify no; file "null.zone.file"; }; zone "capoeiraventrelivre.com" { type master; notify no; file "null.zone.file"; }; -zone "carlsbadre.com" { type master; notify no; file "null.zone.file"; }; -zone "carsidecor.com" { type master; notify no; file "null.zone.file"; }; zone "cashyinvestment.org" { type master; notify no; file "null.zone.file"; }; zone "catchperch.com" { type master; notify no; file "null.zone.file"; }; zone "catchpoolshetlands.co.uk" { type master; notify no; file "null.zone.file"; }; @@ -215,7 +213,6 @@ zone "colinde.pricesne.com" { type master; notify no; file "null.zone.file"; }; zone "colorpak.pl" { type master; notify no; file "null.zone.file"; }; zone "columbia.aula-web.net" { type master; notify no; file "null.zone.file"; }; zone "community.reimclub.com" { type master; notify no; file "null.zone.file"; }; -zone "comosairdoburaco.com.br" { type master; notify no; file "null.zone.file"; }; zone "competancy.indigoconsult.net" { type master; notify no; file "null.zone.file"; }; zone "conceptimagine.ro" { type master; notify no; file "null.zone.file"; }; zone "config.cqhbkjzx.com" { type master; notify no; file "null.zone.file"; }; @@ -224,12 +221,14 @@ zone "constructoralyon.com" { type master; notify no; file "null.zone.file"; }; zone "consulateins.solucioneslink.com" { type master; notify no; file "null.zone.file"; }; zone "contributeindustry.com" { type master; notify no; file "null.zone.file"; }; zone "copelandscapes.com" { type master; notify no; file "null.zone.file"; }; +zone "corwin-tommie06f.ru.com" { type master; notify no; file "null.zone.file"; }; zone "coulsongraphics.com" { type master; notify no; file "null.zone.file"; }; zone "count.mail.163.com.impactmedfoundation.com" { type master; notify no; file "null.zone.file"; }; zone "covid19.cyberschool.or.id" { type master; notify no; file "null.zone.file"; }; zone "cpanel.shivay.net" { type master; notify no; file "null.zone.file"; }; zone "cr-sq.com" { type master; notify no; file "null.zone.file"; }; zone "craftech.nxtnet.ga" { type master; notify no; file "null.zone.file"; }; +zone "crearechile.cl" { type master; notify no; file "null.zone.file"; }; zone "creationskateboards.com" { type master; notify no; file "null.zone.file"; }; zone "crecerco.com" { type master; notify no; file "null.zone.file"; }; zone "crittersbythebay.com" { type master; notify no; file "null.zone.file"; }; @@ -239,6 +238,7 @@ zone "crmroche.manivelasst.com" { type master; notify no; file "null.zone.file"; zone "crscorretordeimoveis.com.br" { type master; notify no; file "null.zone.file"; }; zone "cse-engineer.com" { type master; notify no; file "null.zone.file"; }; zone "csnserver.com" { type master; notify no; file "null.zone.file"; }; +zone "ctracknxt.in" { type master; notify no; file "null.zone.file"; }; zone "cubescargoexpress.com" { type master; notify no; file "null.zone.file"; }; zone "curasoles.co.za" { type master; notify no; file "null.zone.file"; }; zone "currantmedia.com" { type master; notify no; file "null.zone.file"; }; @@ -257,7 +257,6 @@ zone "datapolish.com" { type master; notify no; file "null.zone.file"; }; zone "dating.khokhas.co.za" { type master; notify no; file "null.zone.file"; }; zone "datsom.vn" { type master; notify no; file "null.zone.file"; }; zone "davethompson.me.uk" { type master; notify no; file "null.zone.file"; }; -zone "davidmcguinness.info" { type master; notify no; file "null.zone.file"; }; zone "dayspringdaisies.com" { type master; notify no; file "null.zone.file"; }; zone "dd.qiyuea.cn" { type master; notify no; file "null.zone.file"; }; zone "ddns.cyberium.cc" { type master; notify no; file "null.zone.file"; }; @@ -291,14 +290,11 @@ zone "dl.198424.com" { type master; notify no; file "null.zone.file"; }; zone "dl.installcdn-aws.com" { type master; notify no; file "null.zone.file"; }; zone "dl.packetstormsecurity.net" { type master; notify no; file "null.zone.file"; }; zone "dl.rina-roleplay.com" { type master; notify no; file "null.zone.file"; }; -zone "dnn.alibuf.com" { type master; notify no; file "null.zone.file"; }; -zone "dns.alibuf.com" { type master; notify no; file "null.zone.file"; }; zone "dockerupdate.anondns.net" { type master; notify no; file "null.zone.file"; }; zone "docman.orientalservices.in" { type master; notify no; file "null.zone.file"; }; zone "dodsonimaging.com" { type master; notify no; file "null.zone.file"; }; zone "doitunlimited.com" { type master; notify no; file "null.zone.file"; }; zone "dokan.blueberrytec.com" { type master; notify no; file "null.zone.file"; }; -zone "dom-chel74.ru" { type master; notify no; file "null.zone.file"; }; zone "dom.daf.free.fr" { type master; notify no; file "null.zone.file"; }; zone "doncedyhall.com" { type master; notify no; file "null.zone.file"; }; zone "donghobinhminh.com" { type master; notify no; file "null.zone.file"; }; @@ -308,6 +304,7 @@ zone "dosame.com" { type master; notify no; file "null.zone.file"; }; zone "dosman.pl" { type master; notify no; file "null.zone.file"; }; zone "dovberger.com" { type master; notify no; file "null.zone.file"; }; zone "down.pcclear.com" { type master; notify no; file "null.zone.file"; }; +zone "down.udashi.com" { type master; notify no; file "null.zone.file"; }; zone "down.webbora.com" { type master; notify no; file "null.zone.file"; }; zone "down1.arpun.com" { type master; notify no; file "null.zone.file"; }; zone "download.caihong.com" { type master; notify no; file "null.zone.file"; }; @@ -338,6 +335,7 @@ zone "e.sldov.ru" { type master; notify no; file "null.zone.file"; }; zone "eandgdesign.com.ng" { type master; notify no; file "null.zone.file"; }; zone "eastsheen-glaziers.co.uk" { type master; notify no; file "null.zone.file"; }; zone "ebruyatkin.com" { type master; notify no; file "null.zone.file"; }; +zone "edu.saicraftsman.com" { type master; notify no; file "null.zone.file"; }; zone "eedo.ee" { type master; notify no; file "null.zone.file"; }; zone "efficientegroup.com" { type master; notify no; file "null.zone.file"; }; zone "elbauldenora.com" { type master; notify no; file "null.zone.file"; }; @@ -352,8 +350,8 @@ zone "erp.nanotechproautocare.com" { type master; notify no; file "null.zone.fil zone "erp.zilymax.com" { type master; notify no; file "null.zone.file"; }; zone "escola.probommar.org.br" { type master; notify no; file "null.zone.file"; }; zone "esnconsultants.com" { type master; notify no; file "null.zone.file"; }; -zone "esrhf04.top" { type master; notify no; file "null.zone.file"; }; zone "essentia.org.br" { type master; notify no; file "null.zone.file"; }; +zone "estjh05.top" { type master; notify no; file "null.zone.file"; }; zone "ethereality.info" { type master; notify no; file "null.zone.file"; }; zone "eubanks7.com" { type master; notify no; file "null.zone.file"; }; zone "europeanzonexxi.com" { type master; notify no; file "null.zone.file"; }; @@ -422,9 +420,11 @@ zone "goldcoastoffice365.com" { type master; notify no; file "null.zone.file"; } zone "goldcoastoffice365.com.au" { type master; notify no; file "null.zone.file"; }; zone "golden-memories-funerals.yourpageserver.com" { type master; notify no; file "null.zone.file"; }; zone "goldenasiacapital.com" { type master; notify no; file "null.zone.file"; }; +zone "goldmen.in" { type master; notify no; file "null.zone.file"; }; zone "gpotecnosystems.com" { type master; notify no; file "null.zone.file"; }; zone "gracejukes.com" { type master; notify no; file "null.zone.file"; }; zone "grupoinmare.com" { type master; notify no; file "null.zone.file"; }; +zone "gruposelt.000webhostapp.com" { type master; notify no; file "null.zone.file"; }; zone "gs.monerorx.com" { type master; notify no; file "null.zone.file"; }; zone "guide-to-cell-phones.com" { type master; notify no; file "null.zone.file"; }; zone "gulfac-house.com" { type master; notify no; file "null.zone.file"; }; @@ -452,6 +452,7 @@ zone "hitstation.nl" { type master; notify no; file "null.zone.file"; }; zone "hmpmall.co.kr" { type master; notify no; file "null.zone.file"; }; zone "hoagietesting10.com" { type master; notify no; file "null.zone.file"; }; zone "hoayeuthuong-my.sharepoint.com" { type master; notify no; file "null.zone.file"; }; +zone "holmesservices.mobiledevsite.co" { type master; notify no; file "null.zone.file"; }; zone "homefindersolutions.com" { type master; notify no; file "null.zone.file"; }; zone "hongluosi.com" { type master; notify no; file "null.zone.file"; }; zone "hookedupboatclub.com" { type master; notify no; file "null.zone.file"; }; @@ -464,6 +465,7 @@ zone "hsmwebapp.com" { type master; notify no; file "null.zone.file"; }; zone "htownbars.com" { type master; notify no; file "null.zone.file"; }; zone "hubtech.co.za" { type master; notify no; file "null.zone.file"; }; zone "huellacero.cl" { type master; notify no; file "null.zone.file"; }; +zone "hunchomusichub.com" { type master; notify no; file "null.zone.file"; }; zone "hunggiang.vn" { type master; notify no; file "null.zone.file"; }; zone "husamiyahschool.com" { type master; notify no; file "null.zone.file"; }; zone "iabmixx2020.rayadigital.online" { type master; notify no; file "null.zone.file"; }; @@ -515,7 +517,6 @@ zone "jathra.co.uk" { type master; notify no; file "null.zone.file"; }; zone "jay.diamondrelationscrm.us" { type master; notify no; file "null.zone.file"; }; zone "jebs.net.au" { type master; notify no; file "null.zone.file"; }; zone "jeffdahlke.com" { type master; notify no; file "null.zone.file"; }; -zone "jhayesconsulting.com" { type master; notify no; file "null.zone.file"; }; zone "jiaoyuzixun.cn" { type master; notify no; file "null.zone.file"; }; zone "jing-da.com.tw" { type master; notify no; file "null.zone.file"; }; zone "jmtc.91756.cn" { type master; notify no; file "null.zone.file"; }; @@ -529,7 +530,6 @@ zone "jumpmanualjacobhiller.com" { type master; notify no; file "null.zone.file" zone "jupiter.toxsl.in" { type master; notify no; file "null.zone.file"; }; zone "justinscott.com.au" { type master; notify no; file "null.zone.file"; }; zone "kadigital.co.uk" { type master; notify no; file "null.zone.file"; }; -zone "kaizenjanitorial.com" { type master; notify no; file "null.zone.file"; }; zone "kalawatihomes.com" { type master; notify no; file "null.zone.file"; }; zone "kalogirosfinance.com" { type master; notify no; file "null.zone.file"; }; zone "kaptaanchapal.com" { type master; notify no; file "null.zone.file"; }; @@ -540,17 +540,15 @@ zone "kensingtondriving.com" { type master; notify no; file "null.zone.file"; }; zone "ketofitnessexpert.com" { type master; notify no; file "null.zone.file"; }; zone "kevinjewelry.com.co" { type master; notify no; file "null.zone.file"; }; zone "keywatch.yourpageserver.com" { type master; notify no; file "null.zone.file"; }; -zone "khmerosja.net" { type master; notify no; file "null.zone.file"; }; zone "kingssa.co.za" { type master; notify no; file "null.zone.file"; }; zone "kizitox.ga" { type master; notify no; file "null.zone.file"; }; zone "kjcpromo.com" { type master; notify no; file "null.zone.file"; }; -zone "kldatabase.com" { type master; notify no; file "null.zone.file"; }; zone "kleinendeli.co.za" { type master; notify no; file "null.zone.file"; }; zone "korrectconceptservices.com" { type master; notify no; file "null.zone.file"; }; zone "krisbadminton.com" { type master; notify no; file "null.zone.file"; }; zone "ktb.sch.id" { type master; notify no; file "null.zone.file"; }; zone "kubatoglubaklava.com.tr" { type master; notify no; file "null.zone.file"; }; -zone "kullumanalitours.com" { type master; notify no; file "null.zone.file"; }; +zone "kumaralok.in" { type master; notify no; file "null.zone.file"; }; zone "kwanfromhongkong.com" { type master; notify no; file "null.zone.file"; }; zone "kz.sldov.ru" { type master; notify no; file "null.zone.file"; }; zone "lacasadelosalebrijes.com" { type master; notify no; file "null.zone.file"; }; @@ -559,7 +557,6 @@ zone "lameguard.ru" { type master; notify no; file "null.zone.file"; }; zone "laodongnhat.vn" { type master; notify no; file "null.zone.file"; }; zone "laravel.pointersoftwares.com.br" { type master; notify no; file "null.zone.file"; }; zone "lasermobilesounds.co.uk" { type master; notify no; file "null.zone.file"; }; -zone "laura9630fr.com" { type master; notify no; file "null.zone.file"; }; zone "lauratomismith.com" { type master; notify no; file "null.zone.file"; }; zone "lautarosanmiguel.com" { type master; notify no; file "null.zone.file"; }; zone "lawforall.edu.lk" { type master; notify no; file "null.zone.file"; }; @@ -661,14 +658,12 @@ zone "mis.nbcc.ac.th" { type master; notify no; file "null.zone.file"; }; zone "misterson.com" { type master; notify no; file "null.zone.file"; }; zone "mkontakt.az" { type master; notify no; file "null.zone.file"; }; zone "mktf.mx" { type master; notify no; file "null.zone.file"; }; -zone "mmdx.com" { type master; notify no; file "null.zone.file"; }; zone "mmogollon.com.mx" { type master; notify no; file "null.zone.file"; }; zone "mncarteam.com" { type master; notify no; file "null.zone.file"; }; zone "modelhouseturkey.com" { type master; notify no; file "null.zone.file"; }; zone "modernmanna.org" { type master; notify no; file "null.zone.file"; }; zone "monetization.business" { type master; notify no; file "null.zone.file"; }; zone "moninediy.com" { type master; notify no; file "null.zone.file"; }; -zone "mopai.sg" { type master; notify no; file "null.zone.file"; }; zone "motorcomunicacion.com" { type master; notify no; file "null.zone.file"; }; zone "moumitas.com" { type master; notify no; file "null.zone.file"; }; zone "msacontabil.com.br" { type master; notify no; file "null.zone.file"; }; @@ -687,7 +682,7 @@ zone "namnyak.co.ke" { type master; notify no; file "null.zone.file"; }; zone "nap.mgsservers.com" { type master; notify no; file "null.zone.file"; }; zone "navayurveda.in" { type master; notify no; file "null.zone.file"; }; zone "nec-i.com" { type master; notify no; file "null.zone.file"; }; -zone "nellaimasthanbiryani.com" { type master; notify no; file "null.zone.file"; }; +zone "nelitrianggraeni.000webhostapp.com" { type master; notify no; file "null.zone.file"; }; zone "nerve.untergrund.net" { type master; notify no; file "null.zone.file"; }; zone "nettube.com.br" { type master; notify no; file "null.zone.file"; }; zone "networkwheels.co.za" { type master; notify no; file "null.zone.file"; }; @@ -706,6 +701,7 @@ zone "nilehouse.co.ug" { type master; notify no; file "null.zone.file"; }; zone "nilinkeji.com" { type master; notify no; file "null.zone.file"; }; zone "nimboohomes.com" { type master; notify no; file "null.zone.file"; }; zone "njtiledesigncenter.com" { type master; notify no; file "null.zone.file"; }; +zone "nmxwllwsdyminoragenw.dns.army" { type master; notify no; file "null.zone.file"; }; zone "nobius.org" { type master; notify no; file "null.zone.file"; }; zone "nocalnoodle.elin.co.za" { type master; notify no; file "null.zone.file"; }; zone "nomadicbees.com" { type master; notify no; file "null.zone.file"; }; @@ -719,6 +715,7 @@ zone "nyasabigbullets.com" { type master; notify no; file "null.zone.file"; }; zone "nyeh2o.com.au" { type master; notify no; file "null.zone.file"; }; zone "obseques-conseils.com" { type master; notify no; file "null.zone.file"; }; zone "oecteam.com" { type master; notify no; file "null.zone.file"; }; +zone "ohe.ie" { type master; notify no; file "null.zone.file"; }; zone "ohsewgorgeous.co.uk" { type master; notify no; file "null.zone.file"; }; zone "oknoplastik.sk" { type master; notify no; file "null.zone.file"; }; zone "oleholeh.memangbeda.website" { type master; notify no; file "null.zone.file"; }; @@ -751,6 +748,7 @@ zone "pacwebdesigns.com" { type master; notify no; file "null.zone.file"; }; zone "pagos.krayem.com.mx" { type master; notify no; file "null.zone.file"; }; zone "palbas.cl" { type master; notify no; file "null.zone.file"; }; zone "palochusvet.szm.com" { type master; notify no; file "null.zone.file"; }; +zone "panslimiterd.com" { type master; notify no; file "null.zone.file"; }; zone "parallel.rockvideos.at" { type master; notify no; file "null.zone.file"; }; zone "parejasfelices.mi-fs.com" { type master; notify no; file "null.zone.file"; }; zone "parkhussion.com" { type master; notify no; file "null.zone.file"; }; @@ -781,6 +779,7 @@ zone "pink99.com" { type master; notify no; file "null.zone.file"; }; zone "plasfan.ind.br" { type master; notify no; file "null.zone.file"; }; zone "playground2.grupoaliadasca.com" { type master; notify no; file "null.zone.file"; }; zone "pmglance.startwriteup.com" { type master; notify no; file "null.zone.file"; }; +zone "pmrimewsdylimtewsogh.dns.army" { type master; notify no; file "null.zone.file"; }; zone "pokojewewladyslawowie.pl" { type master; notify no; file "null.zone.file"; }; zone "pole.com.vc" { type master; notify no; file "null.zone.file"; }; zone "pool.phxdir.com" { type master; notify no; file "null.zone.file"; }; @@ -794,7 +793,6 @@ zone "preview2.behalen.com" { type master; notify no; file "null.zone.file"; }; zone "prishaartcreations.com" { type master; notify no; file "null.zone.file"; }; zone "production.sparshims.com" { type master; notify no; file "null.zone.file"; }; zone "programaoperadoronline.com.br" { type master; notify no; file "null.zone.file"; }; -zone "project.exquitec.com" { type master; notify no; file "null.zone.file"; }; zone "promotoradescomplica.com.br" { type master; notify no; file "null.zone.file"; }; zone "promoversdubai.com" { type master; notify no; file "null.zone.file"; }; zone "propertiq.elin.co.za" { type master; notify no; file "null.zone.file"; }; @@ -804,7 +802,6 @@ zone "prosupport.cl" { type master; notify no; file "null.zone.file"; }; zone "prosyarmakassar.com" { type master; notify no; file "null.zone.file"; }; zone "provence.elin.co.za" { type master; notify no; file "null.zone.file"; }; zone "prox.realunix.cc" { type master; notify no; file "null.zone.file"; }; -zone "prueba.danielluza.com" { type master; notify no; file "null.zone.file"; }; zone "pujashoppe.in" { type master; notify no; file "null.zone.file"; }; zone "punchdialogues.com" { type master; notify no; file "null.zone.file"; }; zone "punjabdevelopersassociation.com.pk" { type master; notify no; file "null.zone.file"; }; @@ -819,7 +816,6 @@ zone "radioafifense.deploys.live" { type master; notify no; file "null.zone.file zone "rainbowisp.info" { type master; notify no; file "null.zone.file"; }; zone "rajeshtailang.com" { type master; notify no; file "null.zone.file"; }; zone "rakeshkhatri.in" { type master; notify no; file "null.zone.file"; }; -zone "raodigitalmedia.com" { type master; notify no; file "null.zone.file"; }; zone "raquelhelena.com.br" { type master; notify no; file "null.zone.file"; }; zone "rarlabarchiver.ac" { type master; notify no; file "null.zone.file"; }; zone "rasadbar.ir" { type master; notify no; file "null.zone.file"; }; @@ -833,7 +829,6 @@ zone "readwrite26.nl" { type master; notify no; file "null.zone.file"; }; zone "readymmade.com" { type master; notify no; file "null.zone.file"; }; zone "recyclethesurplus.com" { type master; notify no; file "null.zone.file"; }; zone "redbats.co.in" { type master; notify no; file "null.zone.file"; }; -zone "redboxmultimedia.com" { type master; notify no; file "null.zone.file"; }; zone "redchillicrackers.com" { type master; notify no; file "null.zone.file"; }; zone "reifenquick.de" { type master; notify no; file "null.zone.file"; }; zone "relaxindulge.co.nz" { type master; notify no; file "null.zone.file"; }; @@ -916,7 +911,6 @@ zone "shopsofe.com" { type master; notify no; file "null.zone.file"; }; zone "sibernetix.fr" { type master; notify no; file "null.zone.file"; }; zone "sigapresschennai.com" { type master; notify no; file "null.zone.file"; }; zone "sige.brisainformatica.com.br" { type master; notify no; file "null.zone.file"; }; -zone "signatureads.co.in" { type master; notify no; file "null.zone.file"; }; zone "siili.net" { type master; notify no; file "null.zone.file"; }; zone "simoneporzi.it" { type master; notify no; file "null.zone.file"; }; zone "simorsint.com" { type master; notify no; file "null.zone.file"; }; @@ -952,7 +946,6 @@ zone "spent.com.pl" { type master; notify no; file "null.zone.file"; }; zone "spetsesyachtcharter.gr" { type master; notify no; file "null.zone.file"; }; zone "spititourism.com" { type master; notify no; file "null.zone.file"; }; zone "spittinfire.com" { type master; notify no; file "null.zone.file"; }; -zone "springbedspetroleum.com" { type master; notify no; file "null.zone.file"; }; zone "src1.minibai.com" { type master; notify no; file "null.zone.file"; }; zone "sreenivasapaintingworks.com" { type master; notify no; file "null.zone.file"; }; zone "sriglobalit.com" { type master; notify no; file "null.zone.file"; }; @@ -994,12 +987,12 @@ zone "tafsantoursandtravels.com" { type master; notify no; file "null.zone.file" zone "tajushariya.com" { type master; notify no; file "null.zone.file"; }; zone "tallyinvoicecustomization.com" { type master; notify no; file "null.zone.file"; }; zone "taltus.co.uk" { type master; notify no; file "null.zone.file"; }; -zone "tapalkoedacoffee.com" { type master; notify no; file "null.zone.file"; }; zone "tarravalleyfoods.com.au" { type master; notify no; file "null.zone.file"; }; zone "tavo.cl" { type master; notify no; file "null.zone.file"; }; zone "tc.snpsresidential.com" { type master; notify no; file "null.zone.file"; }; zone "tcy.198424.com" { type master; notify no; file "null.zone.file"; }; zone "tdsp.yngw518.com" { type master; notify no; file "null.zone.file"; }; +zone "tech332.synology.me" { type master; notify no; file "null.zone.file"; }; zone "techgms.com" { type master; notify no; file "null.zone.file"; }; zone "teduae.com" { type master; notify no; file "null.zone.file"; }; zone "teleargentina.com" { type master; notify no; file "null.zone.file"; }; @@ -1038,6 +1031,7 @@ zone "themansionkasauli.com" { type master; notify no; file "null.zone.file"; }; zone "theprofinn.com" { type master; notify no; file "null.zone.file"; }; zone "thesummitpc.net" { type master; notify no; file "null.zone.file"; }; zone "theurbantutors.com" { type master; notify no; file "null.zone.file"; }; +zone "theviewsdyjupcazfeqv.dns.army" { type master; notify no; file "null.zone.file"; }; zone "thosewebbs.com" { type master; notify no; file "null.zone.file"; }; zone "thriveink.com" { type master; notify no; file "null.zone.file"; }; zone "tianangdep.com" { type master; notify no; file "null.zone.file"; }; @@ -1055,6 +1049,7 @@ zone "topcell9.com" { type master; notify no; file "null.zone.file"; }; zone "toplevel.com.br" { type master; notify no; file "null.zone.file"; }; zone "topmask.co.za" { type master; notify no; file "null.zone.file"; }; zone "torresquinterocorp.com" { type master; notify no; file "null.zone.file"; }; +zone "towme.services" { type master; notify no; file "null.zone.file"; }; zone "toyotacollege.ac.th" { type master; notify no; file "null.zone.file"; }; zone "tpke.hu" { type master; notify no; file "null.zone.file"; }; zone "translaterjemah.com" { type master; notify no; file "null.zone.file"; }; @@ -1078,8 +1073,7 @@ zone "ultimate-24.de" { type master; notify no; file "null.zone.file"; }; zone "umwelt-kirchhof.de" { type master; notify no; file "null.zone.file"; }; zone "unicorpbrunei.com" { type master; notify no; file "null.zone.file"; }; zone "uniengrisb.com" { type master; notify no; file "null.zone.file"; }; -zone "unisoftcc.com" { type master; notify no; file "null.zone.file"; }; -zone "unityindiversity.in" { type master; notify no; file "null.zone.file"; }; +zone "unitedwsdykesokowskg.dns.army" { type master; notify no; file "null.zone.file"; }; zone "unyazitelecom.com" { type master; notify no; file "null.zone.file"; }; zone "upcbpta.com" { type master; notify no; file "null.zone.file"; }; zone "urbantrapfest.cl" { type master; notify no; file "null.zone.file"; }; @@ -1087,6 +1081,7 @@ zone "used-jeans.fr" { type master; notify no; file "null.zone.file"; }; zone "useformoney.000webhostapp.com" { type master; notify no; file "null.zone.file"; }; zone "uss.ac.th" { type master; notify no; file "null.zone.file"; }; zone "uzzepay.com.br" { type master; notify no; file "null.zone.file"; }; +zone "v2consultores.com" { type master; notify no; file "null.zone.file"; }; zone "vanzare.cabanabrazi2.ro" { type master; notify no; file "null.zone.file"; }; zone "vbcargo.hu" { type master; notify no; file "null.zone.file"; }; zone "vcah.co.uk" { type master; notify no; file "null.zone.file"; }; @@ -1146,11 +1141,14 @@ zone "wolfgang-brodte.de" { type master; notify no; file "null.zone.file"; }; zone "woodsytech.com" { type master; notify no; file "null.zone.file"; }; zone "wordpress.saleensuporte.com.br" { type master; notify no; file "null.zone.file"; }; zone "workingsolutionsrome.org" { type master; notify no; file "null.zone.file"; }; -zone "wozata.000webhostapp.com" { type master; notify no; file "null.zone.file"; }; zone "wp.readhere.in" { type master; notify no; file "null.zone.file"; }; zone "wpdemo.101clients.com.au" { type master; notify no; file "null.zone.file"; }; zone "writtendeer.com" { type master; notify no; file "null.zone.file"; }; zone "ws5588.f3322.net" { type master; notify no; file "null.zone.file"; }; +zone "wsdyalgreenkelveskxz.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "wsdykungsb2talenwsjf.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "wsdyrkkrgorgiousejhd.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "wsdysara1investvwsfs.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdysuresbonescagegp.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wyklej.pl" { type master; notify no; file "null.zone.file"; }; zone "x2vn.com" { type master; notify no; file "null.zone.file"; }; diff --git a/urlhaus-filter-bind.conf b/urlhaus-filter-bind.conf index 9438e018..a03260e6 100644 --- a/urlhaus-filter-bind.conf +++ b/urlhaus-filter-bind.conf @@ -1,5 +1,5 @@ # Title: Malicious Domains BIND Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -238,6 +238,7 @@ zone "123mobile.store" { type master; notify no; file "null.zone.file"; }; zone "123moviesfx.com" { type master; notify no; file "null.zone.file"; }; zone "123sellfast.com" { type master; notify no; file "null.zone.file"; }; zone "123sex.co" { type master; notify no; file "null.zone.file"; }; +zone "123tadi.com" { type master; notify no; file "null.zone.file"; }; zone "123xyz.xyz" { type master; notify no; file "null.zone.file"; }; zone "124.com.ua" { type master; notify no; file "null.zone.file"; }; zone "124.cpanel.realwebsitesite.com" { type master; notify no; file "null.zone.file"; }; @@ -1190,6 +1191,7 @@ zone "4drakona.ru" { type master; notify no; file "null.zone.file"; }; zone "4ele.pl" { type master; notify no; file "null.zone.file"; }; zone "4ertybhdfrt.gq" { type master; notify no; file "null.zone.file"; }; zone "4esports.de" { type master; notify no; file "null.zone.file"; }; +zone "4et3ja.am.files.1drv.com" { type master; notify no; file "null.zone.file"; }; zone "4evakleen.com.au" { type master; notify no; file "null.zone.file"; }; zone "4eventfacilities.nl" { type master; notify no; file "null.zone.file"; }; zone "4evernails.nl" { type master; notify no; file "null.zone.file"; }; @@ -1776,6 +1778,7 @@ zone "998awol.com" { type master; notify no; file "null.zone.file"; }; zone "999.buzz" { type master; notify no; file "null.zone.file"; }; zone "999.co.id" { type master; notify no; file "null.zone.file"; }; zone "999.rajaojek.com" { type master; notify no; file "null.zone.file"; }; +zone "999080321newfolder1002002131-service1002.space" { type master; notify no; file "null.zone.file"; }; zone "999102com.cn" { type master; notify no; file "null.zone.file"; }; zone "99bkx.com" { type master; notify no; file "null.zone.file"; }; zone "99centsdigitals.com" { type master; notify no; file "null.zone.file"; }; @@ -3963,6 +3966,7 @@ zone "ahiraatfashion.com" { type master; notify no; file "null.zone.file"; }; zone "ahiskatv.net" { type master; notify no; file "null.zone.file"; }; zone "ahitekniktarti.com" { type master; notify no; file "null.zone.file"; }; zone "ahiyangrup.com.tr" { type master; notify no; file "null.zone.file"; }; +zone "ahjianlong.cf" { type master; notify no; file "null.zone.file"; }; zone "ahjuric.si" { type master; notify no; file "null.zone.file"; }; zone "ahk.smu8street.ru" { type master; notify no; file "null.zone.file"; }; zone "ahkha.com" { type master; notify no; file "null.zone.file"; }; @@ -4387,6 +4391,7 @@ zone "akito.be" { type master; notify no; file "null.zone.file"; }; zone "akivj07.top" { type master; notify no; file "null.zone.file"; }; zone "akktis.com" { type master; notify no; file "null.zone.file"; }; zone "akkurtmadencilik.com" { type master; notify no; file "null.zone.file"; }; +zone "aklatdelmundo.com" { type master; notify no; file "null.zone.file"; }; zone "akleigh.com" { type master; notify no; file "null.zone.file"; }; zone "aklin.ir" { type master; notify no; file "null.zone.file"; }; zone "aklocalshop.com" { type master; notify no; file "null.zone.file"; }; @@ -5099,7 +5104,6 @@ zone "alladinonlinee.com" { type master; notify no; file "null.zone.file"; }; zone "allainesconsultancyinc.com" { type master; notify no; file "null.zone.file"; }; zone "allamanolibrary.com" { type master; notify no; file "null.zone.file"; }; zone "allan-it.com" { type master; notify no; file "null.zone.file"; }; -zone "allanabolicsteam.net" { type master; notify no; file "null.zone.file"; }; zone "allanelect.co.uk" { type master; notify no; file "null.zone.file"; }; zone "allangillphotography.com" { type master; notify no; file "null.zone.file"; }; zone "allanhollowell.com" { type master; notify no; file "null.zone.file"; }; @@ -5373,6 +5377,7 @@ zone "alona.org.cy" { type master; notify no; file "null.zone.file"; }; zone "aloneintheweb.com" { type master; notify no; file "null.zone.file"; }; zone "aloneskisehir.com" { type master; notify no; file "null.zone.file"; }; zone "alongthelines.com" { type master; notify no; file "null.zone.file"; }; +zone "alongwalker.com" { type master; notify no; file "null.zone.file"; }; zone "alonhadat24h.vn" { type master; notify no; file "null.zone.file"; }; zone "alooshop.ir" { type master; notify no; file "null.zone.file"; }; zone "aloravan.com" { type master; notify no; file "null.zone.file"; }; @@ -6130,7 +6135,6 @@ zone "an9news.com" { type master; notify no; file "null.zone.file"; }; zone "ana.plecko.eu" { type master; notify no; file "null.zone.file"; }; zone "anaaj.pk" { type master; notify no; file "null.zone.file"; }; zone "anabim.com" { type master; notify no; file "null.zone.file"; }; -zone "anabolicsteroidsbuy.info" { type master; notify no; file "null.zone.file"; }; zone "anaceb.com" { type master; notify no; file "null.zone.file"; }; zone "anadearmas.net" { type master; notify no; file "null.zone.file"; }; zone "anadelgbt.org" { type master; notify no; file "null.zone.file"; }; @@ -10103,7 +10107,6 @@ zone "b94yhzk.com" { type master; notify no; file "null.zone.file"; }; zone "b97pm6.com" { type master; notify no; file "null.zone.file"; }; zone "ba3capital.com" { type master; notify no; file "null.zone.file"; }; zone "baacsetu.org" { type master; notify no; file "null.zone.file"; }; -zone "baadababada.ru" { type master; notify no; file "null.zone.file"; }; zone "baaders-namibia.com" { type master; notify no; file "null.zone.file"; }; zone "baakcafe.com" { type master; notify no; file "null.zone.file"; }; zone "baamiraan.ir" { type master; notify no; file "null.zone.file"; }; @@ -10225,7 +10228,6 @@ zone "backup.utlitslaekning.is" { type master; notify no; file "null.zone.file"; zone "backup.xn----8sba7bmrlhv0a.xn--p1ai" { type master; notify no; file "null.zone.file"; }; zone "backup2.robinandelaine.com" { type master; notify no; file "null.zone.file"; }; zone "backupcom.e-twow.uk" { type master; notify no; file "null.zone.file"; }; -zone "backupez.com" { type master; notify no; file "null.zone.file"; }; zone "backupfashions.com" { type master; notify no; file "null.zone.file"; }; zone "backupsitedev.flywheelsites.com" { type master; notify no; file "null.zone.file"; }; zone "backupsql.datasiswebcontable.com" { type master; notify no; file "null.zone.file"; }; @@ -11608,7 +11610,6 @@ zone "belayadver.com" { type master; notify no; file "null.zone.file"; }; zone "belaythakayni.com" { type master; notify no; file "null.zone.file"; }; zone "belboks.com" { type master; notify no; file "null.zone.file"; }; zone "belboy.in" { type master; notify no; file "null.zone.file"; }; -zone "belcineloweek.ru" { type master; notify no; file "null.zone.file"; }; zone "belconger.com" { type master; notify no; file "null.zone.file"; }; zone "belcorpisl.com" { type master; notify no; file "null.zone.file"; }; zone "belcvet.com" { type master; notify no; file "null.zone.file"; }; @@ -14167,7 +14168,6 @@ zone "bobbyterry.top" { type master; notify no; file "null.zone.file"; }; zone "bobbyworld.top" { type master; notify no; file "null.zone.file"; }; zone "bobcar.com.my" { type master; notify no; file "null.zone.file"; }; zone "bobcatofchico.com" { type master; notify no; file "null.zone.file"; }; -zone "bobcatofredding.com" { type master; notify no; file "null.zone.file"; }; zone "bobcook.ca" { type master; notify no; file "null.zone.file"; }; zone "bobdolph.com" { type master; notify no; file "null.zone.file"; }; zone "bobenstetter.net" { type master; notify no; file "null.zone.file"; }; @@ -15419,7 +15419,6 @@ zone "bucketlistrecipes.com" { type master; notify no; file "null.zone.file"; }; zone "bucketstrong.s3-us-west-1.amazonaws.com" { type master; notify no; file "null.zone.file"; }; zone "buckeyechartershiltonhead.com" { type master; notify no; file "null.zone.file"; }; zone "buckeyeoptical.com" { type master; notify no; file "null.zone.file"; }; -zone "buckeyesecurity.net" { type master; notify no; file "null.zone.file"; }; zone "buckinghamandlloyds.com" { type master; notify no; file "null.zone.file"; }; zone "buckleman.co.id" { type master; notify no; file "null.zone.file"; }; zone "bucklindata.net" { type master; notify no; file "null.zone.file"; }; @@ -15508,6 +15507,7 @@ zone "buildchem.pk" { type master; notify no; file "null.zone.file"; }; zone "buildcraftindia.com" { type master; notify no; file "null.zone.file"; }; zone "buildentconstructions.com" { type master; notify no; file "null.zone.file"; }; zone "builder.acasia.mx" { type master; notify no; file "null.zone.file"; }; +zone "builder.makemoneywith.website" { type master; notify no; file "null.zone.file"; }; zone "buildersmerchantsfederation-my.sharepoint.com" { type master; notify no; file "null.zone.file"; }; zone "buildgreenindustries.com" { type master; notify no; file "null.zone.file"; }; zone "building-company.lt" { type master; notify no; file "null.zone.file"; }; @@ -16051,7 +16051,6 @@ zone "c.mymortgagegenius.ca" { type master; notify no; file "null.zone.file"; }; zone "c.oooooooooo.ga" { type master; notify no; file "null.zone.file"; }; zone "c.pieshua.com" { type master; notify no; file "null.zone.file"; }; zone "c.teamworx.ph" { type master; notify no; file "null.zone.file"; }; -zone "c.top4top.io" { type master; notify no; file "null.zone.file"; }; zone "c.top4top.net" { type master; notify no; file "null.zone.file"; }; zone "c.vivi.casa" { type master; notify no; file "null.zone.file"; }; zone "c.vollar.ga" { type master; notify no; file "null.zone.file"; }; @@ -16723,6 +16722,7 @@ zone "capitalnewsagency.com" { type master; notify no; file "null.zone.file"; }; zone "capitalonefinanceltd.in" { type master; notify no; file "null.zone.file"; }; zone "capitalpellets.com" { type master; notify no; file "null.zone.file"; }; zone "capitalpremiumfinancinginc.com" { type master; notify no; file "null.zone.file"; }; +zone "capitalprint.co.za" { type master; notify no; file "null.zone.file"; }; zone "capitalprivateasset.com" { type master; notify no; file "null.zone.file"; }; zone "capitalrealestate.us" { type master; notify no; file "null.zone.file"; }; zone "capitalrh.com.br" { type master; notify no; file "null.zone.file"; }; @@ -21563,6 +21563,7 @@ zone "covid19.peaceforchildren.net" { type master; notify no; file "null.zone.fi zone "covid19map.digital" { type master; notify no; file "null.zone.file"; }; zone "covid19quarantin.com" { type master; notify no; file "null.zone.file"; }; zone "covid19safety.myftp.org" { type master; notify no; file "null.zone.file"; }; +zone "covid19vaccinations.hopto.org" { type master; notify no; file "null.zone.file"; }; zone "covid19vaccine.hopto.org" { type master; notify no; file "null.zone.file"; }; zone "covid2023.info" { type master; notify no; file "null.zone.file"; }; zone "covidbase.info" { type master; notify no; file "null.zone.file"; }; @@ -22921,6 +22922,7 @@ zone "dacle.eu" { type master; notify no; file "null.zone.file"; }; zone "daclim.ro" { type master; notify no; file "null.zone.file"; }; zone "daco-precision.thomaswebs.net" { type master; notify no; file "null.zone.file"; }; zone "daco.nyccomputerconsulting.com" { type master; notify no; file "null.zone.file"; }; +zone "dacsancaonguyen.vn" { type master; notify no; file "null.zone.file"; }; zone "dactridaudaday.com" { type master; notify no; file "null.zone.file"; }; zone "dactyltech.co.za" { type master; notify no; file "null.zone.file"; }; zone "dacviadokese.com" { type master; notify no; file "null.zone.file"; }; @@ -31565,6 +31567,7 @@ zone "estiloraropremium.com.br" { type master; notify no; file "null.zone.file"; zone "estimating.training" { type master; notify no; file "null.zone.file"; }; zone "estimatorfind.com" { type master; notify no; file "null.zone.file"; }; zone "estimetercume.com" { type master; notify no; file "null.zone.file"; }; +zone "estjh05.top" { type master; notify no; file "null.zone.file"; }; zone "estore.qurvex.com" { type master; notify no; file "null.zone.file"; }; zone "estoyadieta.com" { type master; notify no; file "null.zone.file"; }; zone "estrategias-corporativas.com" { type master; notify no; file "null.zone.file"; }; @@ -31740,7 +31743,6 @@ zone "etwqsx23.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "etxse.xyz" { type master; notify no; file "null.zone.file"; }; zone "etysu02scnabr03wzaxue.com" { type master; notify no; file "null.zone.file"; }; zone "eu-easy.com" { type master; notify no; file "null.zone.file"; }; -zone "eu.wildfire.paloaltonetworks.com" { type master; notify no; file "null.zone.file"; }; zone "eu1.salesforce.com" { type master; notify no; file "null.zone.file"; }; zone "eu283iwoqodjspqisjdf.com" { type master; notify no; file "null.zone.file"; }; zone "eu5-cdn.devid.info" { type master; notify no; file "null.zone.file"; }; @@ -33884,7 +33886,6 @@ zone "files.danwin1210.me" { type master; notify no; file "null.zone.file"; }; zone "files.dropmybin.me" { type master; notify no; file "null.zone.file"; }; zone "files.enjin.com" { type master; notify no; file "null.zone.file"; }; zone "files.gathercdn.com" { type master; notify no; file "null.zone.file"; }; -zone "files.hrloo.com" { type master; notify no; file "null.zone.file"; }; zone "files.l-d.tech" { type master; notify no; file "null.zone.file"; }; zone "files.martellexpress.us" { type master; notify no; file "null.zone.file"; }; zone "files.mirai-2viv.vn" { type master; notify no; file "null.zone.file"; }; @@ -35617,6 +35618,7 @@ zone "friendsstarintl.com" { type master; notify no; file "null.zone.file"; }; zone "friendzonecafe.com" { type master; notify no; file "null.zone.file"; }; zone "frietfun.be" { type master; notify no; file "null.zone.file"; }; zone "frigolutasima.net" { type master; notify no; file "null.zone.file"; }; +zone "frigoprehrana.com" { type master; notify no; file "null.zone.file"; }; zone "frigoriferivignola.it" { type master; notify no; file "null.zone.file"; }; zone "frigotechniek.be" { type master; notify no; file "null.zone.file"; }; zone "frigsales.com" { type master; notify no; file "null.zone.file"; }; @@ -36098,7 +36100,6 @@ zone "fuzzymiles.com" { type master; notify no; file "null.zone.file"; }; zone "fv1-2.failiem.lv" { type master; notify no; file "null.zone.file"; }; zone "fv13.failiem.lv" { type master; notify no; file "null.zone.file"; }; zone "fv15.failiem.lv" { type master; notify no; file "null.zone.file"; }; -zone "fv2-2.failiem.lv" { type master; notify no; file "null.zone.file"; }; zone "fv2-7.failiem.lv" { type master; notify no; file "null.zone.file"; }; zone "fv3.failiem.lv" { type master; notify no; file "null.zone.file"; }; zone "fv6.failiem.lv" { type master; notify no; file "null.zone.file"; }; @@ -36176,7 +36177,6 @@ zone "g0ogle.free.fr" { type master; notify no; file "null.zone.file"; }; zone "g0zh8lb3.com" { type master; notify no; file "null.zone.file"; }; zone "g15aocbenedict.com" { type master; notify no; file "null.zone.file"; }; zone "g1ba4tt4ngq5nl7w.xyz" { type master; notify no; file "null.zone.file"; }; -zone "g1smurt.ru" { type master; notify no; file "null.zone.file"; }; zone "g20digital.com.br" { type master; notify no; file "null.zone.file"; }; zone "g237.cn" { type master; notify no; file "null.zone.file"; }; zone "g2creditsolutions.com" { type master; notify no; file "null.zone.file"; }; @@ -36264,9 +36264,6 @@ zone "gadanie-lidia.ru" { type master; notify no; file "null.zone.file"; }; zone "gadaniya-magiya.site" { type master; notify no; file "null.zone.file"; }; zone "gadcoafrica.com" { type master; notify no; file "null.zone.file"; }; zone "gaddco.com" { type master; notify no; file "null.zone.file"; }; -zone "gade4senate.com" { type master; notify no; file "null.zone.file"; }; -zone "gadebrigade.com" { type master; notify no; file "null.zone.file"; }; -zone "gadeforussenate.com" { type master; notify no; file "null.zone.file"; }; zone "gadem.ug" { type master; notify no; file "null.zone.file"; }; zone "gadesoluciones.pe" { type master; notify no; file "null.zone.file"; }; zone "gadget-plaza.ru" { type master; notify no; file "null.zone.file"; }; @@ -38414,6 +38411,7 @@ zone "gomiles.vn" { type master; notify no; file "null.zone.file"; }; zone "gomitra.com" { type master; notify no; file "null.zone.file"; }; zone "gomovies.cl" { type master; notify no; file "null.zone.file"; }; zone "gomsubattrangxuatkhau.com" { type master; notify no; file "null.zone.file"; }; +zone "gomsuminhlongthainguyen.vn" { type master; notify no; file "null.zone.file"; }; zone "gomus.com.br" { type master; notify no; file "null.zone.file"; }; zone "gomyfiles.info" { type master; notify no; file "null.zone.file"; }; zone "gomypass.com" { type master; notify no; file "null.zone.file"; }; @@ -39912,7 +39910,6 @@ zone "h-w-c.net" { type master; notify no; file "null.zone.file"; }; zone "h.epelcdn.com" { type master; notify no; file "null.zone.file"; }; zone "h.eurotrading.com.pl" { type master; notify no; file "null.zone.file"; }; zone "h.j990981.ru" { type master; notify no; file "null.zone.file"; }; -zone "h.top4top.io" { type master; notify no; file "null.zone.file"; }; zone "h.valerana44.ru" { type master; notify no; file "null.zone.file"; }; zone "h002295863.nichost.ru" { type master; notify no; file "null.zone.file"; }; zone "h0h.org" { type master; notify no; file "null.zone.file"; }; @@ -42142,7 +42139,6 @@ zone "home-spy-shop.com" { type master; notify no; file "null.zone.file"; }; zone "home.99eurowebsite.ie" { type master; notify no; file "null.zone.file"; }; zone "home.barley-plus.com" { type master; notify no; file "null.zone.file"; }; zone "home.dawang.ink" { type master; notify no; file "null.zone.file"; }; -zone "home.earthlink.net" { type master; notify no; file "null.zone.file"; }; zone "home.evrstudio.com" { type master; notify no; file "null.zone.file"; }; zone "home.healthiestu.com" { type master; notify no; file "null.zone.file"; }; zone "home.isdes.com" { type master; notify no; file "null.zone.file"; }; @@ -42512,6 +42508,7 @@ zone "hosteriapuestadelsol.com" { type master; notify no; file "null.zone.file"; zone "hostfleek.com" { type master; notify no; file "null.zone.file"; }; zone "hostgo.com.br" { type master; notify no; file "null.zone.file"; }; zone "hostile-gaming.fr" { type master; notify no; file "null.zone.file"; }; +zone "hostimpel.com" { type master; notify no; file "null.zone.file"; }; zone "hosting-c.iuro.nl" { type master; notify no; file "null.zone.file"; }; zone "hosting.drupwayinfotech.in" { type master; notify no; file "null.zone.file"; }; zone "hosting.mrsofttech.com" { type master; notify no; file "null.zone.file"; }; @@ -48968,6 +48965,7 @@ zone "kabek.vn" { type master; notify no; file "null.zone.file"; }; zone "kabelinieseti.ru" { type master; notify no; file "null.zone.file"; }; zone "kabiguru.org" { type master; notify no; file "null.zone.file"; }; zone "kabiledans.com" { type master; notify no; file "null.zone.file"; }; +zone "kabimmo.com" { type master; notify no; file "null.zone.file"; }; zone "kabinarf.ru" { type master; notify no; file "null.zone.file"; }; zone "kabiru.ru" { type master; notify no; file "null.zone.file"; }; zone "kabiryogashramlimbdi.com" { type master; notify no; file "null.zone.file"; }; @@ -50385,7 +50383,6 @@ zone "killu.in" { type master; notify no; file "null.zone.file"; }; zone "kilnrefractory.com" { type master; notify no; file "null.zone.file"; }; zone "kilolo.site" { type master; notify no; file "null.zone.file"; }; zone "kilop.goodvibeskickin.com" { type master; notify no; file "null.zone.file"; }; -zone "kilopaskal.ru" { type master; notify no; file "null.zone.file"; }; zone "kimaco.com" { type master; notify no; file "null.zone.file"; }; zone "kimberly.digital" { type master; notify no; file "null.zone.file"; }; zone "kimberly5esthetique.com" { type master; notify no; file "null.zone.file"; }; @@ -50717,7 +50714,6 @@ zone "klasterpolskanatura.pl" { type master; notify no; file "null.zone.file"; } zone "klaus-moersch.de" { type master; notify no; file "null.zone.file"; }; zone "klausnerlaw.com" { type master; notify no; file "null.zone.file"; }; zone "klaussen.net" { type master; notify no; file "null.zone.file"; }; -zone "klaustrofebia.ru" { type master; notify no; file "null.zone.file"; }; zone "klavze28.com" { type master; notify no; file "null.zone.file"; }; zone "klbay.net" { type master; notify no; file "null.zone.file"; }; zone "kldatabase.com" { type master; notify no; file "null.zone.file"; }; @@ -53619,6 +53615,7 @@ zone "library.arihantmbainstitute.ac.in" { type master; notify no; file "null.zo zone "library.cifor.org" { type master; notify no; file "null.zone.file"; }; zone "library.dhl-xom.com" { type master; notify no; file "null.zone.file"; }; zone "library.iainbengkulu.ac.id" { type master; notify no; file "null.zone.file"; }; +zone "library.mju.ac.th" { type master; notify no; file "null.zone.file"; }; zone "library.phibi.my.id" { type master; notify no; file "null.zone.file"; }; zone "library.piet.co.in" { type master; notify no; file "null.zone.file"; }; zone "library.strophicmusic.com" { type master; notify no; file "null.zone.file"; }; @@ -55391,7 +55388,6 @@ zone "luminousinvestment.com" { type master; notify no; file "null.zone.file"; } zone "luminouspla.net" { type master; notify no; file "null.zone.file"; }; zone "luminouspneuma.com" { type master; notify no; file "null.zone.file"; }; zone "lumnus.com.br" { type master; notify no; file "null.zone.file"; }; -zone "lumoura.com" { type master; notify no; file "null.zone.file"; }; zone "lumperpush.com" { type master; notify no; file "null.zone.file"; }; zone "lumsdancorp.com" { type master; notify no; file "null.zone.file"; }; zone "lun.otrweb.ru" { type master; notify no; file "null.zone.file"; }; @@ -55553,6 +55549,7 @@ zone "lyhnb.club" { type master; notify no; file "null.zone.file"; }; zone "lykangblog.com" { type master; notify no; file "null.zone.file"; }; zone "lykusglobal.com" { type master; notify no; file "null.zone.file"; }; zone "lylevr.com" { type master; notify no; file "null.zone.file"; }; +zone "lyllacarter.com" { type master; notify no; file "null.zone.file"; }; zone "lylydressforless.com" { type master; notify no; file "null.zone.file"; }; zone "lymcomercial.cl" { type master; notify no; file "null.zone.file"; }; zone "lymfodrenaze.eu" { type master; notify no; file "null.zone.file"; }; @@ -58709,6 +58706,7 @@ zone "medicina.uanl.mx" { type master; notify no; file "null.zone.file"; }; zone "medicinadellavoromb.it" { type master; notify no; file "null.zone.file"; }; zone "medicinaesteticaorlandini.it" { type master; notify no; file "null.zone.file"; }; zone "medicinageriatrica.com.br" { type master; notify no; file "null.zone.file"; }; +zone "medicinainterna-critica.com" { type master; notify no; file "null.zone.file"; }; zone "medicinaonline.rjsrwaco.watchdogdns.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "medicine.softberg.ro" { type master; notify no; file "null.zone.file"; }; zone "mediclaim.odhavnidhi.org" { type master; notify no; file "null.zone.file"; }; @@ -61879,6 +61877,7 @@ zone "mtbplus.de" { type master; notify no; file "null.zone.file"; }; zone "mtcinteriordesign.co.uk" { type master; notify no; file "null.zone.file"; }; zone "mtcr.co.za" { type master; notify no; file "null.zone.file"; }; zone "mtcuadrado.com" { type master; notify no; file "null.zone.file"; }; +zone "mtdc.com.my" { type master; notify no; file "null.zone.file"; }; zone "mte1.cn" { type master; notify no; file "null.zone.file"; }; zone "mtechagency.com" { type master; notify no; file "null.zone.file"; }; zone "mteestore.com" { type master; notify no; file "null.zone.file"; }; @@ -62575,7 +62574,6 @@ zone "myhygienemart.com" { type master; notify no; file "null.zone.file"; }; zone "myimmigrationlawmarketingpartner.com" { type master; notify no; file "null.zone.file"; }; zone "myimmogroup.be" { type master; notify no; file "null.zone.file"; }; zone "myinfoart.online" { type master; notify no; file "null.zone.file"; }; -zone "myinstabuzzz.co" { type master; notify no; file "null.zone.file"; }; zone "myinstantguru.com" { type master; notify no; file "null.zone.file"; }; zone "myinternetjobs.com" { type master; notify no; file "null.zone.file"; }; zone "myintromationsz.win" { type master; notify no; file "null.zone.file"; }; @@ -62601,6 +62599,7 @@ zone "mylifestoryfilm.com" { type master; notify no; file "null.zone.file"; }; zone "mylinkguard.com" { type master; notify no; file "null.zone.file"; }; zone "mylistbuildingtraffic.com" { type master; notify no; file "null.zone.file"; }; zone "mylisting.martinface.com" { type master; notify no; file "null.zone.file"; }; +zone "myliverpoolnews.cf" { type master; notify no; file "null.zone.file"; }; zone "myloanbaazar.com" { type master; notify no; file "null.zone.file"; }; zone "myloanexpert.in" { type master; notify no; file "null.zone.file"; }; zone "mylocal.dk" { type master; notify no; file "null.zone.file"; }; @@ -64190,6 +64189,7 @@ zone "news.iid-mit.com.tw" { type master; notify no; file "null.zone.file"; }; zone "news.intertours.org.rs" { type master; notify no; file "null.zone.file"; }; zone "news.leta.com.vn" { type master; notify no; file "null.zone.file"; }; zone "news.lwinmoenaing.me" { type master; notify no; file "null.zone.file"; }; +zone "news.makemoneywith.website" { type master; notify no; file "null.zone.file"; }; zone "news.medicaid.ir" { type master; notify no; file "null.zone.file"; }; zone "news.omumusic.net" { type master; notify no; file "null.zone.file"; }; zone "news.palette69.com" { type master; notify no; file "null.zone.file"; }; @@ -64973,6 +64973,7 @@ zone "nms.evertechit.live" { type master; notify no; file "null.zone.file"; }; zone "nmsk.online" { type master; notify no; file "null.zone.file"; }; zone "nmsr.info" { type master; notify no; file "null.zone.file"; }; zone "nmvconstructions.com" { type master; notify no; file "null.zone.file"; }; +zone "nmxwllwsdyminoragenw.dns.army" { type master; notify no; file "null.zone.file"; }; zone "nn-webdesign.be" { type master; notify no; file "null.zone.file"; }; zone "nn.5ctelematics.com" { type master; notify no; file "null.zone.file"; }; zone "nnasout.com" { type master; notify no; file "null.zone.file"; }; @@ -65753,7 +65754,6 @@ zone "nvdvdgp.com" { type master; notify no; file "null.zone.file"; }; zone "nvdweb.azurewebsites.net" { type master; notify no; file "null.zone.file"; }; zone "nveeusa.com" { type master; notify no; file "null.zone.file"; }; zone "nvelj12qyyfi03kqxy.xyz" { type master; notify no; file "null.zone.file"; }; -zone "nvgeeforsegt.ru" { type master; notify no; file "null.zone.file"; }; zone "nvgp.com.au" { type master; notify no; file "null.zone.file"; }; zone "nvi.edu.vn" { type master; notify no; file "null.zone.file"; }; zone "nvl.netsmartz.net" { type master; notify no; file "null.zone.file"; }; @@ -66971,7 +66971,6 @@ zone "onlusarcadia.it" { type master; notify no; file "null.zone.file"; }; zone "only4atalg.ml" { type master; notify no; file "null.zone.file"; }; zone "onlyapteka.ru" { type master; notify no; file "null.zone.file"; }; zone "onlyart.in" { type master; notify no; file "null.zone.file"; }; -zone "onlybamboofabrics.com" { type master; notify no; file "null.zone.file"; }; zone "onlycane.in" { type master; notify no; file "null.zone.file"; }; zone "onlychild.org" { type master; notify no; file "null.zone.file"; }; zone "onlycocktaildresses.com" { type master; notify no; file "null.zone.file"; }; @@ -68961,6 +68960,7 @@ zone "payyosafoolayzp.com" { type master; notify no; file "null.zone.file"; }; zone "pazarcheto.com" { type master; notify no; file "null.zone.file"; }; zone "pazargezer.com" { type master; notify no; file "null.zone.file"; }; zone "pazcomau-my.sharepoint.com" { type master; notify no; file "null.zone.file"; }; +zone "pazpus.com" { type master; notify no; file "null.zone.file"; }; zone "pb-xt.com" { type master; notify no; file "null.zone.file"; }; zone "pb.divaasolutions.com" { type master; notify no; file "null.zone.file"; }; zone "pb128o6c2favwk.com" { type master; notify no; file "null.zone.file"; }; @@ -70706,6 +70706,7 @@ zone "pmrimesndylimtdvensn.dns.army" { type master; notify no; file "null.zone.f zone "pmrimestdylimtdvenst.dns.army" { type master; notify no; file "null.zone.file"; }; zone "pmrimestdylimtdvests.dns.army" { type master; notify no; file "null.zone.file"; }; zone "pmrimestdylimtstwork.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "pmrimewsdylimtewsogh.dns.army" { type master; notify no; file "null.zone.file"; }; zone "pmrimewsdylimtwswods.dns.army" { type master; notify no; file "null.zone.file"; }; zone "pms.stercomagento.com" { type master; notify no; file "null.zone.file"; }; zone "pmsports.de" { type master; notify no; file "null.zone.file"; }; @@ -72424,6 +72425,7 @@ zone "prostranstvorosta.ru" { type master; notify no; file "null.zone.file"; }; zone "prosupport.cl" { type master; notify no; file "null.zone.file"; }; zone "prosvyaz.kz" { type master; notify no; file "null.zone.file"; }; zone "prosyarmakassar.com" { type master; notify no; file "null.zone.file"; }; +zone "prosystemsug.com" { type master; notify no; file "null.zone.file"; }; zone "prosysvinorosso.com" { type master; notify no; file "null.zone.file"; }; zone "prot.drupal8.softikom.lv" { type master; notify no; file "null.zone.file"; }; zone "protaciohospital.com" { type master; notify no; file "null.zone.file"; }; @@ -72434,7 +72436,6 @@ zone "protech.binarybizz.com" { type master; notify no; file "null.zone.file"; } zone "protech.mn" { type master; notify no; file "null.zone.file"; }; zone "protechcarpetcare.com" { type master; notify no; file "null.zone.file"; }; zone "protechgroup1.com" { type master; notify no; file "null.zone.file"; }; -zone "protect.mimecast-offshore.com" { type master; notify no; file "null.zone.file"; }; zone "protectiadatelor.biz" { type master; notify no; file "null.zone.file"; }; zone "protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "protection.pecol.eu" { type master; notify no; file "null.zone.file"; }; @@ -73634,6 +73635,7 @@ zone "quatanggmt.com" { type master; notify no; file "null.zone.file"; }; zone "quatanghoanglong.com" { type master; notify no; file "null.zone.file"; }; zone "quatangluuniemhue.com" { type master; notify no; file "null.zone.file"; }; zone "quatangtaynguyen.com" { type master; notify no; file "null.zone.file"; }; +zone "quatangtaynguyen.vn" { type master; notify no; file "null.zone.file"; }; zone "quatest.sixstarsent.com" { type master; notify no; file "null.zone.file"; }; zone "quatet365.com" { type master; notify no; file "null.zone.file"; }; zone "quatram.de" { type master; notify no; file "null.zone.file"; }; @@ -73699,6 +73701,7 @@ zone "quickbook.online" { type master; notify no; file "null.zone.file"; }; zone "quickbookstechnicalsupportphonenumber.com" { type master; notify no; file "null.zone.file"; }; zone "quickboooks.host" { type master; notify no; file "null.zone.file"; }; zone "quickboooks.space" { type master; notify no; file "null.zone.file"; }; +zone "quickcompanyreg.co.za" { type master; notify no; file "null.zone.file"; }; zone "quickfingers.net" { type master; notify no; file "null.zone.file"; }; zone "quickinsolutions.com" { type master; notify no; file "null.zone.file"; }; zone "quicklifecare.com" { type master; notify no; file "null.zone.file"; }; @@ -76300,7 +76303,6 @@ zone "roads.stamperinc.org" { type master; notify no; file "null.zone.file"; }; zone "roadscompass.com" { type master; notify no; file "null.zone.file"; }; zone "roadtravelcars.com" { type master; notify no; file "null.zone.file"; }; zone "roanokecellphonerepair.com" { type master; notify no; file "null.zone.file"; }; -zone "roanokemortgages.com" { type master; notify no; file "null.zone.file"; }; zone "roastedguarmeal.com" { type master; notify no; file "null.zone.file"; }; zone "roba.nu" { type master; notify no; file "null.zone.file"; }; zone "robaitec.com" { type master; notify no; file "null.zone.file"; }; @@ -78672,6 +78674,7 @@ zone "savannaopticalsgh.com" { type master; notify no; file "null.zone.file"; }; zone "savasaachi.systems" { type master; notify no; file "null.zone.file"; }; zone "savaspark.com.tr" { type master; notify no; file "null.zone.file"; }; zone "save-room.info" { type master; notify no; file "null.zone.file"; }; +zone "save.makemoneywith.website" { type master; notify no; file "null.zone.file"; }; zone "save24x7.com" { type master; notify no; file "null.zone.file"; }; zone "saveanimal.org" { type master; notify no; file "null.zone.file"; }; zone "savecannabis.org" { type master; notify no; file "null.zone.file"; }; @@ -82332,6 +82335,7 @@ zone "slrent.com" { type master; notify no; file "null.zone.file"; }; zone "slrpros.com" { type master; notify no; file "null.zone.file"; }; zone "sls-eg.com" { type master; notify no; file "null.zone.file"; }; zone "sls-security.ru" { type master; notify no; file "null.zone.file"; }; +zone "slsbearings.com.sg" { type master; notify no; file "null.zone.file"; }; zone "slservicebd.com" { type master; notify no; file "null.zone.file"; }; zone "slubnefury.pl" { type master; notify no; file "null.zone.file"; }; zone "slugard.5gbfree.com" { type master; notify no; file "null.zone.file"; }; @@ -84264,7 +84268,6 @@ zone "srmfiresafety.com" { type master; notify no; file "null.zone.file"; }; zone "srnirob.com" { type master; notify no; file "null.zone.file"; }; zone "srno.hu" { type master; notify no; file "null.zone.file"; }; zone "sromano.it" { type master; notify no; file "null.zone.file"; }; -zone "sromecorlduce.ru" { type master; notify no; file "null.zone.file"; }; zone "sroomf70nasiru.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "srooooiva.ru" { type master; notify no; file "null.zone.file"; }; zone "srpresse.fr" { type master; notify no; file "null.zone.file"; }; @@ -86093,7 +86096,6 @@ zone "sunfloro.com" { type master; notify no; file "null.zone.file"; }; zone "sunflowerschoolandcollege.com" { type master; notify no; file "null.zone.file"; }; zone "sunfruit.com.tn" { type master; notify no; file "null.zone.file"; }; zone "sunganak.in" { type master; notify no; file "null.zone.file"; }; -zone "sungardspo.com" { type master; notify no; file "null.zone.file"; }; zone "sungazer.com.au" { type master; notify no; file "null.zone.file"; }; zone "sunglasses2020.com" { type master; notify no; file "null.zone.file"; }; zone "sungvalopkhongsam.com" { type master; notify no; file "null.zone.file"; }; @@ -89493,6 +89495,7 @@ zone "thefoxfestival.com" { type master; notify no; file "null.zone.file"; }; zone "thefragrancefreeshop.com" { type master; notify no; file "null.zone.file"; }; zone "thefranssons.com" { type master; notify no; file "null.zone.file"; }; zone "thefreelancerschool.com" { type master; notify no; file "null.zone.file"; }; +zone "thefrees.com" { type master; notify no; file "null.zone.file"; }; zone "thefreewaterfoundation.org.za" { type master; notify no; file "null.zone.file"; }; zone "thefront.in" { type master; notify no; file "null.zone.file"; }; zone "thefuel.be" { type master; notify no; file "null.zone.file"; }; @@ -90077,6 +90080,7 @@ zone "theviestdyjupcafgcms.dns.army" { type master; notify no; file "null.zone.f zone "theviestdyjupcafgmcn.dns.army" { type master; notify no; file "null.zone.file"; }; zone "theviestdyjupcafgsvb.dns.army" { type master; notify no; file "null.zone.file"; }; zone "theviestdyjupcazfest.dns.navy" { type master; notify no; file "null.zone.file"; }; +zone "theviewsdyjupcazfeqv.dns.army" { type master; notify no; file "null.zone.file"; }; zone "theviewsdyjupcazwsgv.dns.army" { type master; notify no; file "null.zone.file"; }; zone "thevilla46.com" { type master; notify no; file "null.zone.file"; }; zone "thevine-organizasyon.com" { type master; notify no; file "null.zone.file"; }; @@ -90580,6 +90584,7 @@ zone "timelyent.com" { type master; notify no; file "null.zone.file"; }; zone "timelyrain.top" { type master; notify no; file "null.zone.file"; }; zone "timenard.top" { type master; notify no; file "null.zone.file"; }; zone "timenotbesea.xyz" { type master; notify no; file "null.zone.file"; }; +zone "timenow.pw" { type master; notify no; file "null.zone.file"; }; zone "timenowis1.top" { type master; notify no; file "null.zone.file"; }; zone "timeoffer.site" { type master; notify no; file "null.zone.file"; }; zone "timeofvape.tk" { type master; notify no; file "null.zone.file"; }; @@ -92345,7 +92350,6 @@ zone "trusticar.lt" { type master; notify no; file "null.zone.file"; }; zone "trustinspect.com" { type master; notify no; file "null.zone.file"; }; zone "trustlancers.com" { type master; notify no; file "null.zone.file"; }; zone "trustorbit.com" { type master; notify no; file "null.zone.file"; }; -zone "trustpilot-scam.com" { type master; notify no; file "null.zone.file"; }; zone "trustpropertyholdings.com" { type master; notify no; file "null.zone.file"; }; zone "trustrambusinesssolutions.com" { type master; notify no; file "null.zone.file"; }; zone "trustrobins.info" { type master; notify no; file "null.zone.file"; }; @@ -92392,6 +92396,7 @@ zone "ts-deals.me" { type master; notify no; file "null.zone.file"; }; zone "ts.7rb.xyz" { type master; notify no; file "null.zone.file"; }; zone "ts0ev73.com" { type master; notify no; file "null.zone.file"; }; zone "tsal.com" { type master; notify no; file "null.zone.file"; }; +zone "tsapparel.com.my" { type master; notify no; file "null.zone.file"; }; zone "tsareva-garden.ru" { type master; notify no; file "null.zone.file"; }; zone "tsatsi.co.za" { type master; notify no; file "null.zone.file"; }; zone "tsauctions.com" { type master; notify no; file "null.zone.file"; }; @@ -92953,7 +92958,6 @@ zone "u0649681.cp.regruhosting.ru" { type master; notify no; file "null.zone.fil zone "u0707115.cp.regruhosting.ru" { type master; notify no; file "null.zone.file"; }; zone "u0746219.cp.regruhosting.ru" { type master; notify no; file "null.zone.file"; }; zone "u0774849.cp.regruhosting.ru" { type master; notify no; file "null.zone.file"; }; -zone "u1.huatu.com" { type master; notify no; file "null.zone.file"; }; zone "u1.innerpeer.com" { type master; notify no; file "null.zone.file"; }; zone "u11123p7833.web0104.zxcs.nl" { type master; notify no; file "null.zone.file"; }; zone "u1141p8807.web0103.zxcs.nl" { type master; notify no; file "null.zone.file"; }; @@ -93696,6 +93700,7 @@ zone "unitedworks.info" { type master; notify no; file "null.zone.file"; }; zone "unitedwsdy5defenceforgorvermentsocialeme.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "unitedwsdykesokowsbv.dns.army" { type master; notify no; file "null.zone.file"; }; zone "unitedwsdykesokowsgs.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "unitedwsdykesokowskg.dns.army" { type master; notify no; file "null.zone.file"; }; zone "unitedwsdykesokowsku.dns.army" { type master; notify no; file "null.zone.file"; }; zone "unitedwsdykesokowsri.dns.navy" { type master; notify no; file "null.zone.file"; }; zone "unitedyfl.com" { type master; notify no; file "null.zone.file"; }; @@ -94096,7 +94101,6 @@ zone "url5459.41southbar.com" { type master; notify no; file "null.zone.file"; } zone "url675.textilmallorca.com" { type master; notify no; file "null.zone.file"; }; zone "url9823.ville.labrecque.qc.ca" { type master; notify no; file "null.zone.file"; }; zone "urlac.de" { type master; notify no; file "null.zone.file"; }; -zone "urldefense.us" { type master; notify no; file "null.zone.file"; }; zone "urleddrug.at" { type master; notify no; file "null.zone.file"; }; zone "urlfrance.fr" { type master; notify no; file "null.zone.file"; }; zone "urlm.ir" { type master; notify no; file "null.zone.file"; }; @@ -94223,7 +94227,6 @@ zone "uspeshnybusiness.ru" { type master; notify no; file "null.zone.file"; }; zone "uspslabel.itemdb.com" { type master; notify no; file "null.zone.file"; }; zone "uss.ac.th" { type master; notify no; file "null.zone.file"; }; zone "uss21.com" { type master; notify no; file "null.zone.file"; }; -zone "ussbd.net" { type master; notify no; file "null.zone.file"; }; zone "usselfstoragenetwork.com" { type master; notify no; file "null.zone.file"; }; zone "ussrback.com" { type master; notify no; file "null.zone.file"; }; zone "ussrgun.000webhostapp.com" { type master; notify no; file "null.zone.file"; }; @@ -94338,6 +94341,7 @@ zone "uy-akwaibom.ru" { type master; notify no; file "null.zone.file"; }; zone "uyaiblog.com" { type master; notify no; file "null.zone.file"; }; zone "uycqawua.applekid.cn" { type master; notify no; file "null.zone.file"; }; zone "uydu.antalyaelektrikariza.net" { type master; notify no; file "null.zone.file"; }; +zone "uyen.vn" { type master; notify no; file "null.zone.file"; }; zone "uyencometics.bmt.city" { type master; notify no; file "null.zone.file"; }; zone "uyencuentra.com" { type master; notify no; file "null.zone.file"; }; zone "uyf.com.ua" { type master; notify no; file "null.zone.file"; }; @@ -98810,7 +98814,6 @@ zone "wotan.info" { type master; notify no; file "null.zone.file"; }; zone "wotehb.com" { type master; notify no; file "null.zone.file"; }; zone "wotsuper.pw" { type master; notify no; file "null.zone.file"; }; zone "wotsuper3.exe" { type master; notify no; file "null.zone.file"; }; -zone "wouatiareves.ru" { type master; notify no; file "null.zone.file"; }; zone "wourionlion.ru" { type master; notify no; file "null.zone.file"; }; zone "woutaalexp.com" { type master; notify no; file "null.zone.file"; }; zone "wouterwolf.com" { type master; notify no; file "null.zone.file"; }; @@ -99031,6 +99034,7 @@ zone "wsdshipping.com" { type master; notify no; file "null.zone.file"; }; zone "wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "wsdyalgreenkeghewsmq.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "wsdyalgreenkelveskxz.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdyalhjchfonlinedws.dns.navy" { type master; notify no; file "null.zone.file"; }; zone "wsdyalhjchfonlinwsdf.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdyalhjchfonlinwsed.dns.army" { type master; notify no; file "null.zone.file"; }; @@ -99054,10 +99058,12 @@ zone "wsdyclntnjkcloudwsgh.dns.army" { type master; notify no; file "null.zone.f zone "wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "wsdyibgreenkegheedws.dns.navy" { type master; notify no; file "null.zone.file"; }; zone "wsdyibgreenkeghewsyt.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "wsdyibgreenventureqx.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdykalamikonlinedeliverystoreservwspmq.ydns.eu" { type master; notify no; file "null.zone.file"; }; zone "wsdykung38communicationtarisupliermgapc.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "wsdykungsb2gotchtsub.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdykungsb2gotchtwsp.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "wsdykungsb2talenwsjf.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdykungsb2talenwsmz.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdymsloginvestmwsqd.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdymsloginvestmwsrw.dns.army" { type master; notify no; file "null.zone.file"; }; @@ -99070,9 +99076,11 @@ zone "wsdynitengymndynatem.dns.army" { type master; notify no; file "null.zone.f zone "wsdynitengymndynatin.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdypmrimelimtdvenws.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdypmrimelimtdvewsd.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "wsdyrkkrgorgiousejhd.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdyrkkrsuccessmorev.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdyrkkrsuccessmoven.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdyrmtcntlfarmtwsvb.dns.army" { type master; notify no; file "null.zone.file"; }; +zone "wsdysara1investvwsfs.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdyshgshg2induswsjg.dns.army" { type master; notify no; file "null.zone.file"; }; zone "wsdyshgshgnationalindustrialandgoogledns.duckdns.org" { type master; notify no; file "null.zone.file"; }; zone "wsdyshgshgnationalobjindustrialat23fty.duckdns.org" { type master; notify no; file "null.zone.file"; }; @@ -100119,7 +100127,6 @@ zone "xnjwkaelsf.gq" { type master; notify no; file "null.zone.file"; }; zone "xnk.jbzie.com" { type master; notify no; file "null.zone.file"; }; zone "xnkwintech.com" { type master; notify no; file "null.zone.file"; }; zone "xnxxchannel.com" { type master; notify no; file "null.zone.file"; }; -zone "xnxxfullhd.com" { type master; notify no; file "null.zone.file"; }; zone "xo4z0sl.com" { type master; notify no; file "null.zone.file"; }; zone "xo57.com" { type master; notify no; file "null.zone.file"; }; zone "xoangyduong.com.vn" { type master; notify no; file "null.zone.file"; }; @@ -100668,7 +100675,6 @@ zone "yeu49.com" { type master; notify no; file "null.zone.file"; }; zone "yeu81.com" { type master; notify no; file "null.zone.file"; }; zone "yeu82.com" { type master; notify no; file "null.zone.file"; }; zone "yeuhang.tk" { type master; notify no; file "null.zone.file"; }; -zone "yeumoitruong.vn" { type master; notify no; file "null.zone.file"; }; zone "yeuromndy.cf" { type master; notify no; file "null.zone.file"; }; zone "yeutocviet.com" { type master; notify no; file "null.zone.file"; }; zone "yewonder.com" { type master; notify no; file "null.zone.file"; }; diff --git a/urlhaus-filter-dnsmasq-online.conf b/urlhaus-filter-dnsmasq-online.conf index 62955510..4b78eb3c 100644 --- a/urlhaus-filter-dnsmasq-online.conf +++ b/urlhaus-filter-dnsmasq-online.conf @@ -1,5 +1,5 @@ # Title: Online Malicious Domains dnsmasq Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -10,12 +10,11 @@ address=/1008691.com/0.0.0.0 address=/14karatvisions.com/0.0.0.0 address=/1am.co.nz/0.0.0.0 address=/21robo.com/0.0.0.0 -address=/32792.prolocksmithwinterpark.com/0.0.0.0 address=/360.lcy2zzx.pw/0.0.0.0 address=/360down7.miiyun.cn/0.0.0.0 +address=/4et3ja.am.files.1drv.com/0.0.0.0 address=/77st.net/0.0.0.0 address=/8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com/0.0.0.0 -address=/87du.vip/0.0.0.0 address=/8poieq.bn.files.1drv.com/0.0.0.0 address=/aatreefelling.co.za/0.0.0.0 address=/abcd.bg/0.0.0.0 @@ -29,7 +28,6 @@ address=/accesslinksgroup.com/0.0.0.0 address=/aceeprc.com.aceeprc.com/0.0.0.0 address=/acellr.co.uk/0.0.0.0 address=/acteon.com.ar/0.0.0.0 -address=/activecost.com.au/0.0.0.0 address=/addahealingmusic.com/0.0.0.0 address=/adithimedia.com/0.0.0.0 address=/adithimedia.memengers.com/0.0.0.0 @@ -89,11 +87,14 @@ address=/aps-sv.com/0.0.0.0 address=/artedibujoyarquitectura.com/0.0.0.0 address=/arwenyapi.com/0.0.0.0 address=/ask-regard.call-save.biz/0.0.0.0 +address=/asucssa.live/0.0.0.0 address=/atfile.com/0.0.0.0 address=/athenacapsg.com/0.0.0.0 +address=/atlasconcreteworks.com/0.0.0.0 address=/attach.66rpg.com/0.0.0.0 address=/atteuqpotentialunlimited.com/0.0.0.0 address=/augustair.com/0.0.0.0 +address=/aulist.com/0.0.0.0 address=/automaticrefreshments.com/0.0.0.0 address=/avadhanagames.com/0.0.0.0 address=/ayahuascasp.com.br/0.0.0.0 @@ -109,6 +110,7 @@ address=/bangladeshunbound.com/0.0.0.0 address=/bary.sz4h.com/0.0.0.0 address=/bash.givemexyz.in/0.0.0.0 address=/bausch.kr-atlas.monaxikoslykos@zytrox.tk/0.0.0.0 +address=/bavhome.com/0.0.0.0 address=/bbia.co.uk/0.0.0.0 address=/bcmt.elin.co.za/0.0.0.0 address=/bcrg.co.za/0.0.0.0 @@ -160,7 +162,6 @@ address=/browardinsurancemiami.solucioneslink.com/0.0.0.0 address=/bt2.elin.co.za/0.0.0.0 address=/btdapi.robotake.com/0.0.0.0 address=/buigiaphat.com.vn/0.0.0.0 -address=/bulkyfoodja.com/0.0.0.0 address=/bullseyemedia.in/0.0.0.0 address=/busandvanrentalmalaysia.com/0.0.0.0 address=/buscascolegios.diit.cl/0.0.0.0 @@ -174,11 +175,8 @@ address=/cacaoprojects.com/0.0.0.0 address=/calgaryautorepairservice.com/0.0.0.0 address=/callbury.in/0.0.0.0 address=/camminachetipassa.it/0.0.0.0 -address=/canadianwork.cc/0.0.0.0 address=/capitalgroup-kw.com/0.0.0.0 address=/capoeiraventrelivre.com/0.0.0.0 -address=/carlsbadre.com/0.0.0.0 -address=/carsidecor.com/0.0.0.0 address=/cashyinvestment.org/0.0.0.0 address=/catchperch.com/0.0.0.0 address=/catchpoolshetlands.co.uk/0.0.0.0 @@ -215,7 +213,6 @@ address=/colinde.pricesne.com/0.0.0.0 address=/colorpak.pl/0.0.0.0 address=/columbia.aula-web.net/0.0.0.0 address=/community.reimclub.com/0.0.0.0 -address=/comosairdoburaco.com.br/0.0.0.0 address=/competancy.indigoconsult.net/0.0.0.0 address=/conceptimagine.ro/0.0.0.0 address=/config.cqhbkjzx.com/0.0.0.0 @@ -224,12 +221,14 @@ address=/constructoralyon.com/0.0.0.0 address=/consulateins.solucioneslink.com/0.0.0.0 address=/contributeindustry.com/0.0.0.0 address=/copelandscapes.com/0.0.0.0 +address=/corwin-tommie06f.ru.com/0.0.0.0 address=/coulsongraphics.com/0.0.0.0 address=/count.mail.163.com.impactmedfoundation.com/0.0.0.0 address=/covid19.cyberschool.or.id/0.0.0.0 address=/cpanel.shivay.net/0.0.0.0 address=/cr-sq.com/0.0.0.0 address=/craftech.nxtnet.ga/0.0.0.0 +address=/crearechile.cl/0.0.0.0 address=/creationskateboards.com/0.0.0.0 address=/crecerco.com/0.0.0.0 address=/crittersbythebay.com/0.0.0.0 @@ -239,6 +238,7 @@ address=/crmroche.manivelasst.com/0.0.0.0 address=/crscorretordeimoveis.com.br/0.0.0.0 address=/cse-engineer.com/0.0.0.0 address=/csnserver.com/0.0.0.0 +address=/ctracknxt.in/0.0.0.0 address=/cubescargoexpress.com/0.0.0.0 address=/curasoles.co.za/0.0.0.0 address=/currantmedia.com/0.0.0.0 @@ -257,7 +257,6 @@ address=/datapolish.com/0.0.0.0 address=/dating.khokhas.co.za/0.0.0.0 address=/datsom.vn/0.0.0.0 address=/davethompson.me.uk/0.0.0.0 -address=/davidmcguinness.info/0.0.0.0 address=/dayspringdaisies.com/0.0.0.0 address=/dd.qiyuea.cn/0.0.0.0 address=/ddns.cyberium.cc/0.0.0.0 @@ -291,14 +290,11 @@ address=/dl.198424.com/0.0.0.0 address=/dl.installcdn-aws.com/0.0.0.0 address=/dl.packetstormsecurity.net/0.0.0.0 address=/dl.rina-roleplay.com/0.0.0.0 -address=/dnn.alibuf.com/0.0.0.0 -address=/dns.alibuf.com/0.0.0.0 address=/dockerupdate.anondns.net/0.0.0.0 address=/docman.orientalservices.in/0.0.0.0 address=/dodsonimaging.com/0.0.0.0 address=/doitunlimited.com/0.0.0.0 address=/dokan.blueberrytec.com/0.0.0.0 -address=/dom-chel74.ru/0.0.0.0 address=/dom.daf.free.fr/0.0.0.0 address=/doncedyhall.com/0.0.0.0 address=/donghobinhminh.com/0.0.0.0 @@ -308,6 +304,7 @@ address=/dosame.com/0.0.0.0 address=/dosman.pl/0.0.0.0 address=/dovberger.com/0.0.0.0 address=/down.pcclear.com/0.0.0.0 +address=/down.udashi.com/0.0.0.0 address=/down.webbora.com/0.0.0.0 address=/down1.arpun.com/0.0.0.0 address=/download.caihong.com/0.0.0.0 @@ -338,6 +335,7 @@ address=/e.sldov.ru/0.0.0.0 address=/eandgdesign.com.ng/0.0.0.0 address=/eastsheen-glaziers.co.uk/0.0.0.0 address=/ebruyatkin.com/0.0.0.0 +address=/edu.saicraftsman.com/0.0.0.0 address=/eedo.ee/0.0.0.0 address=/efficientegroup.com/0.0.0.0 address=/elbauldenora.com/0.0.0.0 @@ -352,8 +350,8 @@ address=/erp.nanotechproautocare.com/0.0.0.0 address=/erp.zilymax.com/0.0.0.0 address=/escola.probommar.org.br/0.0.0.0 address=/esnconsultants.com/0.0.0.0 -address=/esrhf04.top/0.0.0.0 address=/essentia.org.br/0.0.0.0 +address=/estjh05.top/0.0.0.0 address=/ethereality.info/0.0.0.0 address=/eubanks7.com/0.0.0.0 address=/europeanzonexxi.com/0.0.0.0 @@ -422,9 +420,11 @@ address=/goldcoastoffice365.com/0.0.0.0 address=/goldcoastoffice365.com.au/0.0.0.0 address=/golden-memories-funerals.yourpageserver.com/0.0.0.0 address=/goldenasiacapital.com/0.0.0.0 +address=/goldmen.in/0.0.0.0 address=/gpotecnosystems.com/0.0.0.0 address=/gracejukes.com/0.0.0.0 address=/grupoinmare.com/0.0.0.0 +address=/gruposelt.000webhostapp.com/0.0.0.0 address=/gs.monerorx.com/0.0.0.0 address=/guide-to-cell-phones.com/0.0.0.0 address=/gulfac-house.com/0.0.0.0 @@ -452,6 +452,7 @@ address=/hitstation.nl/0.0.0.0 address=/hmpmall.co.kr/0.0.0.0 address=/hoagietesting10.com/0.0.0.0 address=/hoayeuthuong-my.sharepoint.com/0.0.0.0 +address=/holmesservices.mobiledevsite.co/0.0.0.0 address=/homefindersolutions.com/0.0.0.0 address=/hongluosi.com/0.0.0.0 address=/hookedupboatclub.com/0.0.0.0 @@ -464,6 +465,7 @@ address=/hsmwebapp.com/0.0.0.0 address=/htownbars.com/0.0.0.0 address=/hubtech.co.za/0.0.0.0 address=/huellacero.cl/0.0.0.0 +address=/hunchomusichub.com/0.0.0.0 address=/hunggiang.vn/0.0.0.0 address=/husamiyahschool.com/0.0.0.0 address=/iabmixx2020.rayadigital.online/0.0.0.0 @@ -515,7 +517,6 @@ address=/jathra.co.uk/0.0.0.0 address=/jay.diamondrelationscrm.us/0.0.0.0 address=/jebs.net.au/0.0.0.0 address=/jeffdahlke.com/0.0.0.0 -address=/jhayesconsulting.com/0.0.0.0 address=/jiaoyuzixun.cn/0.0.0.0 address=/jing-da.com.tw/0.0.0.0 address=/jmtc.91756.cn/0.0.0.0 @@ -529,7 +530,6 @@ address=/jumpmanualjacobhiller.com/0.0.0.0 address=/jupiter.toxsl.in/0.0.0.0 address=/justinscott.com.au/0.0.0.0 address=/kadigital.co.uk/0.0.0.0 -address=/kaizenjanitorial.com/0.0.0.0 address=/kalawatihomes.com/0.0.0.0 address=/kalogirosfinance.com/0.0.0.0 address=/kaptaanchapal.com/0.0.0.0 @@ -540,17 +540,15 @@ address=/kensingtondriving.com/0.0.0.0 address=/ketofitnessexpert.com/0.0.0.0 address=/kevinjewelry.com.co/0.0.0.0 address=/keywatch.yourpageserver.com/0.0.0.0 -address=/khmerosja.net/0.0.0.0 address=/kingssa.co.za/0.0.0.0 address=/kizitox.ga/0.0.0.0 address=/kjcpromo.com/0.0.0.0 -address=/kldatabase.com/0.0.0.0 address=/kleinendeli.co.za/0.0.0.0 address=/korrectconceptservices.com/0.0.0.0 address=/krisbadminton.com/0.0.0.0 address=/ktb.sch.id/0.0.0.0 address=/kubatoglubaklava.com.tr/0.0.0.0 -address=/kullumanalitours.com/0.0.0.0 +address=/kumaralok.in/0.0.0.0 address=/kwanfromhongkong.com/0.0.0.0 address=/kz.sldov.ru/0.0.0.0 address=/lacasadelosalebrijes.com/0.0.0.0 @@ -559,7 +557,6 @@ address=/lameguard.ru/0.0.0.0 address=/laodongnhat.vn/0.0.0.0 address=/laravel.pointersoftwares.com.br/0.0.0.0 address=/lasermobilesounds.co.uk/0.0.0.0 -address=/laura9630fr.com/0.0.0.0 address=/lauratomismith.com/0.0.0.0 address=/lautarosanmiguel.com/0.0.0.0 address=/lawforall.edu.lk/0.0.0.0 @@ -661,14 +658,12 @@ address=/mis.nbcc.ac.th/0.0.0.0 address=/misterson.com/0.0.0.0 address=/mkontakt.az/0.0.0.0 address=/mktf.mx/0.0.0.0 -address=/mmdx.com/0.0.0.0 address=/mmogollon.com.mx/0.0.0.0 address=/mncarteam.com/0.0.0.0 address=/modelhouseturkey.com/0.0.0.0 address=/modernmanna.org/0.0.0.0 address=/monetization.business/0.0.0.0 address=/moninediy.com/0.0.0.0 -address=/mopai.sg/0.0.0.0 address=/motorcomunicacion.com/0.0.0.0 address=/moumitas.com/0.0.0.0 address=/msacontabil.com.br/0.0.0.0 @@ -687,7 +682,7 @@ address=/namnyak.co.ke/0.0.0.0 address=/nap.mgsservers.com/0.0.0.0 address=/navayurveda.in/0.0.0.0 address=/nec-i.com/0.0.0.0 -address=/nellaimasthanbiryani.com/0.0.0.0 +address=/nelitrianggraeni.000webhostapp.com/0.0.0.0 address=/nerve.untergrund.net/0.0.0.0 address=/nettube.com.br/0.0.0.0 address=/networkwheels.co.za/0.0.0.0 @@ -706,6 +701,7 @@ address=/nilehouse.co.ug/0.0.0.0 address=/nilinkeji.com/0.0.0.0 address=/nimboohomes.com/0.0.0.0 address=/njtiledesigncenter.com/0.0.0.0 +address=/nmxwllwsdyminoragenw.dns.army/0.0.0.0 address=/nobius.org/0.0.0.0 address=/nocalnoodle.elin.co.za/0.0.0.0 address=/nomadicbees.com/0.0.0.0 @@ -719,6 +715,7 @@ address=/nyasabigbullets.com/0.0.0.0 address=/nyeh2o.com.au/0.0.0.0 address=/obseques-conseils.com/0.0.0.0 address=/oecteam.com/0.0.0.0 +address=/ohe.ie/0.0.0.0 address=/ohsewgorgeous.co.uk/0.0.0.0 address=/oknoplastik.sk/0.0.0.0 address=/oleholeh.memangbeda.website/0.0.0.0 @@ -751,6 +748,7 @@ address=/pacwebdesigns.com/0.0.0.0 address=/pagos.krayem.com.mx/0.0.0.0 address=/palbas.cl/0.0.0.0 address=/palochusvet.szm.com/0.0.0.0 +address=/panslimiterd.com/0.0.0.0 address=/parallel.rockvideos.at/0.0.0.0 address=/parejasfelices.mi-fs.com/0.0.0.0 address=/parkhussion.com/0.0.0.0 @@ -781,6 +779,7 @@ address=/pink99.com/0.0.0.0 address=/plasfan.ind.br/0.0.0.0 address=/playground2.grupoaliadasca.com/0.0.0.0 address=/pmglance.startwriteup.com/0.0.0.0 +address=/pmrimewsdylimtewsogh.dns.army/0.0.0.0 address=/pokojewewladyslawowie.pl/0.0.0.0 address=/pole.com.vc/0.0.0.0 address=/pool.phxdir.com/0.0.0.0 @@ -794,7 +793,6 @@ address=/preview2.behalen.com/0.0.0.0 address=/prishaartcreations.com/0.0.0.0 address=/production.sparshims.com/0.0.0.0 address=/programaoperadoronline.com.br/0.0.0.0 -address=/project.exquitec.com/0.0.0.0 address=/promotoradescomplica.com.br/0.0.0.0 address=/promoversdubai.com/0.0.0.0 address=/propertiq.elin.co.za/0.0.0.0 @@ -804,7 +802,6 @@ address=/prosupport.cl/0.0.0.0 address=/prosyarmakassar.com/0.0.0.0 address=/provence.elin.co.za/0.0.0.0 address=/prox.realunix.cc/0.0.0.0 -address=/prueba.danielluza.com/0.0.0.0 address=/pujashoppe.in/0.0.0.0 address=/punchdialogues.com/0.0.0.0 address=/punjabdevelopersassociation.com.pk/0.0.0.0 @@ -819,7 +816,6 @@ address=/radioafifense.deploys.live/0.0.0.0 address=/rainbowisp.info/0.0.0.0 address=/rajeshtailang.com/0.0.0.0 address=/rakeshkhatri.in/0.0.0.0 -address=/raodigitalmedia.com/0.0.0.0 address=/raquelhelena.com.br/0.0.0.0 address=/rarlabarchiver.ac/0.0.0.0 address=/rasadbar.ir/0.0.0.0 @@ -833,7 +829,6 @@ address=/readwrite26.nl/0.0.0.0 address=/readymmade.com/0.0.0.0 address=/recyclethesurplus.com/0.0.0.0 address=/redbats.co.in/0.0.0.0 -address=/redboxmultimedia.com/0.0.0.0 address=/redchillicrackers.com/0.0.0.0 address=/reifenquick.de/0.0.0.0 address=/relaxindulge.co.nz/0.0.0.0 @@ -916,7 +911,6 @@ address=/shopsofe.com/0.0.0.0 address=/sibernetix.fr/0.0.0.0 address=/sigapresschennai.com/0.0.0.0 address=/sige.brisainformatica.com.br/0.0.0.0 -address=/signatureads.co.in/0.0.0.0 address=/siili.net/0.0.0.0 address=/simoneporzi.it/0.0.0.0 address=/simorsint.com/0.0.0.0 @@ -952,7 +946,6 @@ address=/spent.com.pl/0.0.0.0 address=/spetsesyachtcharter.gr/0.0.0.0 address=/spititourism.com/0.0.0.0 address=/spittinfire.com/0.0.0.0 -address=/springbedspetroleum.com/0.0.0.0 address=/src1.minibai.com/0.0.0.0 address=/sreenivasapaintingworks.com/0.0.0.0 address=/sriglobalit.com/0.0.0.0 @@ -994,12 +987,12 @@ address=/tafsantoursandtravels.com/0.0.0.0 address=/tajushariya.com/0.0.0.0 address=/tallyinvoicecustomization.com/0.0.0.0 address=/taltus.co.uk/0.0.0.0 -address=/tapalkoedacoffee.com/0.0.0.0 address=/tarravalleyfoods.com.au/0.0.0.0 address=/tavo.cl/0.0.0.0 address=/tc.snpsresidential.com/0.0.0.0 address=/tcy.198424.com/0.0.0.0 address=/tdsp.yngw518.com/0.0.0.0 +address=/tech332.synology.me/0.0.0.0 address=/techgms.com/0.0.0.0 address=/teduae.com/0.0.0.0 address=/teleargentina.com/0.0.0.0 @@ -1038,6 +1031,7 @@ address=/themansionkasauli.com/0.0.0.0 address=/theprofinn.com/0.0.0.0 address=/thesummitpc.net/0.0.0.0 address=/theurbantutors.com/0.0.0.0 +address=/theviewsdyjupcazfeqv.dns.army/0.0.0.0 address=/thosewebbs.com/0.0.0.0 address=/thriveink.com/0.0.0.0 address=/tianangdep.com/0.0.0.0 @@ -1055,6 +1049,7 @@ address=/topcell9.com/0.0.0.0 address=/toplevel.com.br/0.0.0.0 address=/topmask.co.za/0.0.0.0 address=/torresquinterocorp.com/0.0.0.0 +address=/towme.services/0.0.0.0 address=/toyotacollege.ac.th/0.0.0.0 address=/tpke.hu/0.0.0.0 address=/translaterjemah.com/0.0.0.0 @@ -1078,8 +1073,7 @@ address=/ultimate-24.de/0.0.0.0 address=/umwelt-kirchhof.de/0.0.0.0 address=/unicorpbrunei.com/0.0.0.0 address=/uniengrisb.com/0.0.0.0 -address=/unisoftcc.com/0.0.0.0 -address=/unityindiversity.in/0.0.0.0 +address=/unitedwsdykesokowskg.dns.army/0.0.0.0 address=/unyazitelecom.com/0.0.0.0 address=/upcbpta.com/0.0.0.0 address=/urbantrapfest.cl/0.0.0.0 @@ -1087,6 +1081,7 @@ address=/used-jeans.fr/0.0.0.0 address=/useformoney.000webhostapp.com/0.0.0.0 address=/uss.ac.th/0.0.0.0 address=/uzzepay.com.br/0.0.0.0 +address=/v2consultores.com/0.0.0.0 address=/vanzare.cabanabrazi2.ro/0.0.0.0 address=/vbcargo.hu/0.0.0.0 address=/vcah.co.uk/0.0.0.0 @@ -1146,11 +1141,14 @@ address=/wolfgang-brodte.de/0.0.0.0 address=/woodsytech.com/0.0.0.0 address=/wordpress.saleensuporte.com.br/0.0.0.0 address=/workingsolutionsrome.org/0.0.0.0 -address=/wozata.000webhostapp.com/0.0.0.0 address=/wp.readhere.in/0.0.0.0 address=/wpdemo.101clients.com.au/0.0.0.0 address=/writtendeer.com/0.0.0.0 address=/ws5588.f3322.net/0.0.0.0 +address=/wsdyalgreenkelveskxz.dns.army/0.0.0.0 +address=/wsdykungsb2talenwsjf.dns.army/0.0.0.0 +address=/wsdyrkkrgorgiousejhd.dns.army/0.0.0.0 +address=/wsdysara1investvwsfs.dns.army/0.0.0.0 address=/wsdysuresbonescagegp.dns.army/0.0.0.0 address=/wyklej.pl/0.0.0.0 address=/x2vn.com/0.0.0.0 diff --git a/urlhaus-filter-dnsmasq.conf b/urlhaus-filter-dnsmasq.conf index 170f645d..20fb6a04 100644 --- a/urlhaus-filter-dnsmasq.conf +++ b/urlhaus-filter-dnsmasq.conf @@ -1,5 +1,5 @@ # Title: Malicious Domains dnsmasq Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -238,6 +238,7 @@ address=/123mobile.store/0.0.0.0 address=/123moviesfx.com/0.0.0.0 address=/123sellfast.com/0.0.0.0 address=/123sex.co/0.0.0.0 +address=/123tadi.com/0.0.0.0 address=/123xyz.xyz/0.0.0.0 address=/124.com.ua/0.0.0.0 address=/124.cpanel.realwebsitesite.com/0.0.0.0 @@ -1190,6 +1191,7 @@ address=/4drakona.ru/0.0.0.0 address=/4ele.pl/0.0.0.0 address=/4ertybhdfrt.gq/0.0.0.0 address=/4esports.de/0.0.0.0 +address=/4et3ja.am.files.1drv.com/0.0.0.0 address=/4evakleen.com.au/0.0.0.0 address=/4eventfacilities.nl/0.0.0.0 address=/4evernails.nl/0.0.0.0 @@ -1776,6 +1778,7 @@ address=/998awol.com/0.0.0.0 address=/999.buzz/0.0.0.0 address=/999.co.id/0.0.0.0 address=/999.rajaojek.com/0.0.0.0 +address=/999080321newfolder1002002131-service1002.space/0.0.0.0 address=/999102com.cn/0.0.0.0 address=/99bkx.com/0.0.0.0 address=/99centsdigitals.com/0.0.0.0 @@ -3963,6 +3966,7 @@ address=/ahiraatfashion.com/0.0.0.0 address=/ahiskatv.net/0.0.0.0 address=/ahitekniktarti.com/0.0.0.0 address=/ahiyangrup.com.tr/0.0.0.0 +address=/ahjianlong.cf/0.0.0.0 address=/ahjuric.si/0.0.0.0 address=/ahk.smu8street.ru/0.0.0.0 address=/ahkha.com/0.0.0.0 @@ -4387,6 +4391,7 @@ address=/akito.be/0.0.0.0 address=/akivj07.top/0.0.0.0 address=/akktis.com/0.0.0.0 address=/akkurtmadencilik.com/0.0.0.0 +address=/aklatdelmundo.com/0.0.0.0 address=/akleigh.com/0.0.0.0 address=/aklin.ir/0.0.0.0 address=/aklocalshop.com/0.0.0.0 @@ -5099,7 +5104,6 @@ address=/alladinonlinee.com/0.0.0.0 address=/allainesconsultancyinc.com/0.0.0.0 address=/allamanolibrary.com/0.0.0.0 address=/allan-it.com/0.0.0.0 -address=/allanabolicsteam.net/0.0.0.0 address=/allanelect.co.uk/0.0.0.0 address=/allangillphotography.com/0.0.0.0 address=/allanhollowell.com/0.0.0.0 @@ -5373,6 +5377,7 @@ address=/alona.org.cy/0.0.0.0 address=/aloneintheweb.com/0.0.0.0 address=/aloneskisehir.com/0.0.0.0 address=/alongthelines.com/0.0.0.0 +address=/alongwalker.com/0.0.0.0 address=/alonhadat24h.vn/0.0.0.0 address=/alooshop.ir/0.0.0.0 address=/aloravan.com/0.0.0.0 @@ -6130,7 +6135,6 @@ address=/an9news.com/0.0.0.0 address=/ana.plecko.eu/0.0.0.0 address=/anaaj.pk/0.0.0.0 address=/anabim.com/0.0.0.0 -address=/anabolicsteroidsbuy.info/0.0.0.0 address=/anaceb.com/0.0.0.0 address=/anadearmas.net/0.0.0.0 address=/anadelgbt.org/0.0.0.0 @@ -10103,7 +10107,6 @@ address=/b94yhzk.com/0.0.0.0 address=/b97pm6.com/0.0.0.0 address=/ba3capital.com/0.0.0.0 address=/baacsetu.org/0.0.0.0 -address=/baadababada.ru/0.0.0.0 address=/baaders-namibia.com/0.0.0.0 address=/baakcafe.com/0.0.0.0 address=/baamiraan.ir/0.0.0.0 @@ -10225,7 +10228,6 @@ address=/backup.utlitslaekning.is/0.0.0.0 address=/backup.xn----8sba7bmrlhv0a.xn--p1ai/0.0.0.0 address=/backup2.robinandelaine.com/0.0.0.0 address=/backupcom.e-twow.uk/0.0.0.0 -address=/backupez.com/0.0.0.0 address=/backupfashions.com/0.0.0.0 address=/backupsitedev.flywheelsites.com/0.0.0.0 address=/backupsql.datasiswebcontable.com/0.0.0.0 @@ -11608,7 +11610,6 @@ address=/belayadver.com/0.0.0.0 address=/belaythakayni.com/0.0.0.0 address=/belboks.com/0.0.0.0 address=/belboy.in/0.0.0.0 -address=/belcineloweek.ru/0.0.0.0 address=/belconger.com/0.0.0.0 address=/belcorpisl.com/0.0.0.0 address=/belcvet.com/0.0.0.0 @@ -14167,7 +14168,6 @@ address=/bobbyterry.top/0.0.0.0 address=/bobbyworld.top/0.0.0.0 address=/bobcar.com.my/0.0.0.0 address=/bobcatofchico.com/0.0.0.0 -address=/bobcatofredding.com/0.0.0.0 address=/bobcook.ca/0.0.0.0 address=/bobdolph.com/0.0.0.0 address=/bobenstetter.net/0.0.0.0 @@ -15419,7 +15419,6 @@ address=/bucketlistrecipes.com/0.0.0.0 address=/bucketstrong.s3-us-west-1.amazonaws.com/0.0.0.0 address=/buckeyechartershiltonhead.com/0.0.0.0 address=/buckeyeoptical.com/0.0.0.0 -address=/buckeyesecurity.net/0.0.0.0 address=/buckinghamandlloyds.com/0.0.0.0 address=/buckleman.co.id/0.0.0.0 address=/bucklindata.net/0.0.0.0 @@ -15508,6 +15507,7 @@ address=/buildchem.pk/0.0.0.0 address=/buildcraftindia.com/0.0.0.0 address=/buildentconstructions.com/0.0.0.0 address=/builder.acasia.mx/0.0.0.0 +address=/builder.makemoneywith.website/0.0.0.0 address=/buildersmerchantsfederation-my.sharepoint.com/0.0.0.0 address=/buildgreenindustries.com/0.0.0.0 address=/building-company.lt/0.0.0.0 @@ -16051,7 +16051,6 @@ address=/c.mymortgagegenius.ca/0.0.0.0 address=/c.oooooooooo.ga/0.0.0.0 address=/c.pieshua.com/0.0.0.0 address=/c.teamworx.ph/0.0.0.0 -address=/c.top4top.io/0.0.0.0 address=/c.top4top.net/0.0.0.0 address=/c.vivi.casa/0.0.0.0 address=/c.vollar.ga/0.0.0.0 @@ -16723,6 +16722,7 @@ address=/capitalnewsagency.com/0.0.0.0 address=/capitalonefinanceltd.in/0.0.0.0 address=/capitalpellets.com/0.0.0.0 address=/capitalpremiumfinancinginc.com/0.0.0.0 +address=/capitalprint.co.za/0.0.0.0 address=/capitalprivateasset.com/0.0.0.0 address=/capitalrealestate.us/0.0.0.0 address=/capitalrh.com.br/0.0.0.0 @@ -21563,6 +21563,7 @@ address=/covid19.peaceforchildren.net/0.0.0.0 address=/covid19map.digital/0.0.0.0 address=/covid19quarantin.com/0.0.0.0 address=/covid19safety.myftp.org/0.0.0.0 +address=/covid19vaccinations.hopto.org/0.0.0.0 address=/covid19vaccine.hopto.org/0.0.0.0 address=/covid2023.info/0.0.0.0 address=/covidbase.info/0.0.0.0 @@ -22921,6 +22922,7 @@ address=/dacle.eu/0.0.0.0 address=/daclim.ro/0.0.0.0 address=/daco-precision.thomaswebs.net/0.0.0.0 address=/daco.nyccomputerconsulting.com/0.0.0.0 +address=/dacsancaonguyen.vn/0.0.0.0 address=/dactridaudaday.com/0.0.0.0 address=/dactyltech.co.za/0.0.0.0 address=/dacviadokese.com/0.0.0.0 @@ -31565,6 +31567,7 @@ address=/estiloraropremium.com.br/0.0.0.0 address=/estimating.training/0.0.0.0 address=/estimatorfind.com/0.0.0.0 address=/estimetercume.com/0.0.0.0 +address=/estjh05.top/0.0.0.0 address=/estore.qurvex.com/0.0.0.0 address=/estoyadieta.com/0.0.0.0 address=/estrategias-corporativas.com/0.0.0.0 @@ -31740,7 +31743,6 @@ address=/etwqsx23.duckdns.org/0.0.0.0 address=/etxse.xyz/0.0.0.0 address=/etysu02scnabr03wzaxue.com/0.0.0.0 address=/eu-easy.com/0.0.0.0 -address=/eu.wildfire.paloaltonetworks.com/0.0.0.0 address=/eu1.salesforce.com/0.0.0.0 address=/eu283iwoqodjspqisjdf.com/0.0.0.0 address=/eu5-cdn.devid.info/0.0.0.0 @@ -33884,7 +33886,6 @@ address=/files.danwin1210.me/0.0.0.0 address=/files.dropmybin.me/0.0.0.0 address=/files.enjin.com/0.0.0.0 address=/files.gathercdn.com/0.0.0.0 -address=/files.hrloo.com/0.0.0.0 address=/files.l-d.tech/0.0.0.0 address=/files.martellexpress.us/0.0.0.0 address=/files.mirai-2viv.vn/0.0.0.0 @@ -35617,6 +35618,7 @@ address=/friendsstarintl.com/0.0.0.0 address=/friendzonecafe.com/0.0.0.0 address=/frietfun.be/0.0.0.0 address=/frigolutasima.net/0.0.0.0 +address=/frigoprehrana.com/0.0.0.0 address=/frigoriferivignola.it/0.0.0.0 address=/frigotechniek.be/0.0.0.0 address=/frigsales.com/0.0.0.0 @@ -36098,7 +36100,6 @@ address=/fuzzymiles.com/0.0.0.0 address=/fv1-2.failiem.lv/0.0.0.0 address=/fv13.failiem.lv/0.0.0.0 address=/fv15.failiem.lv/0.0.0.0 -address=/fv2-2.failiem.lv/0.0.0.0 address=/fv2-7.failiem.lv/0.0.0.0 address=/fv3.failiem.lv/0.0.0.0 address=/fv6.failiem.lv/0.0.0.0 @@ -36176,7 +36177,6 @@ address=/g0ogle.free.fr/0.0.0.0 address=/g0zh8lb3.com/0.0.0.0 address=/g15aocbenedict.com/0.0.0.0 address=/g1ba4tt4ngq5nl7w.xyz/0.0.0.0 -address=/g1smurt.ru/0.0.0.0 address=/g20digital.com.br/0.0.0.0 address=/g237.cn/0.0.0.0 address=/g2creditsolutions.com/0.0.0.0 @@ -36264,9 +36264,6 @@ address=/gadanie-lidia.ru/0.0.0.0 address=/gadaniya-magiya.site/0.0.0.0 address=/gadcoafrica.com/0.0.0.0 address=/gaddco.com/0.0.0.0 -address=/gade4senate.com/0.0.0.0 -address=/gadebrigade.com/0.0.0.0 -address=/gadeforussenate.com/0.0.0.0 address=/gadem.ug/0.0.0.0 address=/gadesoluciones.pe/0.0.0.0 address=/gadget-plaza.ru/0.0.0.0 @@ -38414,6 +38411,7 @@ address=/gomiles.vn/0.0.0.0 address=/gomitra.com/0.0.0.0 address=/gomovies.cl/0.0.0.0 address=/gomsubattrangxuatkhau.com/0.0.0.0 +address=/gomsuminhlongthainguyen.vn/0.0.0.0 address=/gomus.com.br/0.0.0.0 address=/gomyfiles.info/0.0.0.0 address=/gomypass.com/0.0.0.0 @@ -39912,7 +39910,6 @@ address=/h-w-c.net/0.0.0.0 address=/h.epelcdn.com/0.0.0.0 address=/h.eurotrading.com.pl/0.0.0.0 address=/h.j990981.ru/0.0.0.0 -address=/h.top4top.io/0.0.0.0 address=/h.valerana44.ru/0.0.0.0 address=/h002295863.nichost.ru/0.0.0.0 address=/h0h.org/0.0.0.0 @@ -42142,7 +42139,6 @@ address=/home-spy-shop.com/0.0.0.0 address=/home.99eurowebsite.ie/0.0.0.0 address=/home.barley-plus.com/0.0.0.0 address=/home.dawang.ink/0.0.0.0 -address=/home.earthlink.net/0.0.0.0 address=/home.evrstudio.com/0.0.0.0 address=/home.healthiestu.com/0.0.0.0 address=/home.isdes.com/0.0.0.0 @@ -42512,6 +42508,7 @@ address=/hosteriapuestadelsol.com/0.0.0.0 address=/hostfleek.com/0.0.0.0 address=/hostgo.com.br/0.0.0.0 address=/hostile-gaming.fr/0.0.0.0 +address=/hostimpel.com/0.0.0.0 address=/hosting-c.iuro.nl/0.0.0.0 address=/hosting.drupwayinfotech.in/0.0.0.0 address=/hosting.mrsofttech.com/0.0.0.0 @@ -48968,6 +48965,7 @@ address=/kabek.vn/0.0.0.0 address=/kabelinieseti.ru/0.0.0.0 address=/kabiguru.org/0.0.0.0 address=/kabiledans.com/0.0.0.0 +address=/kabimmo.com/0.0.0.0 address=/kabinarf.ru/0.0.0.0 address=/kabiru.ru/0.0.0.0 address=/kabiryogashramlimbdi.com/0.0.0.0 @@ -50385,7 +50383,6 @@ address=/killu.in/0.0.0.0 address=/kilnrefractory.com/0.0.0.0 address=/kilolo.site/0.0.0.0 address=/kilop.goodvibeskickin.com/0.0.0.0 -address=/kilopaskal.ru/0.0.0.0 address=/kimaco.com/0.0.0.0 address=/kimberly.digital/0.0.0.0 address=/kimberly5esthetique.com/0.0.0.0 @@ -50717,7 +50714,6 @@ address=/klasterpolskanatura.pl/0.0.0.0 address=/klaus-moersch.de/0.0.0.0 address=/klausnerlaw.com/0.0.0.0 address=/klaussen.net/0.0.0.0 -address=/klaustrofebia.ru/0.0.0.0 address=/klavze28.com/0.0.0.0 address=/klbay.net/0.0.0.0 address=/kldatabase.com/0.0.0.0 @@ -53619,6 +53615,7 @@ address=/library.arihantmbainstitute.ac.in/0.0.0.0 address=/library.cifor.org/0.0.0.0 address=/library.dhl-xom.com/0.0.0.0 address=/library.iainbengkulu.ac.id/0.0.0.0 +address=/library.mju.ac.th/0.0.0.0 address=/library.phibi.my.id/0.0.0.0 address=/library.piet.co.in/0.0.0.0 address=/library.strophicmusic.com/0.0.0.0 @@ -55391,7 +55388,6 @@ address=/luminousinvestment.com/0.0.0.0 address=/luminouspla.net/0.0.0.0 address=/luminouspneuma.com/0.0.0.0 address=/lumnus.com.br/0.0.0.0 -address=/lumoura.com/0.0.0.0 address=/lumperpush.com/0.0.0.0 address=/lumsdancorp.com/0.0.0.0 address=/lun.otrweb.ru/0.0.0.0 @@ -55553,6 +55549,7 @@ address=/lyhnb.club/0.0.0.0 address=/lykangblog.com/0.0.0.0 address=/lykusglobal.com/0.0.0.0 address=/lylevr.com/0.0.0.0 +address=/lyllacarter.com/0.0.0.0 address=/lylydressforless.com/0.0.0.0 address=/lymcomercial.cl/0.0.0.0 address=/lymfodrenaze.eu/0.0.0.0 @@ -58709,6 +58706,7 @@ address=/medicina.uanl.mx/0.0.0.0 address=/medicinadellavoromb.it/0.0.0.0 address=/medicinaesteticaorlandini.it/0.0.0.0 address=/medicinageriatrica.com.br/0.0.0.0 +address=/medicinainterna-critica.com/0.0.0.0 address=/medicinaonline.rjsrwaco.watchdogdns.duckdns.org/0.0.0.0 address=/medicine.softberg.ro/0.0.0.0 address=/mediclaim.odhavnidhi.org/0.0.0.0 @@ -61879,6 +61877,7 @@ address=/mtbplus.de/0.0.0.0 address=/mtcinteriordesign.co.uk/0.0.0.0 address=/mtcr.co.za/0.0.0.0 address=/mtcuadrado.com/0.0.0.0 +address=/mtdc.com.my/0.0.0.0 address=/mte1.cn/0.0.0.0 address=/mtechagency.com/0.0.0.0 address=/mteestore.com/0.0.0.0 @@ -62575,7 +62574,6 @@ address=/myhygienemart.com/0.0.0.0 address=/myimmigrationlawmarketingpartner.com/0.0.0.0 address=/myimmogroup.be/0.0.0.0 address=/myinfoart.online/0.0.0.0 -address=/myinstabuzzz.co/0.0.0.0 address=/myinstantguru.com/0.0.0.0 address=/myinternetjobs.com/0.0.0.0 address=/myintromationsz.win/0.0.0.0 @@ -62601,6 +62599,7 @@ address=/mylifestoryfilm.com/0.0.0.0 address=/mylinkguard.com/0.0.0.0 address=/mylistbuildingtraffic.com/0.0.0.0 address=/mylisting.martinface.com/0.0.0.0 +address=/myliverpoolnews.cf/0.0.0.0 address=/myloanbaazar.com/0.0.0.0 address=/myloanexpert.in/0.0.0.0 address=/mylocal.dk/0.0.0.0 @@ -64190,6 +64189,7 @@ address=/news.iid-mit.com.tw/0.0.0.0 address=/news.intertours.org.rs/0.0.0.0 address=/news.leta.com.vn/0.0.0.0 address=/news.lwinmoenaing.me/0.0.0.0 +address=/news.makemoneywith.website/0.0.0.0 address=/news.medicaid.ir/0.0.0.0 address=/news.omumusic.net/0.0.0.0 address=/news.palette69.com/0.0.0.0 @@ -64973,6 +64973,7 @@ address=/nms.evertechit.live/0.0.0.0 address=/nmsk.online/0.0.0.0 address=/nmsr.info/0.0.0.0 address=/nmvconstructions.com/0.0.0.0 +address=/nmxwllwsdyminoragenw.dns.army/0.0.0.0 address=/nn-webdesign.be/0.0.0.0 address=/nn.5ctelematics.com/0.0.0.0 address=/nnasout.com/0.0.0.0 @@ -65753,7 +65754,6 @@ address=/nvdvdgp.com/0.0.0.0 address=/nvdweb.azurewebsites.net/0.0.0.0 address=/nveeusa.com/0.0.0.0 address=/nvelj12qyyfi03kqxy.xyz/0.0.0.0 -address=/nvgeeforsegt.ru/0.0.0.0 address=/nvgp.com.au/0.0.0.0 address=/nvi.edu.vn/0.0.0.0 address=/nvl.netsmartz.net/0.0.0.0 @@ -66971,7 +66971,6 @@ address=/onlusarcadia.it/0.0.0.0 address=/only4atalg.ml/0.0.0.0 address=/onlyapteka.ru/0.0.0.0 address=/onlyart.in/0.0.0.0 -address=/onlybamboofabrics.com/0.0.0.0 address=/onlycane.in/0.0.0.0 address=/onlychild.org/0.0.0.0 address=/onlycocktaildresses.com/0.0.0.0 @@ -68961,6 +68960,7 @@ address=/payyosafoolayzp.com/0.0.0.0 address=/pazarcheto.com/0.0.0.0 address=/pazargezer.com/0.0.0.0 address=/pazcomau-my.sharepoint.com/0.0.0.0 +address=/pazpus.com/0.0.0.0 address=/pb-xt.com/0.0.0.0 address=/pb.divaasolutions.com/0.0.0.0 address=/pb128o6c2favwk.com/0.0.0.0 @@ -70706,6 +70706,7 @@ address=/pmrimesndylimtdvensn.dns.army/0.0.0.0 address=/pmrimestdylimtdvenst.dns.army/0.0.0.0 address=/pmrimestdylimtdvests.dns.army/0.0.0.0 address=/pmrimestdylimtstwork.dns.army/0.0.0.0 +address=/pmrimewsdylimtewsogh.dns.army/0.0.0.0 address=/pmrimewsdylimtwswods.dns.army/0.0.0.0 address=/pms.stercomagento.com/0.0.0.0 address=/pmsports.de/0.0.0.0 @@ -72424,6 +72425,7 @@ address=/prostranstvorosta.ru/0.0.0.0 address=/prosupport.cl/0.0.0.0 address=/prosvyaz.kz/0.0.0.0 address=/prosyarmakassar.com/0.0.0.0 +address=/prosystemsug.com/0.0.0.0 address=/prosysvinorosso.com/0.0.0.0 address=/prot.drupal8.softikom.lv/0.0.0.0 address=/protaciohospital.com/0.0.0.0 @@ -72434,7 +72436,6 @@ address=/protech.binarybizz.com/0.0.0.0 address=/protech.mn/0.0.0.0 address=/protechcarpetcare.com/0.0.0.0 address=/protechgroup1.com/0.0.0.0 -address=/protect.mimecast-offshore.com/0.0.0.0 address=/protectiadatelor.biz/0.0.0.0 address=/protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org/0.0.0.0 address=/protection.pecol.eu/0.0.0.0 @@ -73634,6 +73635,7 @@ address=/quatanggmt.com/0.0.0.0 address=/quatanghoanglong.com/0.0.0.0 address=/quatangluuniemhue.com/0.0.0.0 address=/quatangtaynguyen.com/0.0.0.0 +address=/quatangtaynguyen.vn/0.0.0.0 address=/quatest.sixstarsent.com/0.0.0.0 address=/quatet365.com/0.0.0.0 address=/quatram.de/0.0.0.0 @@ -73699,6 +73701,7 @@ address=/quickbook.online/0.0.0.0 address=/quickbookstechnicalsupportphonenumber.com/0.0.0.0 address=/quickboooks.host/0.0.0.0 address=/quickboooks.space/0.0.0.0 +address=/quickcompanyreg.co.za/0.0.0.0 address=/quickfingers.net/0.0.0.0 address=/quickinsolutions.com/0.0.0.0 address=/quicklifecare.com/0.0.0.0 @@ -76300,7 +76303,6 @@ address=/roads.stamperinc.org/0.0.0.0 address=/roadscompass.com/0.0.0.0 address=/roadtravelcars.com/0.0.0.0 address=/roanokecellphonerepair.com/0.0.0.0 -address=/roanokemortgages.com/0.0.0.0 address=/roastedguarmeal.com/0.0.0.0 address=/roba.nu/0.0.0.0 address=/robaitec.com/0.0.0.0 @@ -78672,6 +78674,7 @@ address=/savannaopticalsgh.com/0.0.0.0 address=/savasaachi.systems/0.0.0.0 address=/savaspark.com.tr/0.0.0.0 address=/save-room.info/0.0.0.0 +address=/save.makemoneywith.website/0.0.0.0 address=/save24x7.com/0.0.0.0 address=/saveanimal.org/0.0.0.0 address=/savecannabis.org/0.0.0.0 @@ -82332,6 +82335,7 @@ address=/slrent.com/0.0.0.0 address=/slrpros.com/0.0.0.0 address=/sls-eg.com/0.0.0.0 address=/sls-security.ru/0.0.0.0 +address=/slsbearings.com.sg/0.0.0.0 address=/slservicebd.com/0.0.0.0 address=/slubnefury.pl/0.0.0.0 address=/slugard.5gbfree.com/0.0.0.0 @@ -84264,7 +84268,6 @@ address=/srmfiresafety.com/0.0.0.0 address=/srnirob.com/0.0.0.0 address=/srno.hu/0.0.0.0 address=/sromano.it/0.0.0.0 -address=/sromecorlduce.ru/0.0.0.0 address=/sroomf70nasiru.duckdns.org/0.0.0.0 address=/srooooiva.ru/0.0.0.0 address=/srpresse.fr/0.0.0.0 @@ -86093,7 +86096,6 @@ address=/sunfloro.com/0.0.0.0 address=/sunflowerschoolandcollege.com/0.0.0.0 address=/sunfruit.com.tn/0.0.0.0 address=/sunganak.in/0.0.0.0 -address=/sungardspo.com/0.0.0.0 address=/sungazer.com.au/0.0.0.0 address=/sunglasses2020.com/0.0.0.0 address=/sungvalopkhongsam.com/0.0.0.0 @@ -89493,6 +89495,7 @@ address=/thefoxfestival.com/0.0.0.0 address=/thefragrancefreeshop.com/0.0.0.0 address=/thefranssons.com/0.0.0.0 address=/thefreelancerschool.com/0.0.0.0 +address=/thefrees.com/0.0.0.0 address=/thefreewaterfoundation.org.za/0.0.0.0 address=/thefront.in/0.0.0.0 address=/thefuel.be/0.0.0.0 @@ -90077,6 +90080,7 @@ address=/theviestdyjupcafgcms.dns.army/0.0.0.0 address=/theviestdyjupcafgmcn.dns.army/0.0.0.0 address=/theviestdyjupcafgsvb.dns.army/0.0.0.0 address=/theviestdyjupcazfest.dns.navy/0.0.0.0 +address=/theviewsdyjupcazfeqv.dns.army/0.0.0.0 address=/theviewsdyjupcazwsgv.dns.army/0.0.0.0 address=/thevilla46.com/0.0.0.0 address=/thevine-organizasyon.com/0.0.0.0 @@ -90580,6 +90584,7 @@ address=/timelyent.com/0.0.0.0 address=/timelyrain.top/0.0.0.0 address=/timenard.top/0.0.0.0 address=/timenotbesea.xyz/0.0.0.0 +address=/timenow.pw/0.0.0.0 address=/timenowis1.top/0.0.0.0 address=/timeoffer.site/0.0.0.0 address=/timeofvape.tk/0.0.0.0 @@ -92345,7 +92350,6 @@ address=/trusticar.lt/0.0.0.0 address=/trustinspect.com/0.0.0.0 address=/trustlancers.com/0.0.0.0 address=/trustorbit.com/0.0.0.0 -address=/trustpilot-scam.com/0.0.0.0 address=/trustpropertyholdings.com/0.0.0.0 address=/trustrambusinesssolutions.com/0.0.0.0 address=/trustrobins.info/0.0.0.0 @@ -92392,6 +92396,7 @@ address=/ts-deals.me/0.0.0.0 address=/ts.7rb.xyz/0.0.0.0 address=/ts0ev73.com/0.0.0.0 address=/tsal.com/0.0.0.0 +address=/tsapparel.com.my/0.0.0.0 address=/tsareva-garden.ru/0.0.0.0 address=/tsatsi.co.za/0.0.0.0 address=/tsauctions.com/0.0.0.0 @@ -92953,7 +92958,6 @@ address=/u0649681.cp.regruhosting.ru/0.0.0.0 address=/u0707115.cp.regruhosting.ru/0.0.0.0 address=/u0746219.cp.regruhosting.ru/0.0.0.0 address=/u0774849.cp.regruhosting.ru/0.0.0.0 -address=/u1.huatu.com/0.0.0.0 address=/u1.innerpeer.com/0.0.0.0 address=/u11123p7833.web0104.zxcs.nl/0.0.0.0 address=/u1141p8807.web0103.zxcs.nl/0.0.0.0 @@ -93696,6 +93700,7 @@ address=/unitedworks.info/0.0.0.0 address=/unitedwsdy5defenceforgorvermentsocialeme.duckdns.org/0.0.0.0 address=/unitedwsdykesokowsbv.dns.army/0.0.0.0 address=/unitedwsdykesokowsgs.dns.army/0.0.0.0 +address=/unitedwsdykesokowskg.dns.army/0.0.0.0 address=/unitedwsdykesokowsku.dns.army/0.0.0.0 address=/unitedwsdykesokowsri.dns.navy/0.0.0.0 address=/unitedyfl.com/0.0.0.0 @@ -94096,7 +94101,6 @@ address=/url5459.41southbar.com/0.0.0.0 address=/url675.textilmallorca.com/0.0.0.0 address=/url9823.ville.labrecque.qc.ca/0.0.0.0 address=/urlac.de/0.0.0.0 -address=/urldefense.us/0.0.0.0 address=/urleddrug.at/0.0.0.0 address=/urlfrance.fr/0.0.0.0 address=/urlm.ir/0.0.0.0 @@ -94223,7 +94227,6 @@ address=/uspeshnybusiness.ru/0.0.0.0 address=/uspslabel.itemdb.com/0.0.0.0 address=/uss.ac.th/0.0.0.0 address=/uss21.com/0.0.0.0 -address=/ussbd.net/0.0.0.0 address=/usselfstoragenetwork.com/0.0.0.0 address=/ussrback.com/0.0.0.0 address=/ussrgun.000webhostapp.com/0.0.0.0 @@ -94338,6 +94341,7 @@ address=/uy-akwaibom.ru/0.0.0.0 address=/uyaiblog.com/0.0.0.0 address=/uycqawua.applekid.cn/0.0.0.0 address=/uydu.antalyaelektrikariza.net/0.0.0.0 +address=/uyen.vn/0.0.0.0 address=/uyencometics.bmt.city/0.0.0.0 address=/uyencuentra.com/0.0.0.0 address=/uyf.com.ua/0.0.0.0 @@ -98810,7 +98814,6 @@ address=/wotan.info/0.0.0.0 address=/wotehb.com/0.0.0.0 address=/wotsuper.pw/0.0.0.0 address=/wotsuper3.exe/0.0.0.0 -address=/wouatiareves.ru/0.0.0.0 address=/wourionlion.ru/0.0.0.0 address=/woutaalexp.com/0.0.0.0 address=/wouterwolf.com/0.0.0.0 @@ -99031,6 +99034,7 @@ address=/wsdshipping.com/0.0.0.0 address=/wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org/0.0.0.0 address=/wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org/0.0.0.0 address=/wsdyalgreenkeghewsmq.dns.army/0.0.0.0 +address=/wsdyalgreenkelveskxz.dns.army/0.0.0.0 address=/wsdyalhjchfonlinedws.dns.navy/0.0.0.0 address=/wsdyalhjchfonlinwsdf.dns.army/0.0.0.0 address=/wsdyalhjchfonlinwsed.dns.army/0.0.0.0 @@ -99054,10 +99058,12 @@ address=/wsdyclntnjkcloudwsgh.dns.army/0.0.0.0 address=/wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org/0.0.0.0 address=/wsdyibgreenkegheedws.dns.navy/0.0.0.0 address=/wsdyibgreenkeghewsyt.dns.army/0.0.0.0 +address=/wsdyibgreenventureqx.dns.army/0.0.0.0 address=/wsdykalamikonlinedeliverystoreservwspmq.ydns.eu/0.0.0.0 address=/wsdykung38communicationtarisupliermgapc.duckdns.org/0.0.0.0 address=/wsdykungsb2gotchtsub.dns.army/0.0.0.0 address=/wsdykungsb2gotchtwsp.dns.army/0.0.0.0 +address=/wsdykungsb2talenwsjf.dns.army/0.0.0.0 address=/wsdykungsb2talenwsmz.dns.army/0.0.0.0 address=/wsdymsloginvestmwsqd.dns.army/0.0.0.0 address=/wsdymsloginvestmwsrw.dns.army/0.0.0.0 @@ -99070,9 +99076,11 @@ address=/wsdynitengymndynatem.dns.army/0.0.0.0 address=/wsdynitengymndynatin.dns.army/0.0.0.0 address=/wsdypmrimelimtdvenws.dns.army/0.0.0.0 address=/wsdypmrimelimtdvewsd.dns.army/0.0.0.0 +address=/wsdyrkkrgorgiousejhd.dns.army/0.0.0.0 address=/wsdyrkkrsuccessmorev.dns.army/0.0.0.0 address=/wsdyrkkrsuccessmoven.dns.army/0.0.0.0 address=/wsdyrmtcntlfarmtwsvb.dns.army/0.0.0.0 +address=/wsdysara1investvwsfs.dns.army/0.0.0.0 address=/wsdyshgshg2induswsjg.dns.army/0.0.0.0 address=/wsdyshgshgnationalindustrialandgoogledns.duckdns.org/0.0.0.0 address=/wsdyshgshgnationalobjindustrialat23fty.duckdns.org/0.0.0.0 @@ -100119,7 +100127,6 @@ address=/xnjwkaelsf.gq/0.0.0.0 address=/xnk.jbzie.com/0.0.0.0 address=/xnkwintech.com/0.0.0.0 address=/xnxxchannel.com/0.0.0.0 -address=/xnxxfullhd.com/0.0.0.0 address=/xo4z0sl.com/0.0.0.0 address=/xo57.com/0.0.0.0 address=/xoangyduong.com.vn/0.0.0.0 @@ -100668,7 +100675,6 @@ address=/yeu49.com/0.0.0.0 address=/yeu81.com/0.0.0.0 address=/yeu82.com/0.0.0.0 address=/yeuhang.tk/0.0.0.0 -address=/yeumoitruong.vn/0.0.0.0 address=/yeuromndy.cf/0.0.0.0 address=/yeutocviet.com/0.0.0.0 address=/yewonder.com/0.0.0.0 diff --git a/urlhaus-filter-domains-online.txt b/urlhaus-filter-domains-online.txt index 3cb27f7e..2c6b3fd0 100644 --- a/urlhaus-filter-domains-online.txt +++ b/urlhaus-filter-domains-online.txt @@ -1,5 +1,5 @@ # Title: Online Malicious Domains Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -7,7 +7,6 @@ 0-24bpautomentes.hu 0cl.sldov.ru 1.10.147.48 -1.207.196.135 1.222.196.60 1.245.4.163 1.246.222.107 @@ -17,10 +16,10 @@ 1.246.222.134 1.246.222.138 1.246.222.14 +1.246.222.153 1.246.222.16 1.246.222.165 1.246.222.20 -1.246.222.228 1.246.222.234 1.246.222.237 1.246.222.245 @@ -47,14 +46,13 @@ 1.246.223.148 1.246.223.15 1.246.223.151 -1.246.223.22 1.246.223.223 1.246.223.4 1.246.223.48 -1.246.223.54 1.246.223.58 1.246.223.59 1.246.223.6 +1.246.223.61 1.246.223.71 1.246.223.83 1.246.223.94 @@ -80,7 +78,6 @@ 102.141.240.139 103.113.99.79 103.125.218.107 -103.141.138.118 103.16.145.25 103.204.168.34 103.217.215.21 @@ -93,15 +90,11 @@ 103.4.117.26 103.79.112.254 103.82.98.170 -103.91.123.92 +103.84.240.228 +103.84.241.94 103.91.245.12 103.91.245.14 103.91.245.16 -103.91.245.17 -103.91.245.23 -103.91.245.25 -103.91.245.28 -103.91.245.36 103.91.245.46 103.91.245.47 103.92.25.90 @@ -121,6 +114,7 @@ 107.172.193.132 107.172.249.148 107.173.219.80 +107.173.23.240 107.174.250.107 107.174.61.139 107.175.197.135 @@ -134,44 +128,41 @@ 108.190.201.37 108.190.250.48 108.249.194.121 -109.104.151.108 109.124.90.229 109.233.196.232 109.235.7.228 +109.248.58.238 109.86.85.253 -109.88.185.119 109.95.200.102 109.95.200.230 109.96.127.90 109.96.57.246 109.99.37.97 110.14.58.190 -110.187.229.182 110.228.195.46 110.248.124.254 110.248.175.141 110.248.251.194 110.251.10.18 -110.253.150.248 110.253.213.198 110.255.101.184 110.35.145.127 110.35.208.21 110.35.221.77 110.35.223.92 -110.35.225.24 +110.35.233.147 110.35.235.57 110.35.4.2 110.89.10.147 110.89.222.213 -111.118.111.207 +111.118.41.173 +111.118.88.128 111.118.88.61 111.119.245.114 111.125.67.125 111.163.50.120 111.170.86.31 111.172.57.20 -111.182.235.252 111.185.171.111 111.185.177.85 111.185.23.84 @@ -186,7 +177,6 @@ 111.38.121.223 111.38.121.226 111.38.121.228 -111.38.123.136 111.38.26.243 111.38.8.81 112.111.108.184 @@ -211,7 +201,6 @@ 112.236.171.69 112.237.141.241 112.237.144.226 -112.237.209.30 112.237.75.157 112.237.99.207 112.238.143.135 @@ -241,6 +230,7 @@ 112.254.208.123 112.255.6.129 112.255.8.235 +112.26.212.80 112.27.124.111 112.27.124.117 112.27.124.131 @@ -277,6 +267,7 @@ 112.30.1.219 112.30.1.229 112.30.1.230 +112.30.1.245 112.30.1.247 112.30.1.90 112.30.1.91 @@ -284,6 +275,7 @@ 112.30.110.38 112.30.110.43 112.30.110.48 +112.30.110.62 112.30.38.19 112.30.4.103 112.30.4.124 @@ -293,16 +285,20 @@ 112.30.97.184 112.31.0.113 112.31.176.16 +112.31.177.39 112.31.240.239 112.31.87.98 112.53.224.79 +112.53.227.66 112.65.53.175 112.72.153.37 +112.72.162.159 112.72.162.49 112.72.175.147 112.72.176.112 112.72.176.84 112.72.226.202 +112.72.231.35 112.78.45.158 112.80.127.91 112.80.215.101 @@ -314,23 +310,20 @@ 113.122.238.68 113.161.58.249 113.161.78.185 -113.226.42.250 113.227.194.172 113.227.35.229 113.231.211.131 113.254.169.251 113.59.128.133 113.59.133.16 +113.59.136.39 113.59.144.42 -113.59.154.21 +113.59.191.47 113.61.204.205 -113.87.226.255 113.87.32.93 113.89.43.185 114.111.242.3 114.224.203.128 -114.226.100.56 -114.228.205.101 114.229.165.194 114.30.54.64 114.79.172.42 @@ -338,28 +331,27 @@ 115.201.38.185 115.42.47.36 115.50.227.209 -115.50.92.195 +115.53.254.187 115.55.158.93 115.56.131.242 115.56.133.96 -115.56.135.210 115.56.152.194 115.58.132.140 115.59.233.160 -115.61.112.199 115.73.3.11 115.92.174.231 +115.97.142.58 116.124.219.2 116.132.151.60 116.206.164.46 116.211.100.26 -117.196.50.5 +116.75.197.220 117.20.204.138 117.20.204.5 -117.20.210.52 117.20.220.126 117.20.243.40 117.200.76.54 +117.251.59.16 117.26.104.74 117.63.113.146 117.63.195.140 @@ -384,7 +376,6 @@ 118.233.65.93 118.42.125.246 118.43.180.33 -118.79.125.92 118.79.50.203 118.79.58.82 118.99.179.164 @@ -396,7 +387,6 @@ 119.123.238.52 119.14.143.145 119.147.213.57 -119.163.93.191 119.164.18.235 119.164.218.229 119.165.107.93 @@ -435,8 +425,9 @@ 119.56.144.75 119.56.148.115 119.56.155.57 -119.56.173.24 119.56.195.90 +119.56.206.43 +119.56.220.170 12.132.113.2 12.15.69.83 12.178.187.6 @@ -462,10 +453,10 @@ 120.193.91.233 120.209.126.235 120.209.126.239 +120.209.126.250 120.209.126.60 120.209.127.187 120.209.99.127 -120.210.89.79 120.50.66.60 120.50.93.115 120.6.8.11 @@ -492,6 +483,7 @@ 122.100.150.204 122.160.147.53 122.188.86.225 +122.199.66.28 122.199.72.23 122.199.79.27 122.202.37.85 @@ -502,6 +494,7 @@ 123.110.170.237 123.110.182.187 123.110.19.248 +123.110.200.98 123.110.238.188 123.129.2.28 123.129.84.36 @@ -538,9 +531,8 @@ 123.241.148.58 123.241.184.124 123.28.217.23 -123.4.44.113 123.5.5.242 -123.8.17.78 +123.9.193.157 124.129.221.150 124.129.76.230 124.129.78.176 @@ -553,6 +545,7 @@ 124.132.110.150 124.135.34.49 124.152.26.45 +124.153.136.175 124.153.236.6 124.160.126.238 124.163.65.64 @@ -561,6 +554,7 @@ 124.199.56.198 124.230.174.233 124.254.251.54 +124.5.112.43 124.5.92.20 124.6.0.4 124.67.89.28 @@ -571,7 +565,6 @@ 125.128.28.161 125.142.93.34 125.191.113.212 -125.209.71.6 125.40.1.235 125.40.73.68 125.43.23.193 @@ -580,6 +573,7 @@ 128.116.133.92 130.255.159.133 134.195.139.4 +134.236.252.28 135.148.36.127 138.99.204.224 139.159.226.180 @@ -592,6 +586,7 @@ 14.189.247.118 14.232.33.212 14.37.222.190 +14.42.237.237 14.45.127.110 14.46.25.17 14.46.98.241 @@ -624,7 +619,6 @@ 163.53.206.228 165.90.16.5 167.114.172.177 -168.205.223.254 170.81.238.178 171.120.222.98 171.121.255.12 @@ -634,11 +628,13 @@ 171.35.162.156 171.35.174.198 172.105.36.168 +172.105.68.51 172.114.244.127 172.245.186.107 172.245.5.185 172.245.5.190 172.245.81.19 +172.93.176.142 172.93.194.114 173.167.85.89 173.169.46.85 @@ -651,14 +647,11 @@ 173.56.119.108 173.56.92.166 173.63.64.213 -174.106.33.85 174.61.3.149 -174.61.48.94 174.73.246.193 174.81.78.7 174.83.73.163 175.10.147.167 -175.11.193.66 175.11.65.112 175.117.66.74 175.169.13.182 @@ -679,38 +672,40 @@ 176.113.161.76 176.113.161.84 176.113.161.91 +176.113.174.139 176.12.117.70 176.123.7.115 176.123.7.127 -176.123.9.243 176.124.7.225 -176.221.188.251 -176.221.251.238 176.240.84.106 177.11.92.78 177.131.226.235 177.54.82.154 178.124.182.187 -178.134.185.112 178.150.174.65 178.151.143.2 178.165.122.141 +178.17.171.144 +178.175.0.143 178.175.1.179 178.175.10.164 +178.175.10.76 178.175.10.94 178.175.101.51 178.175.102.138 178.175.102.142 178.175.102.162 178.175.102.25 -178.175.103.143 178.175.103.173 +178.175.103.52 178.175.104.112 +178.175.104.67 178.175.104.69 178.175.105.213 178.175.105.238 178.175.105.7 178.175.107.0 +178.175.107.71 178.175.108.173 178.175.108.87 178.175.109.118 @@ -718,57 +713,56 @@ 178.175.111.135 178.175.111.171 178.175.111.190 -178.175.112.111 178.175.112.135 178.175.112.159 178.175.112.198 178.175.112.85 +178.175.114.146 178.175.114.151 -178.175.114.178 178.175.114.57 178.175.115.166 178.175.116.101 178.175.116.138 +178.175.116.20 178.175.116.242 178.175.118.112 -178.175.118.116 -178.175.118.244 178.175.119.69 178.175.12.135 178.175.120.154 -178.175.121.0 178.175.121.228 +178.175.121.54 178.175.122.28 178.175.123.213 -178.175.123.223 178.175.123.232 178.175.123.248 178.175.123.26 178.175.123.91 178.175.124.4 178.175.125.14 +178.175.125.149 178.175.126.129 -178.175.126.254 178.175.126.46 178.175.127.202 -178.175.127.63 +178.175.127.223 178.175.14.14 +178.175.14.155 178.175.15.199 178.175.15.232 178.175.15.44 -178.175.17.194 +178.175.16.26 178.175.17.236 -178.175.18.75 +178.175.19.160 178.175.19.163 178.175.2.158 178.175.2.217 178.175.2.225 +178.175.2.254 178.175.2.59 178.175.20.126 178.175.20.7 178.175.20.74 -178.175.21.149 -178.175.23.119 +178.175.21.41 +178.175.22.120 178.175.24.166 178.175.24.232 178.175.25.129 @@ -776,9 +770,15 @@ 178.175.27.32 178.175.27.46 178.175.29.233 +178.175.3.86 +178.175.30.109 178.175.30.133 178.175.30.151 +178.175.31.55 178.175.32.146 +178.175.32.186 +178.175.33.179 +178.175.33.32 178.175.34.230 178.175.35.170 178.175.35.193 @@ -792,108 +792,109 @@ 178.175.38.12 178.175.4.227 178.175.4.29 +178.175.40.209 +178.175.42.46 178.175.43.121 178.175.43.217 -178.175.43.238 178.175.44.186 -178.175.44.241 178.175.45.125 178.175.45.26 -178.175.46.41 178.175.46.59 -178.175.47.15 -178.175.47.181 +178.175.47.220 178.175.47.222 178.175.47.80 -178.175.48.40 +178.175.48.140 +178.175.48.223 +178.175.48.67 178.175.5.254 178.175.5.44 -178.175.5.74 178.175.50.217 178.175.50.42 +178.175.50.54 178.175.53.101 178.175.54.186 -178.175.54.234 178.175.54.58 178.175.55.99 -178.175.56.11 178.175.56.185 178.175.56.56 -178.175.57.134 +178.175.56.64 178.175.57.14 178.175.57.183 +178.175.57.204 178.175.58.230 178.175.58.234 178.175.58.235 178.175.59.106 178.175.60.247 178.175.61.103 -178.175.61.210 -178.175.62.241 178.175.62.60 178.175.64.156 -178.175.64.17 178.175.64.35 +178.175.65.189 178.175.65.208 +178.175.66.186 178.175.68.123 -178.175.68.209 178.175.68.44 178.175.68.57 +178.175.69.79 178.175.7.156 178.175.70.218 178.175.70.250 178.175.70.74 -178.175.72.148 +178.175.72.126 178.175.72.158 178.175.72.75 178.175.73.238 178.175.75.181 178.175.75.205 +178.175.75.214 +178.175.77.248 178.175.77.47 178.175.78.2 178.175.78.242 -178.175.78.243 178.175.79.146 +178.175.79.198 178.175.79.66 -178.175.8.248 178.175.8.85 +178.175.8.93 178.175.80.142 +178.175.80.167 178.175.81.185 178.175.81.192 178.175.81.226 -178.175.83.224 +178.175.81.240 178.175.84.195 178.175.84.215 +178.175.86.117 178.175.86.182 -178.175.86.47 178.175.86.59 -178.175.87.146 178.175.87.16 178.175.87.207 178.175.87.42 178.175.88.102 -178.175.88.207 +178.175.88.85 178.175.89.121 +178.175.89.132 178.175.89.45 178.175.89.69 178.175.91.223 178.175.92.144 -178.175.92.33 178.175.93.113 -178.175.93.200 178.175.93.234 178.175.93.98 178.175.94.224 +178.175.94.248 178.175.94.27 178.175.94.32 178.175.94.40 -178.175.95.60 -178.175.96.106 +178.175.95.105 +178.175.95.188 178.175.96.125 +178.175.96.93 178.175.97.127 -178.175.97.227 178.175.99.106 178.175.99.209 +178.175.99.21 178.19.183.14 178.205.101.33 178.21.164.68 @@ -904,7 +905,6 @@ 178.48.235.59 178.95.136.35 179.159.58.134 -179.4.187.39 179.43.176.41 179.43.176.48 179.60.84.7 @@ -941,6 +941,7 @@ 181.49.236.4 181.49.59.162 181.80.69.94 +182.112.177.134 182.115.179.201 182.119.206.219 182.119.225.221 @@ -953,13 +954,14 @@ 182.233.0.252 182.235.252.31 182.53.197.62 -183.105.104.83 183.105.225.154 183.109.169.45 183.143.148.105 183.188.50.93 -183.83.8.225 +183.83.1.1 +183.83.14.20 184.164.185.41 +184.175.115.10 184.74.149.230 184.82.15.135 185.106.209.68 @@ -974,7 +976,6 @@ 185.215.113.93 185.221.3.244 185.222.58.152 -185.224.129.224 185.228.141.74 185.233.186.151 185.245.96.94 @@ -984,6 +985,7 @@ 185.55.1.182 185.68.230.207 185.8.173.159 +185.81.154.208 185.81.157.186 185.82.217.185 185.82.217.213 @@ -1011,6 +1013,8 @@ 188.152.41.141 188.169.178.50 188.169.179.127 +188.169.199.59 +188.169.30.30 188.169.36.163 188.242.167.159 188.242.242.144 @@ -1040,6 +1044,7 @@ 190.216.140.123 190.65.206.162 190.85.213.51 +190.92.4.231 190.98.37.135 190.98.37.200 190.98.41.33 @@ -1053,7 +1058,6 @@ 192.227.230.72 192.227.230.74 192.227.230.76 -192.236.147.58 192.99.240.77 194.113.107.243 194.147.142.230 @@ -1065,11 +1069,10 @@ 195.24.94.187 195.5.3.87 196.202.26.182 +196.218.48.82 196.221.148.90 196.221.166.203 197.50.27.115 -198.23.133.218 -198.23.174.104 198.23.213.61 198.23.251.105 198.46.132.132 @@ -1077,6 +1080,7 @@ 2.239.22.188 2.36.231.201 2.37.149.230 +2.37.203.65 2.45.111.158 2.45.4.24 2.55.125.182 @@ -1090,32 +1094,29 @@ 200.194.4.24 200.30.132.50 201.170.46.2 +201.171.40.215 201.184.163.170 201.187.102.73 201.200.254.86 201.203.221.20 201.203.27.37 202.107.233.41 -202.150.176.100 202.166.217.54 202.175.103.10 202.29.95.12 202.4.124.58 202.51.176.114 202.51.191.174 -202.74.236.9 203.109.201.243 203.159.80.128 203.159.80.129 +203.159.80.164 203.170.123.78 203.189.156.107 203.204.232.18 203.229.21.56 203.236.190.28 -203.238.86.202 -203.243.142.132 203.70.166.107 -203.77.80.159 203.80.119.166 203.80.171.138 203.82.36.34 @@ -1130,7 +1131,6 @@ 209.141.40.31 209.146.98.50 210.124.149.19 -210.180.17.140 210.216.152.122 210.216.153.142 210.57.234.93 @@ -1139,19 +1139,20 @@ 210.68.242.114 211.187.132.204 211.187.75.220 -211.200.160.239 211.204.215.157 211.210.66.179 211.210.93.93 211.216.66.105 211.237.114.96 211.237.120.13 +211.237.246.137 211.238.83.238 211.247.5.96 211.32.122.110 211.93.191.153 212.122.86.105 212.143.227.22 +212.156.215.178 212.46.197.114 212.56.197.230 213.123.206.197 @@ -1162,28 +1163,30 @@ 213.163.104.99 213.163.111.201 213.163.114.136 -213.163.114.165 -213.163.115.104 213.163.116.153 +213.163.118.10 +213.163.118.216 213.163.126.20 213.163.126.201 -213.163.126.243 213.163.126.7 +213.186.69.101 213.189.178.163 213.240.218.15 213.249.156.189 -213.91.244.58 213.92.254.52 216.158.238.236 216.170.240.98 216.183.54.169 +216.183.54.196 216.36.12.98 217.11.75.162 +217.12.209.82 218.12.181.110 -218.161.69.135 218.2.40.34 218.234.165.18 218.238.246.3 +218.255.226.166 +218.32.118.1 218.35.207.119 218.35.227.133 218.35.68.35 @@ -1193,11 +1196,10 @@ 218.79.103.159 218.93.102.63 218.93.102.75 +219.155.234.33 219.155.29.165 219.155.64.104 219.157.139.165 -219.157.202.92 -219.157.214.235 219.241.6.180 219.68.1.148 219.68.1.84 @@ -1211,8 +1213,8 @@ 21robo.com 220.118.168.155 220.126.237.74 -220.132.89.154 220.200.22.163 +220.81.44.181 220.90.159.188 221.0.133.84 221.124.78.15 @@ -1238,11 +1240,13 @@ 222.132.125.138 222.133.103.120 222.135.9.5 +222.137.133.125 222.137.139.86 222.137.73.214 -222.138.201.129 222.140.17.245 +222.142.210.144 222.185.116.233 +222.186.20.19 222.187.9.178 222.211.72.66 222.236.85.220 @@ -1265,6 +1269,7 @@ 23.24.213.121 23.243.149.13 23.243.21.167 +23.95.122.24 23.95.89.21 24.103.74.180 24.11.141.134 @@ -1299,7 +1304,6 @@ 27.147.40.128 27.184.251.135 27.193.217.210 -27.194.149.142 27.194.192.66 27.197.23.215 27.199.232.65 @@ -1329,7 +1333,6 @@ 27.208.247.130 27.208.25.59 27.208.34.2 -27.209.208.122 27.209.231.15 27.21.151.205 27.210.107.125 @@ -1372,10 +1375,10 @@ 27.223.242.164 27.35.129.198 27.35.154.13 -27.35.2.30 +27.35.171.36 27.35.212.124 27.35.58.5 -27.7.204.255 +27.6.255.101 31.0.98.131 31.11.51.57 31.13.23.180 @@ -1402,7 +1405,6 @@ 31.30.119.23 31.32.120.79 32.208.157.193 -32792.prolocksmithwinterpark.com 34.122.44.188 35.184.169.169 36.108.231.218 @@ -1418,6 +1420,7 @@ 36.66.105.159 36.66.133.125 36.66.139.36 +36.67.152.161 36.89.18.133 36.91.89.187 360.lcy2zzx.pw @@ -1494,33 +1497,32 @@ 40.88.2.151 41.139.209.46 41.165.130.43 -41.190.63.174 41.193.192.100 41.219.185.171 41.226.60.115 41.72.203.82 41.76.157.2 41.86.18.200 -41.86.18.201 +41.86.5.164 41.86.5.197 +42.202.101.118 42.202.101.199 +42.224.51.229 42.228.60.114 42.229.173.80 42.230.91.1 42.231.208.64 +42.236.212.157 42.56.15.227 42.61.99.155 -42.82.217.241 +43.230.207.204 43.241.106.183 -43.241.108.134 -43.252.8.94 45.133.1.242 45.133.203.192 45.135.134.228 45.14.149.178 45.14.149.182 45.14.149.204 -45.141.84.182 45.141.84.184 45.144.225.118 45.144.225.135 @@ -1530,6 +1532,7 @@ 45.144.225.27 45.148.10.47 45.148.10.94 +45.156.22.230 45.176.109.205 45.176.111.159 45.176.111.35 @@ -1547,7 +1550,6 @@ 45.92.108.35 45.95.169.153 46.114.28.132 -46.161.185.15 46.172.75.231 46.20.63.218 46.214.27.4 @@ -1579,6 +1581,7 @@ 49.213.170.49 49.213.178.183 49.213.179.129 +4et3ja.am.files.1drv.com 5.14.122.233 5.188.62.111 5.2.70.50 @@ -1597,10 +1600,8 @@ 58.115.174.4 58.125.191.4 58.126.247.118 -58.141.122.109 58.142.166.120 58.142.200.124 -58.218.67.253 58.22.212.107 58.226.129.29 58.229.194.122 @@ -1611,7 +1612,6 @@ 58.241.78.55 58.243.126.133 58.72.165.153 -58.72.165.39 58.76.151.51 58.97.206.33 59.0.211.161 @@ -1622,6 +1622,7 @@ 59.151.246.125 59.173.193.208 59.23.114.97 +59.26.181.228 59.30.12.254 60.13.61.12 60.208.135.42 @@ -1645,7 +1646,6 @@ 60.253.44.99 60.253.51.127 60.253.60.174 -60.253.8.81 60.7.10.121 60.7.8.43 61.164.96.98 @@ -1676,17 +1676,19 @@ 62.141.73.58 62.219.131.205 62.219.143.46 -62.219.227.31 62.31.126.33 62.38.149.66 62.38.222.98 62.43.207.148 62.90.165.236 63.245.122.93 +64.233.154.99 +65.0.168.152 65.125.128.196 65.21.58.252 65.26.155.131 65.35.61.255 +66.108.199.144 66.229.214.115 66.57.55.210 66.74.7.197 @@ -1747,7 +1749,6 @@ 73.70.164.42 74.101.1.159 74.108.224.112 -74.119.195.101 74.194.117.165 74.195.115.176 74.199.84.77 @@ -1851,6 +1852,7 @@ 84.40.127.242 84.42.20.217 8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com +85.105.11.216 85.105.123.251 85.105.135.187 85.105.180.33 @@ -1863,13 +1865,13 @@ 85.74.215.180 85.97.130.227 86.35.43.220 -87.110.105.250 +87.117.11.46 87.172.19.130 87.61.89.40 -87du.vip 88.119.171.253 88.2.208.71 88.2.219.179 +88.218.17.110 88.218.17.149 88.225.222.128 88.247.96.19 @@ -1878,10 +1880,12 @@ 88.249.244.180 88.250.204.12 88.250.226.26 +88.250.240.245 88.250.254.90 89.122.183.130 89.136.197.170 89.22.152.244 +89.248.112.202 89.29.213.33 89.40.85.166 8poieq.bn.files.1drv.com @@ -1957,7 +1961,6 @@ accesslinksgroup.com aceeprc.com.aceeprc.com acellr.co.uk acteon.com.ar -activecost.com.au addahealingmusic.com adithimedia.com adithimedia.memengers.com @@ -2018,11 +2021,14 @@ aps-sv.com artedibujoyarquitectura.com arwenyapi.com ask-regard.call-save.biz +asucssa.live atfile.com athenacapsg.com +atlasconcreteworks.com attach.66rpg.com atteuqpotentialunlimited.com augustair.com +aulist.com automaticrefreshments.com avadhanagames.com ayahuascasp.com.br @@ -2038,6 +2044,7 @@ bangladeshunbound.com bary.sz4h.com bash.givemexyz.in bausch.kr-atlas.monaxikoslykos@zytrox.tk +bavhome.com bbia.co.uk bcmt.elin.co.za bcrg.co.za @@ -2089,7 +2096,6 @@ browardinsurancemiami.solucioneslink.com bt2.elin.co.za btdapi.robotake.com buigiaphat.com.vn -bulkyfoodja.com bullseyemedia.in busandvanrentalmalaysia.com buscascolegios.diit.cl @@ -2103,11 +2109,8 @@ cacaoprojects.com calgaryautorepairservice.com callbury.in camminachetipassa.it -canadianwork.cc capitalgroup-kw.com capoeiraventrelivre.com -carlsbadre.com -carsidecor.com cashyinvestment.org catchperch.com catchpoolshetlands.co.uk @@ -2144,7 +2147,6 @@ colinde.pricesne.com colorpak.pl columbia.aula-web.net community.reimclub.com -comosairdoburaco.com.br competancy.indigoconsult.net conceptimagine.ro config.cqhbkjzx.com @@ -2153,12 +2155,14 @@ constructoralyon.com consulateins.solucioneslink.com contributeindustry.com copelandscapes.com +corwin-tommie06f.ru.com coulsongraphics.com count.mail.163.com.impactmedfoundation.com covid19.cyberschool.or.id cpanel.shivay.net cr-sq.com craftech.nxtnet.ga +crearechile.cl creationskateboards.com crecerco.com crittersbythebay.com @@ -2168,6 +2172,7 @@ crmroche.manivelasst.com crscorretordeimoveis.com.br cse-engineer.com csnserver.com +ctracknxt.in cubescargoexpress.com curasoles.co.za currantmedia.com @@ -2186,7 +2191,6 @@ datapolish.com dating.khokhas.co.za datsom.vn davethompson.me.uk -davidmcguinness.info dayspringdaisies.com dd.qiyuea.cn ddns.cyberium.cc @@ -2220,14 +2224,11 @@ dl.198424.com dl.installcdn-aws.com dl.packetstormsecurity.net dl.rina-roleplay.com -dnn.alibuf.com -dns.alibuf.com dockerupdate.anondns.net docman.orientalservices.in dodsonimaging.com doitunlimited.com dokan.blueberrytec.com -dom-chel74.ru dom.daf.free.fr doncedyhall.com donghobinhminh.com @@ -2237,6 +2238,7 @@ dosame.com dosman.pl dovberger.com down.pcclear.com +down.udashi.com down.webbora.com down1.arpun.com download.caihong.com @@ -2267,6 +2269,7 @@ e.sldov.ru eandgdesign.com.ng eastsheen-glaziers.co.uk ebruyatkin.com +edu.saicraftsman.com eedo.ee efficientegroup.com elbauldenora.com @@ -2281,8 +2284,8 @@ erp.nanotechproautocare.com erp.zilymax.com escola.probommar.org.br esnconsultants.com -esrhf04.top essentia.org.br +estjh05.top ethereality.info eubanks7.com europeanzonexxi.com @@ -2351,9 +2354,11 @@ goldcoastoffice365.com goldcoastoffice365.com.au golden-memories-funerals.yourpageserver.com goldenasiacapital.com +goldmen.in gpotecnosystems.com gracejukes.com grupoinmare.com +gruposelt.000webhostapp.com gs.monerorx.com guide-to-cell-phones.com gulfac-house.com @@ -2381,6 +2386,7 @@ hitstation.nl hmpmall.co.kr hoagietesting10.com hoayeuthuong-my.sharepoint.com +holmesservices.mobiledevsite.co homefindersolutions.com hongluosi.com hookedupboatclub.com @@ -2393,6 +2399,7 @@ hsmwebapp.com htownbars.com hubtech.co.za huellacero.cl +hunchomusichub.com hunggiang.vn husamiyahschool.com iabmixx2020.rayadigital.online @@ -2444,7 +2451,6 @@ jathra.co.uk jay.diamondrelationscrm.us jebs.net.au jeffdahlke.com -jhayesconsulting.com jiaoyuzixun.cn jing-da.com.tw jmtc.91756.cn @@ -2458,7 +2464,6 @@ jumpmanualjacobhiller.com jupiter.toxsl.in justinscott.com.au kadigital.co.uk -kaizenjanitorial.com kalawatihomes.com kalogirosfinance.com kaptaanchapal.com @@ -2469,17 +2474,15 @@ kensingtondriving.com ketofitnessexpert.com kevinjewelry.com.co keywatch.yourpageserver.com -khmerosja.net kingssa.co.za kizitox.ga kjcpromo.com -kldatabase.com kleinendeli.co.za korrectconceptservices.com krisbadminton.com ktb.sch.id kubatoglubaklava.com.tr -kullumanalitours.com +kumaralok.in kwanfromhongkong.com kz.sldov.ru lacasadelosalebrijes.com @@ -2488,7 +2491,6 @@ lameguard.ru laodongnhat.vn laravel.pointersoftwares.com.br lasermobilesounds.co.uk -laura9630fr.com lauratomismith.com lautarosanmiguel.com lawforall.edu.lk @@ -2590,14 +2592,12 @@ mis.nbcc.ac.th misterson.com mkontakt.az mktf.mx -mmdx.com mmogollon.com.mx mncarteam.com modelhouseturkey.com modernmanna.org monetization.business moninediy.com -mopai.sg motorcomunicacion.com moumitas.com msacontabil.com.br @@ -2616,7 +2616,7 @@ namnyak.co.ke nap.mgsservers.com navayurveda.in nec-i.com -nellaimasthanbiryani.com +nelitrianggraeni.000webhostapp.com nerve.untergrund.net nettube.com.br networkwheels.co.za @@ -2635,6 +2635,7 @@ nilehouse.co.ug nilinkeji.com nimboohomes.com njtiledesigncenter.com +nmxwllwsdyminoragenw.dns.army nobius.org nocalnoodle.elin.co.za nomadicbees.com @@ -2648,6 +2649,7 @@ nyasabigbullets.com nyeh2o.com.au obseques-conseils.com oecteam.com +ohe.ie ohsewgorgeous.co.uk oknoplastik.sk oleholeh.memangbeda.website @@ -2680,6 +2682,7 @@ pacwebdesigns.com pagos.krayem.com.mx palbas.cl palochusvet.szm.com +panslimiterd.com parallel.rockvideos.at parejasfelices.mi-fs.com parkhussion.com @@ -2710,6 +2713,7 @@ pink99.com plasfan.ind.br playground2.grupoaliadasca.com pmglance.startwriteup.com +pmrimewsdylimtewsogh.dns.army pokojewewladyslawowie.pl pole.com.vc pool.phxdir.com @@ -2723,7 +2727,6 @@ preview2.behalen.com prishaartcreations.com production.sparshims.com programaoperadoronline.com.br -project.exquitec.com promotoradescomplica.com.br promoversdubai.com propertiq.elin.co.za @@ -2733,7 +2736,6 @@ prosupport.cl prosyarmakassar.com provence.elin.co.za prox.realunix.cc -prueba.danielluza.com pujashoppe.in punchdialogues.com punjabdevelopersassociation.com.pk @@ -2748,7 +2750,6 @@ radioafifense.deploys.live rainbowisp.info rajeshtailang.com rakeshkhatri.in -raodigitalmedia.com raquelhelena.com.br rarlabarchiver.ac rasadbar.ir @@ -2762,7 +2763,6 @@ readwrite26.nl readymmade.com recyclethesurplus.com redbats.co.in -redboxmultimedia.com redchillicrackers.com reifenquick.de relaxindulge.co.nz @@ -2846,7 +2846,6 @@ shopsofe.com sibernetix.fr sigapresschennai.com sige.brisainformatica.com.br -signatureads.co.in siili.net simoneporzi.it simorsint.com @@ -2882,7 +2881,6 @@ spent.com.pl spetsesyachtcharter.gr spititourism.com spittinfire.com -springbedspetroleum.com src1.minibai.com sreenivasapaintingworks.com sriglobalit.com @@ -2924,12 +2922,12 @@ tafsantoursandtravels.com tajushariya.com tallyinvoicecustomization.com taltus.co.uk -tapalkoedacoffee.com tarravalleyfoods.com.au tavo.cl tc.snpsresidential.com tcy.198424.com tdsp.yngw518.com +tech332.synology.me techgms.com teduae.com teleargentina.com @@ -2968,6 +2966,7 @@ themansionkasauli.com theprofinn.com thesummitpc.net theurbantutors.com +theviewsdyjupcazfeqv.dns.army thosewebbs.com thriveink.com tianangdep.com @@ -2985,6 +2984,7 @@ topcell9.com toplevel.com.br topmask.co.za torresquinterocorp.com +towme.services toyotacollege.ac.th tpke.hu translaterjemah.com @@ -3008,8 +3008,7 @@ ultimate-24.de umwelt-kirchhof.de unicorpbrunei.com uniengrisb.com -unisoftcc.com -unityindiversity.in +unitedwsdykesokowskg.dns.army unyazitelecom.com upcbpta.com urbantrapfest.cl @@ -3017,6 +3016,7 @@ used-jeans.fr useformoney.000webhostapp.com uss.ac.th uzzepay.com.br +v2consultores.com vanzare.cabanabrazi2.ro vbcargo.hu vcah.co.uk @@ -3076,11 +3076,14 @@ wolfgang-brodte.de woodsytech.com wordpress.saleensuporte.com.br workingsolutionsrome.org -wozata.000webhostapp.com wp.readhere.in wpdemo.101clients.com.au writtendeer.com ws5588.f3322.net +wsdyalgreenkelveskxz.dns.army +wsdykungsb2talenwsjf.dns.army +wsdyrkkrgorgiousejhd.dns.army +wsdysara1investvwsfs.dns.army wsdysuresbonescagegp.dns.army wyklej.pl x2vn.com diff --git a/urlhaus-filter-domains.txt b/urlhaus-filter-domains.txt index ada1ce69..f38621d6 100644 --- a/urlhaus-filter-domains.txt +++ b/urlhaus-filter-domains.txt @@ -1,5 +1,5 @@ # Title: Malicious Domains Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -7235,6 +7235,7 @@ 104.248.45.10 104.248.46.116 104.248.47.15 +104.248.48.18 104.248.49.76 104.248.5.108 104.248.5.19 @@ -8844,6 +8845,7 @@ 107.173.222.122 107.173.222.123 107.173.222.153 +107.173.23.240 107.173.24.139 107.173.24.14 107.173.24.145 @@ -44051,6 +44053,7 @@ 115.53.254.154 115.53.254.163 115.53.254.17 +115.53.254.187 115.53.254.192 115.53.254.217 115.53.254.218 @@ -131883,6 +131886,7 @@ 119.123.216.171 119.123.216.178 119.123.216.184 +119.123.216.19 119.123.216.206 119.123.216.208 119.123.216.218 @@ -155791,6 +155795,7 @@ 123.4.251.84 123.4.252.12 123.4.252.120 +123.4.252.144 123.4.252.159 123.4.252.170 123.4.252.19 @@ -161127,6 +161132,7 @@ 123.9.193.144 123.9.193.152 123.9.193.154 +123.9.193.157 123.9.193.164 123.9.193.168 123.9.193.179 @@ -162513,6 +162519,7 @@ 123moviesfx.com 123sellfast.com 123sex.co +123tadi.com 123xyz.xyz 124.100.74.153 124.105.105.222 @@ -164892,6 +164899,7 @@ 124.40.246.95 124.43.216.1 124.45.136.224 +124.5.112.43 124.5.203.86 124.5.24.59 124.5.28.41 @@ -184022,6 +184030,7 @@ 125.99.220.27 125.99.221.206 125.99.222.152 +125.99.222.170 125.99.222.2 125.99.222.245 125.99.222.76 @@ -187647,6 +187656,7 @@ 14.42.155.140 14.42.206.204 14.42.229.214 +14.42.237.237 14.42.48.241 14.42.53.134 14.42.80.24 @@ -195359,6 +195369,7 @@ 172.105.247.88 172.105.36.168 172.105.61.165 +172.105.68.51 172.105.69.5 172.105.70.225 172.105.79.99 @@ -198091,6 +198102,7 @@ 172.93.162.253 172.93.165.221 172.93.176.137 +172.93.176.142 172.93.184.161 172.93.184.71 172.93.187.131 @@ -202464,6 +202476,7 @@ 178.169.165.90 178.169.68.162 178.17.170.28 +178.17.171.144 178.17.174.43 178.170.117.50 178.170.117.8 @@ -202485,6 +202498,7 @@ 178.175.0.125 178.175.0.129 178.175.0.140 +178.175.0.143 178.175.0.144 178.175.0.146 178.175.0.149 @@ -202728,6 +202742,7 @@ 178.175.10.6 178.175.10.66 178.175.10.71 +178.175.10.76 178.175.10.78 178.175.10.8 178.175.10.85 @@ -203124,6 +203139,7 @@ 178.175.103.45 178.175.103.48 178.175.103.50 +178.175.103.52 178.175.103.54 178.175.103.58 178.175.103.61 @@ -203247,6 +203263,7 @@ 178.175.104.62 178.175.104.64 178.175.104.66 +178.175.104.67 178.175.104.69 178.175.104.80 178.175.104.85 @@ -203587,6 +203604,7 @@ 178.175.107.68 178.175.107.7 178.175.107.70 +178.175.107.71 178.175.107.75 178.175.107.76 178.175.107.78 @@ -204381,6 +204399,7 @@ 178.175.114.138 178.175.114.142 178.175.114.145 +178.175.114.146 178.175.114.15 178.175.114.151 178.175.114.152 @@ -204637,6 +204656,7 @@ 178.175.116.195 178.175.116.196 178.175.116.197 +178.175.116.20 178.175.116.200 178.175.116.201 178.175.116.207 @@ -205987,6 +206007,7 @@ 178.175.127.216 178.175.127.217 178.175.127.219 +178.175.127.223 178.175.127.224 178.175.127.225 178.175.127.228 @@ -206145,6 +206166,7 @@ 178.175.14.152 178.175.14.153 178.175.14.154 +178.175.14.155 178.175.14.156 178.175.14.157 178.175.14.16 @@ -206539,6 +206561,7 @@ 178.175.18.202 178.175.18.203 178.175.18.205 +178.175.18.214 178.175.18.215 178.175.18.219 178.175.18.22 @@ -206595,6 +206618,7 @@ 178.175.19.150 178.175.19.157 178.175.19.158 +178.175.19.160 178.175.19.162 178.175.19.163 178.175.19.165 @@ -206948,6 +206972,7 @@ 178.175.21.38 178.175.21.39 178.175.21.40 +178.175.21.41 178.175.21.42 178.175.21.44 178.175.21.53 @@ -206974,6 +206999,7 @@ 178.175.22.116 178.175.22.117 178.175.22.118 +178.175.22.120 178.175.22.125 178.175.22.129 178.175.22.13 @@ -207847,6 +207873,7 @@ 178.175.3.80 178.175.3.81 178.175.3.85 +178.175.3.86 178.175.3.87 178.175.3.94 178.175.3.98 @@ -208090,6 +208117,7 @@ 178.175.32.183 178.175.32.184 178.175.32.185 +178.175.32.186 178.175.32.190 178.175.32.196 178.175.32.197 @@ -208227,6 +208255,7 @@ 178.175.33.26 178.175.33.28 178.175.33.30 +178.175.33.32 178.175.33.38 178.175.33.40 178.175.33.50 @@ -209038,6 +209067,7 @@ 178.175.40.203 178.175.40.204 178.175.40.205 +178.175.40.209 178.175.40.211 178.175.40.218 178.175.40.221 @@ -209248,6 +209278,7 @@ 178.175.42.42 178.175.42.44 178.175.42.45 +178.175.42.46 178.175.42.48 178.175.42.53 178.175.42.55 @@ -209766,6 +209797,7 @@ 178.175.47.217 178.175.47.218 178.175.47.22 +178.175.47.220 178.175.47.222 178.175.47.224 178.175.47.226 @@ -209903,6 +209935,7 @@ 178.175.48.6 178.175.48.65 178.175.48.66 +178.175.48.67 178.175.48.71 178.175.48.76 178.175.48.80 @@ -210181,6 +210214,7 @@ 178.175.50.47 178.175.50.48 178.175.50.50 +178.175.50.54 178.175.50.55 178.175.50.57 178.175.50.58 @@ -210792,6 +210826,7 @@ 178.175.56.57 178.175.56.6 178.175.56.61 +178.175.56.64 178.175.56.66 178.175.56.67 178.175.56.69 @@ -210859,6 +210894,7 @@ 178.175.57.192 178.175.57.20 178.175.57.203 +178.175.57.204 178.175.57.206 178.175.57.209 178.175.57.210 @@ -211742,6 +211778,7 @@ 178.175.65.181 178.175.65.184 178.175.65.186 +178.175.65.189 178.175.65.19 178.175.65.192 178.175.65.193 @@ -212228,6 +212265,7 @@ 178.175.69.73 178.175.69.74 178.175.69.77 +178.175.69.79 178.175.69.8 178.175.69.82 178.175.69.83 @@ -213313,6 +213351,7 @@ 178.175.79.188 178.175.79.189 178.175.79.196 +178.175.79.198 178.175.79.199 178.175.79.200 178.175.79.204 @@ -213623,6 +213662,7 @@ 178.175.81.232 178.175.81.235 178.175.81.236 +178.175.81.240 178.175.81.241 178.175.81.244 178.175.81.246 @@ -214123,6 +214163,7 @@ 178.175.86.106 178.175.86.108 178.175.86.11 +178.175.86.117 178.175.86.119 178.175.86.12 178.175.86.122 @@ -214148,6 +214189,7 @@ 178.175.86.181 178.175.86.182 178.175.86.183 +178.175.86.184 178.175.86.187 178.175.86.188 178.175.86.191 @@ -214424,6 +214466,7 @@ 178.175.88.8 178.175.88.83 178.175.88.84 +178.175.88.85 178.175.88.95 178.175.89.0 178.175.89.10 @@ -214824,6 +214867,7 @@ 178.175.92.1 178.175.92.100 178.175.92.102 +178.175.92.105 178.175.92.106 178.175.92.108 178.175.92.109 @@ -215169,6 +215213,7 @@ 178.175.95.102 178.175.95.103 178.175.95.104 +178.175.95.105 178.175.95.111 178.175.95.112 178.175.95.114 @@ -215362,6 +215407,7 @@ 178.175.96.82 178.175.96.87 178.175.96.88 +178.175.96.93 178.175.96.95 178.175.96.96 178.175.96.97 @@ -215616,6 +215662,7 @@ 178.175.99.207 178.175.99.208 178.175.99.209 +178.175.99.21 178.175.99.214 178.175.99.216 178.175.99.22 @@ -218635,6 +218682,7 @@ 182.112.173.245 182.112.173.8 182.112.176.47 +182.112.177.134 182.112.177.215 182.112.177.93 182.112.178.167 @@ -261159,6 +261207,7 @@ 183.83.0.112 183.83.0.192 183.83.0.230 +183.83.1.1 183.83.1.221 183.83.1.234 183.83.1.239 @@ -261271,6 +261320,7 @@ 183.83.13.17 183.83.13.69 183.83.13.95 +183.83.14.20 183.83.14.3 183.83.14.35 183.83.14.70 @@ -263187,6 +263237,7 @@ 185.8.202.254 185.8.232.145 185.80.92.4 +185.81.154.208 185.81.157.124 185.81.157.186 185.81.98.78 @@ -272154,6 +272205,7 @@ 201.171.185.92 201.171.204.13 201.171.227.59 +201.171.40.215 201.171.84.139 201.175.63.186 201.182.144.193 @@ -279093,6 +279145,7 @@ 213.183.63.124 213.183.63.242 213.186.35.153 +213.186.69.101 213.189.178.163 213.195.111.72 213.200.133.18 @@ -279380,6 +279433,7 @@ 216.180.117.96 216.180.117.98 216.183.54.169 +216.183.54.196 216.189.145.11 216.189.177.221 216.189.184.23 @@ -279579,6 +279633,7 @@ 217.12.199.179 217.12.208.14 217.12.209.74 +217.12.209.82 217.12.210.156 217.12.210.209 217.12.221.244 @@ -284073,6 +284128,7 @@ 219.155.234.12 219.155.234.155 219.155.234.218 +219.155.234.33 219.155.235.100 219.155.235.145 219.155.235.154 @@ -291595,6 +291651,7 @@ 220.81.201.7 220.81.229.175 220.81.30.193 +220.81.44.181 220.81.44.92 220.82.140.17 220.82.182.150 @@ -299540,6 +299597,7 @@ 222.137.132.49 222.137.133.110 222.137.133.120 +222.137.133.125 222.137.133.195 222.137.133.212 222.137.133.244 @@ -309766,6 +309824,7 @@ 222.142.210.122 222.142.210.136 222.142.210.138 +222.142.210.144 222.142.210.146 222.142.210.155 222.142.210.163 @@ -311692,6 +311751,7 @@ 23.95.11.48 23.95.116.135 23.95.116.144 +23.95.122.24 23.95.122.47 23.95.13.131 23.95.13.158 @@ -325790,6 +325850,7 @@ 27.5.39.115 27.5.39.121 27.5.39.122 +27.5.39.124 27.5.39.127 27.5.39.128 27.5.39.140 @@ -334728,6 +334789,7 @@ 27.6.254.187 27.6.254.232 27.6.254.89 +27.6.255.101 27.6.255.107 27.6.255.121 27.6.255.160 @@ -355793,6 +355855,7 @@ 42.2.137.29 42.202.100.135 42.202.100.233 +42.202.101.118 42.202.101.133 42.202.101.136 42.202.101.138 @@ -357199,6 +357262,7 @@ 42.224.158.181 42.224.158.206 42.224.158.208 +42.224.158.22 42.224.158.227 42.224.158.231 42.224.158.234 @@ -360151,6 +360215,7 @@ 42.224.51.213 42.224.51.222 42.224.51.223 +42.224.51.229 42.224.51.23 42.224.51.239 42.224.51.75 @@ -379290,6 +379355,7 @@ 42.236.212.147 42.236.212.154 42.236.212.155 +42.236.212.157 42.236.212.158 42.236.212.159 42.236.212.167 @@ -388820,6 +388886,7 @@ 4ele.pl 4ertybhdfrt.gq 4esports.de +4et3ja.am.files.1drv.com 4evakleen.com.au 4eventfacilities.nl 4evernails.nl @@ -397354,6 +397421,7 @@ 59.25.9.121 59.25.9.126 59.26.12.115 +59.26.181.228 59.26.20.177 59.26.209.230 59.26.214.148 @@ -433128,6 +433196,7 @@ 6481254.ru 649924.nchsoftwarecom.com 64x9bg.ch.files.1drv.com +65.0.168.152 65.0.173.107 65.0.179.146 65.0.55.192 @@ -433173,6 +433242,8 @@ 65k2.com 66-gifts.com 66.103.9.249 +66.108.199.144 +66.109.135.129 66.11.110.27 66.11.125.94 66.110.228.60 @@ -437959,6 +438030,7 @@ 88.218.16.87 88.218.16.9 88.218.17.109 +88.218.17.110 88.218.17.119 88.218.17.149 88.218.17.179 @@ -438525,6 +438597,7 @@ 89.239.96.164 89.244.238.226 89.245.110.35 +89.248.112.202 89.248.166.171 89.248.166.183 89.248.167.133 @@ -441334,6 +441407,7 @@ 999.buzz 999.co.id 999.rajaojek.com +999080321newfolder1002002131-service1002.space 999102com.cn 99bkx.com 99centsdigitals.com @@ -443521,6 +443595,7 @@ ahiraatfashion.com ahiskatv.net ahitekniktarti.com ahiyangrup.com.tr +ahjianlong.cf ahjuric.si ahk.smu8street.ru ahkha.com @@ -443945,6 +444020,7 @@ akito.be akivj07.top akktis.com akkurtmadencilik.com +aklatdelmundo.com akleigh.com aklin.ir aklocalshop.com @@ -444657,7 +444733,6 @@ alladinonlinee.com allainesconsultancyinc.com allamanolibrary.com allan-it.com -allanabolicsteam.net allanelect.co.uk allangillphotography.com allanhollowell.com @@ -444931,6 +445006,7 @@ alona.org.cy aloneintheweb.com aloneskisehir.com alongthelines.com +alongwalker.com alonhadat24h.vn alooshop.ir aloravan.com @@ -445689,7 +445765,6 @@ an9news.com ana.plecko.eu anaaj.pk anabim.com -anabolicsteroidsbuy.info anaceb.com anadearmas.net anadelgbt.org @@ -449662,7 +449737,6 @@ b94yhzk.com b97pm6.com ba3capital.com baacsetu.org -baadababada.ru baaders-namibia.com baakcafe.com baamiraan.ir @@ -449784,7 +449858,6 @@ backup.utlitslaekning.is backup.xn----8sba7bmrlhv0a.xn--p1ai backup2.robinandelaine.com backupcom.e-twow.uk -backupez.com backupfashions.com backupsitedev.flywheelsites.com backupsql.datasiswebcontable.com @@ -451167,7 +451240,6 @@ belayadver.com belaythakayni.com belboks.com belboy.in -belcineloweek.ru belconger.com belcorpisl.com belcvet.com @@ -453726,7 +453798,6 @@ bobbyterry.top bobbyworld.top bobcar.com.my bobcatofchico.com -bobcatofredding.com bobcook.ca bobdolph.com bobenstetter.net @@ -454978,7 +455049,6 @@ bucketlistrecipes.com bucketstrong.s3-us-west-1.amazonaws.com buckeyechartershiltonhead.com buckeyeoptical.com -buckeyesecurity.net buckinghamandlloyds.com buckleman.co.id bucklindata.net @@ -455067,6 +455137,7 @@ buildchem.pk buildcraftindia.com buildentconstructions.com builder.acasia.mx +builder.makemoneywith.website buildersmerchantsfederation-my.sharepoint.com buildgreenindustries.com building-company.lt @@ -455610,7 +455681,6 @@ c.mymortgagegenius.ca c.oooooooooo.ga c.pieshua.com c.teamworx.ph -c.top4top.io c.top4top.net c.vivi.casa c.vollar.ga @@ -456282,6 +456352,7 @@ capitalnewsagency.com capitalonefinanceltd.in capitalpellets.com capitalpremiumfinancinginc.com +capitalprint.co.za capitalprivateasset.com capitalrealestate.us capitalrh.com.br @@ -461122,6 +461193,7 @@ covid19.peaceforchildren.net covid19map.digital covid19quarantin.com covid19safety.myftp.org +covid19vaccinations.hopto.org covid19vaccine.hopto.org covid2023.info covidbase.info @@ -462480,6 +462552,7 @@ dacle.eu daclim.ro daco-precision.thomaswebs.net daco.nyccomputerconsulting.com +dacsancaonguyen.vn dactridaudaday.com dactyltech.co.za dacviadokese.com @@ -471124,6 +471197,7 @@ estiloraropremium.com.br estimating.training estimatorfind.com estimetercume.com +estjh05.top estore.qurvex.com estoyadieta.com estrategias-corporativas.com @@ -471299,7 +471373,6 @@ etwqsx23.duckdns.org etxse.xyz etysu02scnabr03wzaxue.com eu-easy.com -eu.wildfire.paloaltonetworks.com eu1.salesforce.com eu283iwoqodjspqisjdf.com eu5-cdn.devid.info @@ -473443,7 +473516,6 @@ files.danwin1210.me files.dropmybin.me files.enjin.com files.gathercdn.com -files.hrloo.com files.l-d.tech files.martellexpress.us files.mirai-2viv.vn @@ -475176,6 +475248,7 @@ friendsstarintl.com friendzonecafe.com frietfun.be frigolutasima.net +frigoprehrana.com frigoriferivignola.it frigotechniek.be frigsales.com @@ -475657,7 +475730,6 @@ fuzzymiles.com fv1-2.failiem.lv fv13.failiem.lv fv15.failiem.lv -fv2-2.failiem.lv fv2-7.failiem.lv fv3.failiem.lv fv6.failiem.lv @@ -475735,7 +475807,6 @@ g0ogle.free.fr g0zh8lb3.com g15aocbenedict.com g1ba4tt4ngq5nl7w.xyz -g1smurt.ru g20digital.com.br g237.cn g2creditsolutions.com @@ -475823,9 +475894,6 @@ gadanie-lidia.ru gadaniya-magiya.site gadcoafrica.com gaddco.com -gade4senate.com -gadebrigade.com -gadeforussenate.com gadem.ug gadesoluciones.pe gadget-plaza.ru @@ -477973,6 +478041,7 @@ gomiles.vn gomitra.com gomovies.cl gomsubattrangxuatkhau.com +gomsuminhlongthainguyen.vn gomus.com.br gomyfiles.info gomypass.com @@ -479471,7 +479540,6 @@ h-w-c.net h.epelcdn.com h.eurotrading.com.pl h.j990981.ru -h.top4top.io h.valerana44.ru h002295863.nichost.ru h0h.org @@ -481701,7 +481769,6 @@ home-spy-shop.com home.99eurowebsite.ie home.barley-plus.com home.dawang.ink -home.earthlink.net home.evrstudio.com home.healthiestu.com home.isdes.com @@ -482071,6 +482138,7 @@ hosteriapuestadelsol.com hostfleek.com hostgo.com.br hostile-gaming.fr +hostimpel.com hosting-c.iuro.nl hosting.drupwayinfotech.in hosting.mrsofttech.com @@ -488527,6 +488595,7 @@ kabek.vn kabelinieseti.ru kabiguru.org kabiledans.com +kabimmo.com kabinarf.ru kabiru.ru kabiryogashramlimbdi.com @@ -489944,7 +490013,6 @@ killu.in kilnrefractory.com kilolo.site kilop.goodvibeskickin.com -kilopaskal.ru kimaco.com kimberly.digital kimberly5esthetique.com @@ -490276,7 +490344,6 @@ klasterpolskanatura.pl klaus-moersch.de klausnerlaw.com klaussen.net -klaustrofebia.ru klavze28.com klbay.net kldatabase.com @@ -493178,6 +493245,7 @@ library.arihantmbainstitute.ac.in library.cifor.org library.dhl-xom.com library.iainbengkulu.ac.id +library.mju.ac.th library.phibi.my.id library.piet.co.in library.strophicmusic.com @@ -494950,7 +495018,6 @@ luminousinvestment.com luminouspla.net luminouspneuma.com lumnus.com.br -lumoura.com lumperpush.com lumsdancorp.com lun.otrweb.ru @@ -495112,6 +495179,7 @@ lyhnb.club lykangblog.com lykusglobal.com lylevr.com +lyllacarter.com lylydressforless.com lymcomercial.cl lymfodrenaze.eu @@ -498268,6 +498336,7 @@ medicina.uanl.mx medicinadellavoromb.it medicinaesteticaorlandini.it medicinageriatrica.com.br +medicinainterna-critica.com medicinaonline.rjsrwaco.watchdogdns.duckdns.org medicine.softberg.ro mediclaim.odhavnidhi.org @@ -501438,6 +501507,7 @@ mtbplus.de mtcinteriordesign.co.uk mtcr.co.za mtcuadrado.com +mtdc.com.my mte1.cn mtechagency.com mteestore.com @@ -502134,7 +502204,6 @@ myhygienemart.com myimmigrationlawmarketingpartner.com myimmogroup.be myinfoart.online -myinstabuzzz.co myinstantguru.com myinternetjobs.com myintromationsz.win @@ -502160,6 +502229,7 @@ mylifestoryfilm.com mylinkguard.com mylistbuildingtraffic.com mylisting.martinface.com +myliverpoolnews.cf myloanbaazar.com myloanexpert.in mylocal.dk @@ -503749,6 +503819,7 @@ news.iid-mit.com.tw news.intertours.org.rs news.leta.com.vn news.lwinmoenaing.me +news.makemoneywith.website news.medicaid.ir news.omumusic.net news.palette69.com @@ -504532,6 +504603,7 @@ nms.evertechit.live nmsk.online nmsr.info nmvconstructions.com +nmxwllwsdyminoragenw.dns.army nn-webdesign.be nn.5ctelematics.com nnasout.com @@ -505312,7 +505384,6 @@ nvdvdgp.com nvdweb.azurewebsites.net nveeusa.com nvelj12qyyfi03kqxy.xyz -nvgeeforsegt.ru nvgp.com.au nvi.edu.vn nvl.netsmartz.net @@ -506530,7 +506601,6 @@ onlusarcadia.it only4atalg.ml onlyapteka.ru onlyart.in -onlybamboofabrics.com onlycane.in onlychild.org onlycocktaildresses.com @@ -508520,6 +508590,7 @@ payyosafoolayzp.com pazarcheto.com pazargezer.com pazcomau-my.sharepoint.com +pazpus.com pb-xt.com pb.divaasolutions.com pb128o6c2favwk.com @@ -510265,6 +510336,7 @@ pmrimesndylimtdvensn.dns.army pmrimestdylimtdvenst.dns.army pmrimestdylimtdvests.dns.army pmrimestdylimtstwork.dns.army +pmrimewsdylimtewsogh.dns.army pmrimewsdylimtwswods.dns.army pms.stercomagento.com pmsports.de @@ -511983,6 +512055,7 @@ prostranstvorosta.ru prosupport.cl prosvyaz.kz prosyarmakassar.com +prosystemsug.com prosysvinorosso.com prot.drupal8.softikom.lv protaciohospital.com @@ -511993,7 +512066,6 @@ protech.binarybizz.com protech.mn protechcarpetcare.com protechgroup1.com -protect.mimecast-offshore.com protectiadatelor.biz protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org protection.pecol.eu @@ -513193,6 +513265,7 @@ quatanggmt.com quatanghoanglong.com quatangluuniemhue.com quatangtaynguyen.com +quatangtaynguyen.vn quatest.sixstarsent.com quatet365.com quatram.de @@ -513258,6 +513331,7 @@ quickbook.online quickbookstechnicalsupportphonenumber.com quickboooks.host quickboooks.space +quickcompanyreg.co.za quickfingers.net quickinsolutions.com quicklifecare.com @@ -515859,7 +515933,6 @@ roads.stamperinc.org roadscompass.com roadtravelcars.com roanokecellphonerepair.com -roanokemortgages.com roastedguarmeal.com roba.nu robaitec.com @@ -518232,6 +518305,7 @@ savannaopticalsgh.com savasaachi.systems savaspark.com.tr save-room.info +save.makemoneywith.website save24x7.com saveanimal.org savecannabis.org @@ -521892,6 +521966,7 @@ slrent.com slrpros.com sls-eg.com sls-security.ru +slsbearings.com.sg slservicebd.com slubnefury.pl slugard.5gbfree.com @@ -523824,7 +523899,6 @@ srmfiresafety.com srnirob.com srno.hu sromano.it -sromecorlduce.ru sroomf70nasiru.duckdns.org srooooiva.ru srpresse.fr @@ -525656,7 +525730,6 @@ sunfloro.com sunflowerschoolandcollege.com sunfruit.com.tn sunganak.in -sungardspo.com sungazer.com.au sunglasses2020.com sungvalopkhongsam.com @@ -529056,6 +529129,7 @@ thefoxfestival.com thefragrancefreeshop.com thefranssons.com thefreelancerschool.com +thefrees.com thefreewaterfoundation.org.za thefront.in thefuel.be @@ -529640,6 +529714,7 @@ theviestdyjupcafgcms.dns.army theviestdyjupcafgmcn.dns.army theviestdyjupcafgsvb.dns.army theviestdyjupcazfest.dns.navy +theviewsdyjupcazfeqv.dns.army theviewsdyjupcazwsgv.dns.army thevilla46.com thevine-organizasyon.com @@ -530143,6 +530218,7 @@ timelyent.com timelyrain.top timenard.top timenotbesea.xyz +timenow.pw timenowis1.top timeoffer.site timeofvape.tk @@ -531908,7 +531984,6 @@ trusticar.lt trustinspect.com trustlancers.com trustorbit.com -trustpilot-scam.com trustpropertyholdings.com trustrambusinesssolutions.com trustrobins.info @@ -531955,6 +532030,7 @@ ts-deals.me ts.7rb.xyz ts0ev73.com tsal.com +tsapparel.com.my tsareva-garden.ru tsatsi.co.za tsauctions.com @@ -532516,7 +532592,6 @@ u0649681.cp.regruhosting.ru u0707115.cp.regruhosting.ru u0746219.cp.regruhosting.ru u0774849.cp.regruhosting.ru -u1.huatu.com u1.innerpeer.com u11123p7833.web0104.zxcs.nl u1141p8807.web0103.zxcs.nl @@ -533259,6 +533334,7 @@ unitedworks.info unitedwsdy5defenceforgorvermentsocialeme.duckdns.org unitedwsdykesokowsbv.dns.army unitedwsdykesokowsgs.dns.army +unitedwsdykesokowskg.dns.army unitedwsdykesokowsku.dns.army unitedwsdykesokowsri.dns.navy unitedyfl.com @@ -533659,7 +533735,6 @@ url5459.41southbar.com url675.textilmallorca.com url9823.ville.labrecque.qc.ca urlac.de -urldefense.us urleddrug.at urlfrance.fr urlm.ir @@ -533786,7 +533861,6 @@ uspeshnybusiness.ru uspslabel.itemdb.com uss.ac.th uss21.com -ussbd.net usselfstoragenetwork.com ussrback.com ussrgun.000webhostapp.com @@ -533901,6 +533975,7 @@ uy-akwaibom.ru uyaiblog.com uycqawua.applekid.cn uydu.antalyaelektrikariza.net +uyen.vn uyencometics.bmt.city uyencuentra.com uyf.com.ua @@ -538373,7 +538448,6 @@ wotan.info wotehb.com wotsuper.pw wotsuper3.exe -wouatiareves.ru wourionlion.ru woutaalexp.com wouterwolf.com @@ -538594,6 +538668,7 @@ wsdshipping.com wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org wsdyalgreenkeghewsmq.dns.army +wsdyalgreenkelveskxz.dns.army wsdyalhjchfonlinedws.dns.navy wsdyalhjchfonlinwsdf.dns.army wsdyalhjchfonlinwsed.dns.army @@ -538617,10 +538692,12 @@ wsdyclntnjkcloudwsgh.dns.army wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org wsdyibgreenkegheedws.dns.navy wsdyibgreenkeghewsyt.dns.army +wsdyibgreenventureqx.dns.army wsdykalamikonlinedeliverystoreservwspmq.ydns.eu wsdykung38communicationtarisupliermgapc.duckdns.org wsdykungsb2gotchtsub.dns.army wsdykungsb2gotchtwsp.dns.army +wsdykungsb2talenwsjf.dns.army wsdykungsb2talenwsmz.dns.army wsdymsloginvestmwsqd.dns.army wsdymsloginvestmwsrw.dns.army @@ -538633,9 +538710,11 @@ wsdynitengymndynatem.dns.army wsdynitengymndynatin.dns.army wsdypmrimelimtdvenws.dns.army wsdypmrimelimtdvewsd.dns.army +wsdyrkkrgorgiousejhd.dns.army wsdyrkkrsuccessmorev.dns.army wsdyrkkrsuccessmoven.dns.army wsdyrmtcntlfarmtwsvb.dns.army +wsdysara1investvwsfs.dns.army wsdyshgshg2induswsjg.dns.army wsdyshgshgnationalindustrialandgoogledns.duckdns.org wsdyshgshgnationalobjindustrialat23fty.duckdns.org @@ -539682,7 +539761,6 @@ xnjwkaelsf.gq xnk.jbzie.com xnkwintech.com xnxxchannel.com -xnxxfullhd.com xo4z0sl.com xo57.com xoangyduong.com.vn @@ -540231,7 +540309,6 @@ yeu49.com yeu81.com yeu82.com yeuhang.tk -yeumoitruong.vn yeuromndy.cf yeutocviet.com yewonder.com diff --git a/urlhaus-filter-hosts-online.txt b/urlhaus-filter-hosts-online.txt index 48589b3b..9a60e9cc 100644 --- a/urlhaus-filter-hosts-online.txt +++ b/urlhaus-filter-hosts-online.txt @@ -1,5 +1,5 @@ # Title: Online Malicious Hosts Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -10,12 +10,11 @@ 0.0.0.0 14karatvisions.com 0.0.0.0 1am.co.nz 0.0.0.0 21robo.com -0.0.0.0 32792.prolocksmithwinterpark.com 0.0.0.0 360.lcy2zzx.pw 0.0.0.0 360down7.miiyun.cn +0.0.0.0 4et3ja.am.files.1drv.com 0.0.0.0 77st.net 0.0.0.0 8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com -0.0.0.0 87du.vip 0.0.0.0 8poieq.bn.files.1drv.com 0.0.0.0 aatreefelling.co.za 0.0.0.0 abcd.bg @@ -29,7 +28,6 @@ 0.0.0.0 aceeprc.com.aceeprc.com 0.0.0.0 acellr.co.uk 0.0.0.0 acteon.com.ar -0.0.0.0 activecost.com.au 0.0.0.0 addahealingmusic.com 0.0.0.0 adithimedia.com 0.0.0.0 adithimedia.memengers.com @@ -89,11 +87,14 @@ 0.0.0.0 artedibujoyarquitectura.com 0.0.0.0 arwenyapi.com 0.0.0.0 ask-regard.call-save.biz +0.0.0.0 asucssa.live 0.0.0.0 atfile.com 0.0.0.0 athenacapsg.com +0.0.0.0 atlasconcreteworks.com 0.0.0.0 attach.66rpg.com 0.0.0.0 atteuqpotentialunlimited.com 0.0.0.0 augustair.com +0.0.0.0 aulist.com 0.0.0.0 automaticrefreshments.com 0.0.0.0 avadhanagames.com 0.0.0.0 ayahuascasp.com.br @@ -109,6 +110,7 @@ 0.0.0.0 bary.sz4h.com 0.0.0.0 bash.givemexyz.in 0.0.0.0 bausch.kr-atlas.monaxikoslykos@zytrox.tk +0.0.0.0 bavhome.com 0.0.0.0 bbia.co.uk 0.0.0.0 bcmt.elin.co.za 0.0.0.0 bcrg.co.za @@ -160,7 +162,6 @@ 0.0.0.0 bt2.elin.co.za 0.0.0.0 btdapi.robotake.com 0.0.0.0 buigiaphat.com.vn -0.0.0.0 bulkyfoodja.com 0.0.0.0 bullseyemedia.in 0.0.0.0 busandvanrentalmalaysia.com 0.0.0.0 buscascolegios.diit.cl @@ -174,11 +175,8 @@ 0.0.0.0 calgaryautorepairservice.com 0.0.0.0 callbury.in 0.0.0.0 camminachetipassa.it -0.0.0.0 canadianwork.cc 0.0.0.0 capitalgroup-kw.com 0.0.0.0 capoeiraventrelivre.com -0.0.0.0 carlsbadre.com -0.0.0.0 carsidecor.com 0.0.0.0 cashyinvestment.org 0.0.0.0 catchperch.com 0.0.0.0 catchpoolshetlands.co.uk @@ -215,7 +213,6 @@ 0.0.0.0 colorpak.pl 0.0.0.0 columbia.aula-web.net 0.0.0.0 community.reimclub.com -0.0.0.0 comosairdoburaco.com.br 0.0.0.0 competancy.indigoconsult.net 0.0.0.0 conceptimagine.ro 0.0.0.0 config.cqhbkjzx.com @@ -224,12 +221,14 @@ 0.0.0.0 consulateins.solucioneslink.com 0.0.0.0 contributeindustry.com 0.0.0.0 copelandscapes.com +0.0.0.0 corwin-tommie06f.ru.com 0.0.0.0 coulsongraphics.com 0.0.0.0 count.mail.163.com.impactmedfoundation.com 0.0.0.0 covid19.cyberschool.or.id 0.0.0.0 cpanel.shivay.net 0.0.0.0 cr-sq.com 0.0.0.0 craftech.nxtnet.ga +0.0.0.0 crearechile.cl 0.0.0.0 creationskateboards.com 0.0.0.0 crecerco.com 0.0.0.0 crittersbythebay.com @@ -239,6 +238,7 @@ 0.0.0.0 crscorretordeimoveis.com.br 0.0.0.0 cse-engineer.com 0.0.0.0 csnserver.com +0.0.0.0 ctracknxt.in 0.0.0.0 cubescargoexpress.com 0.0.0.0 curasoles.co.za 0.0.0.0 currantmedia.com @@ -257,7 +257,6 @@ 0.0.0.0 dating.khokhas.co.za 0.0.0.0 datsom.vn 0.0.0.0 davethompson.me.uk -0.0.0.0 davidmcguinness.info 0.0.0.0 dayspringdaisies.com 0.0.0.0 dd.qiyuea.cn 0.0.0.0 ddns.cyberium.cc @@ -291,14 +290,11 @@ 0.0.0.0 dl.installcdn-aws.com 0.0.0.0 dl.packetstormsecurity.net 0.0.0.0 dl.rina-roleplay.com -0.0.0.0 dnn.alibuf.com -0.0.0.0 dns.alibuf.com 0.0.0.0 dockerupdate.anondns.net 0.0.0.0 docman.orientalservices.in 0.0.0.0 dodsonimaging.com 0.0.0.0 doitunlimited.com 0.0.0.0 dokan.blueberrytec.com -0.0.0.0 dom-chel74.ru 0.0.0.0 dom.daf.free.fr 0.0.0.0 doncedyhall.com 0.0.0.0 donghobinhminh.com @@ -308,6 +304,7 @@ 0.0.0.0 dosman.pl 0.0.0.0 dovberger.com 0.0.0.0 down.pcclear.com +0.0.0.0 down.udashi.com 0.0.0.0 down.webbora.com 0.0.0.0 down1.arpun.com 0.0.0.0 download.caihong.com @@ -338,6 +335,7 @@ 0.0.0.0 eandgdesign.com.ng 0.0.0.0 eastsheen-glaziers.co.uk 0.0.0.0 ebruyatkin.com +0.0.0.0 edu.saicraftsman.com 0.0.0.0 eedo.ee 0.0.0.0 efficientegroup.com 0.0.0.0 elbauldenora.com @@ -352,8 +350,8 @@ 0.0.0.0 erp.zilymax.com 0.0.0.0 escola.probommar.org.br 0.0.0.0 esnconsultants.com -0.0.0.0 esrhf04.top 0.0.0.0 essentia.org.br +0.0.0.0 estjh05.top 0.0.0.0 ethereality.info 0.0.0.0 eubanks7.com 0.0.0.0 europeanzonexxi.com @@ -422,9 +420,11 @@ 0.0.0.0 goldcoastoffice365.com.au 0.0.0.0 golden-memories-funerals.yourpageserver.com 0.0.0.0 goldenasiacapital.com +0.0.0.0 goldmen.in 0.0.0.0 gpotecnosystems.com 0.0.0.0 gracejukes.com 0.0.0.0 grupoinmare.com +0.0.0.0 gruposelt.000webhostapp.com 0.0.0.0 gs.monerorx.com 0.0.0.0 guide-to-cell-phones.com 0.0.0.0 gulfac-house.com @@ -452,6 +452,7 @@ 0.0.0.0 hmpmall.co.kr 0.0.0.0 hoagietesting10.com 0.0.0.0 hoayeuthuong-my.sharepoint.com +0.0.0.0 holmesservices.mobiledevsite.co 0.0.0.0 homefindersolutions.com 0.0.0.0 hongluosi.com 0.0.0.0 hookedupboatclub.com @@ -464,6 +465,7 @@ 0.0.0.0 htownbars.com 0.0.0.0 hubtech.co.za 0.0.0.0 huellacero.cl +0.0.0.0 hunchomusichub.com 0.0.0.0 hunggiang.vn 0.0.0.0 husamiyahschool.com 0.0.0.0 iabmixx2020.rayadigital.online @@ -515,7 +517,6 @@ 0.0.0.0 jay.diamondrelationscrm.us 0.0.0.0 jebs.net.au 0.0.0.0 jeffdahlke.com -0.0.0.0 jhayesconsulting.com 0.0.0.0 jiaoyuzixun.cn 0.0.0.0 jing-da.com.tw 0.0.0.0 jmtc.91756.cn @@ -529,7 +530,6 @@ 0.0.0.0 jupiter.toxsl.in 0.0.0.0 justinscott.com.au 0.0.0.0 kadigital.co.uk -0.0.0.0 kaizenjanitorial.com 0.0.0.0 kalawatihomes.com 0.0.0.0 kalogirosfinance.com 0.0.0.0 kaptaanchapal.com @@ -540,17 +540,15 @@ 0.0.0.0 ketofitnessexpert.com 0.0.0.0 kevinjewelry.com.co 0.0.0.0 keywatch.yourpageserver.com -0.0.0.0 khmerosja.net 0.0.0.0 kingssa.co.za 0.0.0.0 kizitox.ga 0.0.0.0 kjcpromo.com -0.0.0.0 kldatabase.com 0.0.0.0 kleinendeli.co.za 0.0.0.0 korrectconceptservices.com 0.0.0.0 krisbadminton.com 0.0.0.0 ktb.sch.id 0.0.0.0 kubatoglubaklava.com.tr -0.0.0.0 kullumanalitours.com +0.0.0.0 kumaralok.in 0.0.0.0 kwanfromhongkong.com 0.0.0.0 kz.sldov.ru 0.0.0.0 lacasadelosalebrijes.com @@ -559,7 +557,6 @@ 0.0.0.0 laodongnhat.vn 0.0.0.0 laravel.pointersoftwares.com.br 0.0.0.0 lasermobilesounds.co.uk -0.0.0.0 laura9630fr.com 0.0.0.0 lauratomismith.com 0.0.0.0 lautarosanmiguel.com 0.0.0.0 lawforall.edu.lk @@ -661,14 +658,12 @@ 0.0.0.0 misterson.com 0.0.0.0 mkontakt.az 0.0.0.0 mktf.mx -0.0.0.0 mmdx.com 0.0.0.0 mmogollon.com.mx 0.0.0.0 mncarteam.com 0.0.0.0 modelhouseturkey.com 0.0.0.0 modernmanna.org 0.0.0.0 monetization.business 0.0.0.0 moninediy.com -0.0.0.0 mopai.sg 0.0.0.0 motorcomunicacion.com 0.0.0.0 moumitas.com 0.0.0.0 msacontabil.com.br @@ -687,7 +682,7 @@ 0.0.0.0 nap.mgsservers.com 0.0.0.0 navayurveda.in 0.0.0.0 nec-i.com -0.0.0.0 nellaimasthanbiryani.com +0.0.0.0 nelitrianggraeni.000webhostapp.com 0.0.0.0 nerve.untergrund.net 0.0.0.0 nettube.com.br 0.0.0.0 networkwheels.co.za @@ -706,6 +701,7 @@ 0.0.0.0 nilinkeji.com 0.0.0.0 nimboohomes.com 0.0.0.0 njtiledesigncenter.com +0.0.0.0 nmxwllwsdyminoragenw.dns.army 0.0.0.0 nobius.org 0.0.0.0 nocalnoodle.elin.co.za 0.0.0.0 nomadicbees.com @@ -719,6 +715,7 @@ 0.0.0.0 nyeh2o.com.au 0.0.0.0 obseques-conseils.com 0.0.0.0 oecteam.com +0.0.0.0 ohe.ie 0.0.0.0 ohsewgorgeous.co.uk 0.0.0.0 oknoplastik.sk 0.0.0.0 oleholeh.memangbeda.website @@ -751,6 +748,7 @@ 0.0.0.0 pagos.krayem.com.mx 0.0.0.0 palbas.cl 0.0.0.0 palochusvet.szm.com +0.0.0.0 panslimiterd.com 0.0.0.0 parallel.rockvideos.at 0.0.0.0 parejasfelices.mi-fs.com 0.0.0.0 parkhussion.com @@ -781,6 +779,7 @@ 0.0.0.0 plasfan.ind.br 0.0.0.0 playground2.grupoaliadasca.com 0.0.0.0 pmglance.startwriteup.com +0.0.0.0 pmrimewsdylimtewsogh.dns.army 0.0.0.0 pokojewewladyslawowie.pl 0.0.0.0 pole.com.vc 0.0.0.0 pool.phxdir.com @@ -794,7 +793,6 @@ 0.0.0.0 prishaartcreations.com 0.0.0.0 production.sparshims.com 0.0.0.0 programaoperadoronline.com.br -0.0.0.0 project.exquitec.com 0.0.0.0 promotoradescomplica.com.br 0.0.0.0 promoversdubai.com 0.0.0.0 propertiq.elin.co.za @@ -804,7 +802,6 @@ 0.0.0.0 prosyarmakassar.com 0.0.0.0 provence.elin.co.za 0.0.0.0 prox.realunix.cc -0.0.0.0 prueba.danielluza.com 0.0.0.0 pujashoppe.in 0.0.0.0 punchdialogues.com 0.0.0.0 punjabdevelopersassociation.com.pk @@ -819,7 +816,6 @@ 0.0.0.0 rainbowisp.info 0.0.0.0 rajeshtailang.com 0.0.0.0 rakeshkhatri.in -0.0.0.0 raodigitalmedia.com 0.0.0.0 raquelhelena.com.br 0.0.0.0 rarlabarchiver.ac 0.0.0.0 rasadbar.ir @@ -833,7 +829,6 @@ 0.0.0.0 readymmade.com 0.0.0.0 recyclethesurplus.com 0.0.0.0 redbats.co.in -0.0.0.0 redboxmultimedia.com 0.0.0.0 redchillicrackers.com 0.0.0.0 reifenquick.de 0.0.0.0 relaxindulge.co.nz @@ -916,7 +911,6 @@ 0.0.0.0 sibernetix.fr 0.0.0.0 sigapresschennai.com 0.0.0.0 sige.brisainformatica.com.br -0.0.0.0 signatureads.co.in 0.0.0.0 siili.net 0.0.0.0 simoneporzi.it 0.0.0.0 simorsint.com @@ -952,7 +946,6 @@ 0.0.0.0 spetsesyachtcharter.gr 0.0.0.0 spititourism.com 0.0.0.0 spittinfire.com -0.0.0.0 springbedspetroleum.com 0.0.0.0 src1.minibai.com 0.0.0.0 sreenivasapaintingworks.com 0.0.0.0 sriglobalit.com @@ -994,12 +987,12 @@ 0.0.0.0 tajushariya.com 0.0.0.0 tallyinvoicecustomization.com 0.0.0.0 taltus.co.uk -0.0.0.0 tapalkoedacoffee.com 0.0.0.0 tarravalleyfoods.com.au 0.0.0.0 tavo.cl 0.0.0.0 tc.snpsresidential.com 0.0.0.0 tcy.198424.com 0.0.0.0 tdsp.yngw518.com +0.0.0.0 tech332.synology.me 0.0.0.0 techgms.com 0.0.0.0 teduae.com 0.0.0.0 teleargentina.com @@ -1038,6 +1031,7 @@ 0.0.0.0 theprofinn.com 0.0.0.0 thesummitpc.net 0.0.0.0 theurbantutors.com +0.0.0.0 theviewsdyjupcazfeqv.dns.army 0.0.0.0 thosewebbs.com 0.0.0.0 thriveink.com 0.0.0.0 tianangdep.com @@ -1055,6 +1049,7 @@ 0.0.0.0 toplevel.com.br 0.0.0.0 topmask.co.za 0.0.0.0 torresquinterocorp.com +0.0.0.0 towme.services 0.0.0.0 toyotacollege.ac.th 0.0.0.0 tpke.hu 0.0.0.0 translaterjemah.com @@ -1078,8 +1073,7 @@ 0.0.0.0 umwelt-kirchhof.de 0.0.0.0 unicorpbrunei.com 0.0.0.0 uniengrisb.com -0.0.0.0 unisoftcc.com -0.0.0.0 unityindiversity.in +0.0.0.0 unitedwsdykesokowskg.dns.army 0.0.0.0 unyazitelecom.com 0.0.0.0 upcbpta.com 0.0.0.0 urbantrapfest.cl @@ -1087,6 +1081,7 @@ 0.0.0.0 useformoney.000webhostapp.com 0.0.0.0 uss.ac.th 0.0.0.0 uzzepay.com.br +0.0.0.0 v2consultores.com 0.0.0.0 vanzare.cabanabrazi2.ro 0.0.0.0 vbcargo.hu 0.0.0.0 vcah.co.uk @@ -1146,11 +1141,14 @@ 0.0.0.0 woodsytech.com 0.0.0.0 wordpress.saleensuporte.com.br 0.0.0.0 workingsolutionsrome.org -0.0.0.0 wozata.000webhostapp.com 0.0.0.0 wp.readhere.in 0.0.0.0 wpdemo.101clients.com.au 0.0.0.0 writtendeer.com 0.0.0.0 ws5588.f3322.net +0.0.0.0 wsdyalgreenkelveskxz.dns.army +0.0.0.0 wsdykungsb2talenwsjf.dns.army +0.0.0.0 wsdyrkkrgorgiousejhd.dns.army +0.0.0.0 wsdysara1investvwsfs.dns.army 0.0.0.0 wsdysuresbonescagegp.dns.army 0.0.0.0 wyklej.pl 0.0.0.0 x2vn.com diff --git a/urlhaus-filter-hosts.txt b/urlhaus-filter-hosts.txt index 43d7dd7a..79b593a8 100644 --- a/urlhaus-filter-hosts.txt +++ b/urlhaus-filter-hosts.txt @@ -1,5 +1,5 @@ # Title: Malicious Hosts Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -238,6 +238,7 @@ 0.0.0.0 123moviesfx.com 0.0.0.0 123sellfast.com 0.0.0.0 123sex.co +0.0.0.0 123tadi.com 0.0.0.0 123xyz.xyz 0.0.0.0 124.com.ua 0.0.0.0 124.cpanel.realwebsitesite.com @@ -1190,6 +1191,7 @@ 0.0.0.0 4ele.pl 0.0.0.0 4ertybhdfrt.gq 0.0.0.0 4esports.de +0.0.0.0 4et3ja.am.files.1drv.com 0.0.0.0 4evakleen.com.au 0.0.0.0 4eventfacilities.nl 0.0.0.0 4evernails.nl @@ -1776,6 +1778,7 @@ 0.0.0.0 999.buzz 0.0.0.0 999.co.id 0.0.0.0 999.rajaojek.com +0.0.0.0 999080321newfolder1002002131-service1002.space 0.0.0.0 999102com.cn 0.0.0.0 99bkx.com 0.0.0.0 99centsdigitals.com @@ -3963,6 +3966,7 @@ 0.0.0.0 ahiskatv.net 0.0.0.0 ahitekniktarti.com 0.0.0.0 ahiyangrup.com.tr +0.0.0.0 ahjianlong.cf 0.0.0.0 ahjuric.si 0.0.0.0 ahk.smu8street.ru 0.0.0.0 ahkha.com @@ -4387,6 +4391,7 @@ 0.0.0.0 akivj07.top 0.0.0.0 akktis.com 0.0.0.0 akkurtmadencilik.com +0.0.0.0 aklatdelmundo.com 0.0.0.0 akleigh.com 0.0.0.0 aklin.ir 0.0.0.0 aklocalshop.com @@ -5099,7 +5104,6 @@ 0.0.0.0 allainesconsultancyinc.com 0.0.0.0 allamanolibrary.com 0.0.0.0 allan-it.com -0.0.0.0 allanabolicsteam.net 0.0.0.0 allanelect.co.uk 0.0.0.0 allangillphotography.com 0.0.0.0 allanhollowell.com @@ -5373,6 +5377,7 @@ 0.0.0.0 aloneintheweb.com 0.0.0.0 aloneskisehir.com 0.0.0.0 alongthelines.com +0.0.0.0 alongwalker.com 0.0.0.0 alonhadat24h.vn 0.0.0.0 alooshop.ir 0.0.0.0 aloravan.com @@ -6130,7 +6135,6 @@ 0.0.0.0 ana.plecko.eu 0.0.0.0 anaaj.pk 0.0.0.0 anabim.com -0.0.0.0 anabolicsteroidsbuy.info 0.0.0.0 anaceb.com 0.0.0.0 anadearmas.net 0.0.0.0 anadelgbt.org @@ -10103,7 +10107,6 @@ 0.0.0.0 b97pm6.com 0.0.0.0 ba3capital.com 0.0.0.0 baacsetu.org -0.0.0.0 baadababada.ru 0.0.0.0 baaders-namibia.com 0.0.0.0 baakcafe.com 0.0.0.0 baamiraan.ir @@ -10225,7 +10228,6 @@ 0.0.0.0 backup.xn----8sba7bmrlhv0a.xn--p1ai 0.0.0.0 backup2.robinandelaine.com 0.0.0.0 backupcom.e-twow.uk -0.0.0.0 backupez.com 0.0.0.0 backupfashions.com 0.0.0.0 backupsitedev.flywheelsites.com 0.0.0.0 backupsql.datasiswebcontable.com @@ -11608,7 +11610,6 @@ 0.0.0.0 belaythakayni.com 0.0.0.0 belboks.com 0.0.0.0 belboy.in -0.0.0.0 belcineloweek.ru 0.0.0.0 belconger.com 0.0.0.0 belcorpisl.com 0.0.0.0 belcvet.com @@ -14167,7 +14168,6 @@ 0.0.0.0 bobbyworld.top 0.0.0.0 bobcar.com.my 0.0.0.0 bobcatofchico.com -0.0.0.0 bobcatofredding.com 0.0.0.0 bobcook.ca 0.0.0.0 bobdolph.com 0.0.0.0 bobenstetter.net @@ -15419,7 +15419,6 @@ 0.0.0.0 bucketstrong.s3-us-west-1.amazonaws.com 0.0.0.0 buckeyechartershiltonhead.com 0.0.0.0 buckeyeoptical.com -0.0.0.0 buckeyesecurity.net 0.0.0.0 buckinghamandlloyds.com 0.0.0.0 buckleman.co.id 0.0.0.0 bucklindata.net @@ -15508,6 +15507,7 @@ 0.0.0.0 buildcraftindia.com 0.0.0.0 buildentconstructions.com 0.0.0.0 builder.acasia.mx +0.0.0.0 builder.makemoneywith.website 0.0.0.0 buildersmerchantsfederation-my.sharepoint.com 0.0.0.0 buildgreenindustries.com 0.0.0.0 building-company.lt @@ -16051,7 +16051,6 @@ 0.0.0.0 c.oooooooooo.ga 0.0.0.0 c.pieshua.com 0.0.0.0 c.teamworx.ph -0.0.0.0 c.top4top.io 0.0.0.0 c.top4top.net 0.0.0.0 c.vivi.casa 0.0.0.0 c.vollar.ga @@ -16723,6 +16722,7 @@ 0.0.0.0 capitalonefinanceltd.in 0.0.0.0 capitalpellets.com 0.0.0.0 capitalpremiumfinancinginc.com +0.0.0.0 capitalprint.co.za 0.0.0.0 capitalprivateasset.com 0.0.0.0 capitalrealestate.us 0.0.0.0 capitalrh.com.br @@ -21563,6 +21563,7 @@ 0.0.0.0 covid19map.digital 0.0.0.0 covid19quarantin.com 0.0.0.0 covid19safety.myftp.org +0.0.0.0 covid19vaccinations.hopto.org 0.0.0.0 covid19vaccine.hopto.org 0.0.0.0 covid2023.info 0.0.0.0 covidbase.info @@ -22921,6 +22922,7 @@ 0.0.0.0 daclim.ro 0.0.0.0 daco-precision.thomaswebs.net 0.0.0.0 daco.nyccomputerconsulting.com +0.0.0.0 dacsancaonguyen.vn 0.0.0.0 dactridaudaday.com 0.0.0.0 dactyltech.co.za 0.0.0.0 dacviadokese.com @@ -31565,6 +31567,7 @@ 0.0.0.0 estimating.training 0.0.0.0 estimatorfind.com 0.0.0.0 estimetercume.com +0.0.0.0 estjh05.top 0.0.0.0 estore.qurvex.com 0.0.0.0 estoyadieta.com 0.0.0.0 estrategias-corporativas.com @@ -31740,7 +31743,6 @@ 0.0.0.0 etxse.xyz 0.0.0.0 etysu02scnabr03wzaxue.com 0.0.0.0 eu-easy.com -0.0.0.0 eu.wildfire.paloaltonetworks.com 0.0.0.0 eu1.salesforce.com 0.0.0.0 eu283iwoqodjspqisjdf.com 0.0.0.0 eu5-cdn.devid.info @@ -33884,7 +33886,6 @@ 0.0.0.0 files.dropmybin.me 0.0.0.0 files.enjin.com 0.0.0.0 files.gathercdn.com -0.0.0.0 files.hrloo.com 0.0.0.0 files.l-d.tech 0.0.0.0 files.martellexpress.us 0.0.0.0 files.mirai-2viv.vn @@ -35617,6 +35618,7 @@ 0.0.0.0 friendzonecafe.com 0.0.0.0 frietfun.be 0.0.0.0 frigolutasima.net +0.0.0.0 frigoprehrana.com 0.0.0.0 frigoriferivignola.it 0.0.0.0 frigotechniek.be 0.0.0.0 frigsales.com @@ -36098,7 +36100,6 @@ 0.0.0.0 fv1-2.failiem.lv 0.0.0.0 fv13.failiem.lv 0.0.0.0 fv15.failiem.lv -0.0.0.0 fv2-2.failiem.lv 0.0.0.0 fv2-7.failiem.lv 0.0.0.0 fv3.failiem.lv 0.0.0.0 fv6.failiem.lv @@ -36176,7 +36177,6 @@ 0.0.0.0 g0zh8lb3.com 0.0.0.0 g15aocbenedict.com 0.0.0.0 g1ba4tt4ngq5nl7w.xyz -0.0.0.0 g1smurt.ru 0.0.0.0 g20digital.com.br 0.0.0.0 g237.cn 0.0.0.0 g2creditsolutions.com @@ -36264,9 +36264,6 @@ 0.0.0.0 gadaniya-magiya.site 0.0.0.0 gadcoafrica.com 0.0.0.0 gaddco.com -0.0.0.0 gade4senate.com -0.0.0.0 gadebrigade.com -0.0.0.0 gadeforussenate.com 0.0.0.0 gadem.ug 0.0.0.0 gadesoluciones.pe 0.0.0.0 gadget-plaza.ru @@ -38414,6 +38411,7 @@ 0.0.0.0 gomitra.com 0.0.0.0 gomovies.cl 0.0.0.0 gomsubattrangxuatkhau.com +0.0.0.0 gomsuminhlongthainguyen.vn 0.0.0.0 gomus.com.br 0.0.0.0 gomyfiles.info 0.0.0.0 gomypass.com @@ -39912,7 +39910,6 @@ 0.0.0.0 h.epelcdn.com 0.0.0.0 h.eurotrading.com.pl 0.0.0.0 h.j990981.ru -0.0.0.0 h.top4top.io 0.0.0.0 h.valerana44.ru 0.0.0.0 h002295863.nichost.ru 0.0.0.0 h0h.org @@ -42142,7 +42139,6 @@ 0.0.0.0 home.99eurowebsite.ie 0.0.0.0 home.barley-plus.com 0.0.0.0 home.dawang.ink -0.0.0.0 home.earthlink.net 0.0.0.0 home.evrstudio.com 0.0.0.0 home.healthiestu.com 0.0.0.0 home.isdes.com @@ -42512,6 +42508,7 @@ 0.0.0.0 hostfleek.com 0.0.0.0 hostgo.com.br 0.0.0.0 hostile-gaming.fr +0.0.0.0 hostimpel.com 0.0.0.0 hosting-c.iuro.nl 0.0.0.0 hosting.drupwayinfotech.in 0.0.0.0 hosting.mrsofttech.com @@ -48968,6 +48965,7 @@ 0.0.0.0 kabelinieseti.ru 0.0.0.0 kabiguru.org 0.0.0.0 kabiledans.com +0.0.0.0 kabimmo.com 0.0.0.0 kabinarf.ru 0.0.0.0 kabiru.ru 0.0.0.0 kabiryogashramlimbdi.com @@ -50385,7 +50383,6 @@ 0.0.0.0 kilnrefractory.com 0.0.0.0 kilolo.site 0.0.0.0 kilop.goodvibeskickin.com -0.0.0.0 kilopaskal.ru 0.0.0.0 kimaco.com 0.0.0.0 kimberly.digital 0.0.0.0 kimberly5esthetique.com @@ -50717,7 +50714,6 @@ 0.0.0.0 klaus-moersch.de 0.0.0.0 klausnerlaw.com 0.0.0.0 klaussen.net -0.0.0.0 klaustrofebia.ru 0.0.0.0 klavze28.com 0.0.0.0 klbay.net 0.0.0.0 kldatabase.com @@ -53619,6 +53615,7 @@ 0.0.0.0 library.cifor.org 0.0.0.0 library.dhl-xom.com 0.0.0.0 library.iainbengkulu.ac.id +0.0.0.0 library.mju.ac.th 0.0.0.0 library.phibi.my.id 0.0.0.0 library.piet.co.in 0.0.0.0 library.strophicmusic.com @@ -55391,7 +55388,6 @@ 0.0.0.0 luminouspla.net 0.0.0.0 luminouspneuma.com 0.0.0.0 lumnus.com.br -0.0.0.0 lumoura.com 0.0.0.0 lumperpush.com 0.0.0.0 lumsdancorp.com 0.0.0.0 lun.otrweb.ru @@ -55553,6 +55549,7 @@ 0.0.0.0 lykangblog.com 0.0.0.0 lykusglobal.com 0.0.0.0 lylevr.com +0.0.0.0 lyllacarter.com 0.0.0.0 lylydressforless.com 0.0.0.0 lymcomercial.cl 0.0.0.0 lymfodrenaze.eu @@ -58709,6 +58706,7 @@ 0.0.0.0 medicinadellavoromb.it 0.0.0.0 medicinaesteticaorlandini.it 0.0.0.0 medicinageriatrica.com.br +0.0.0.0 medicinainterna-critica.com 0.0.0.0 medicinaonline.rjsrwaco.watchdogdns.duckdns.org 0.0.0.0 medicine.softberg.ro 0.0.0.0 mediclaim.odhavnidhi.org @@ -61879,6 +61877,7 @@ 0.0.0.0 mtcinteriordesign.co.uk 0.0.0.0 mtcr.co.za 0.0.0.0 mtcuadrado.com +0.0.0.0 mtdc.com.my 0.0.0.0 mte1.cn 0.0.0.0 mtechagency.com 0.0.0.0 mteestore.com @@ -62575,7 +62574,6 @@ 0.0.0.0 myimmigrationlawmarketingpartner.com 0.0.0.0 myimmogroup.be 0.0.0.0 myinfoart.online -0.0.0.0 myinstabuzzz.co 0.0.0.0 myinstantguru.com 0.0.0.0 myinternetjobs.com 0.0.0.0 myintromationsz.win @@ -62601,6 +62599,7 @@ 0.0.0.0 mylinkguard.com 0.0.0.0 mylistbuildingtraffic.com 0.0.0.0 mylisting.martinface.com +0.0.0.0 myliverpoolnews.cf 0.0.0.0 myloanbaazar.com 0.0.0.0 myloanexpert.in 0.0.0.0 mylocal.dk @@ -64190,6 +64189,7 @@ 0.0.0.0 news.intertours.org.rs 0.0.0.0 news.leta.com.vn 0.0.0.0 news.lwinmoenaing.me +0.0.0.0 news.makemoneywith.website 0.0.0.0 news.medicaid.ir 0.0.0.0 news.omumusic.net 0.0.0.0 news.palette69.com @@ -64973,6 +64973,7 @@ 0.0.0.0 nmsk.online 0.0.0.0 nmsr.info 0.0.0.0 nmvconstructions.com +0.0.0.0 nmxwllwsdyminoragenw.dns.army 0.0.0.0 nn-webdesign.be 0.0.0.0 nn.5ctelematics.com 0.0.0.0 nnasout.com @@ -65753,7 +65754,6 @@ 0.0.0.0 nvdweb.azurewebsites.net 0.0.0.0 nveeusa.com 0.0.0.0 nvelj12qyyfi03kqxy.xyz -0.0.0.0 nvgeeforsegt.ru 0.0.0.0 nvgp.com.au 0.0.0.0 nvi.edu.vn 0.0.0.0 nvl.netsmartz.net @@ -66971,7 +66971,6 @@ 0.0.0.0 only4atalg.ml 0.0.0.0 onlyapteka.ru 0.0.0.0 onlyart.in -0.0.0.0 onlybamboofabrics.com 0.0.0.0 onlycane.in 0.0.0.0 onlychild.org 0.0.0.0 onlycocktaildresses.com @@ -68961,6 +68960,7 @@ 0.0.0.0 pazarcheto.com 0.0.0.0 pazargezer.com 0.0.0.0 pazcomau-my.sharepoint.com +0.0.0.0 pazpus.com 0.0.0.0 pb-xt.com 0.0.0.0 pb.divaasolutions.com 0.0.0.0 pb128o6c2favwk.com @@ -70706,6 +70706,7 @@ 0.0.0.0 pmrimestdylimtdvenst.dns.army 0.0.0.0 pmrimestdylimtdvests.dns.army 0.0.0.0 pmrimestdylimtstwork.dns.army +0.0.0.0 pmrimewsdylimtewsogh.dns.army 0.0.0.0 pmrimewsdylimtwswods.dns.army 0.0.0.0 pms.stercomagento.com 0.0.0.0 pmsports.de @@ -72424,6 +72425,7 @@ 0.0.0.0 prosupport.cl 0.0.0.0 prosvyaz.kz 0.0.0.0 prosyarmakassar.com +0.0.0.0 prosystemsug.com 0.0.0.0 prosysvinorosso.com 0.0.0.0 prot.drupal8.softikom.lv 0.0.0.0 protaciohospital.com @@ -72434,7 +72436,6 @@ 0.0.0.0 protech.mn 0.0.0.0 protechcarpetcare.com 0.0.0.0 protechgroup1.com -0.0.0.0 protect.mimecast-offshore.com 0.0.0.0 protectiadatelor.biz 0.0.0.0 protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org 0.0.0.0 protection.pecol.eu @@ -73634,6 +73635,7 @@ 0.0.0.0 quatanghoanglong.com 0.0.0.0 quatangluuniemhue.com 0.0.0.0 quatangtaynguyen.com +0.0.0.0 quatangtaynguyen.vn 0.0.0.0 quatest.sixstarsent.com 0.0.0.0 quatet365.com 0.0.0.0 quatram.de @@ -73699,6 +73701,7 @@ 0.0.0.0 quickbookstechnicalsupportphonenumber.com 0.0.0.0 quickboooks.host 0.0.0.0 quickboooks.space +0.0.0.0 quickcompanyreg.co.za 0.0.0.0 quickfingers.net 0.0.0.0 quickinsolutions.com 0.0.0.0 quicklifecare.com @@ -76300,7 +76303,6 @@ 0.0.0.0 roadscompass.com 0.0.0.0 roadtravelcars.com 0.0.0.0 roanokecellphonerepair.com -0.0.0.0 roanokemortgages.com 0.0.0.0 roastedguarmeal.com 0.0.0.0 roba.nu 0.0.0.0 robaitec.com @@ -78672,6 +78674,7 @@ 0.0.0.0 savasaachi.systems 0.0.0.0 savaspark.com.tr 0.0.0.0 save-room.info +0.0.0.0 save.makemoneywith.website 0.0.0.0 save24x7.com 0.0.0.0 saveanimal.org 0.0.0.0 savecannabis.org @@ -82332,6 +82335,7 @@ 0.0.0.0 slrpros.com 0.0.0.0 sls-eg.com 0.0.0.0 sls-security.ru +0.0.0.0 slsbearings.com.sg 0.0.0.0 slservicebd.com 0.0.0.0 slubnefury.pl 0.0.0.0 slugard.5gbfree.com @@ -84264,7 +84268,6 @@ 0.0.0.0 srnirob.com 0.0.0.0 srno.hu 0.0.0.0 sromano.it -0.0.0.0 sromecorlduce.ru 0.0.0.0 sroomf70nasiru.duckdns.org 0.0.0.0 srooooiva.ru 0.0.0.0 srpresse.fr @@ -86093,7 +86096,6 @@ 0.0.0.0 sunflowerschoolandcollege.com 0.0.0.0 sunfruit.com.tn 0.0.0.0 sunganak.in -0.0.0.0 sungardspo.com 0.0.0.0 sungazer.com.au 0.0.0.0 sunglasses2020.com 0.0.0.0 sungvalopkhongsam.com @@ -89493,6 +89495,7 @@ 0.0.0.0 thefragrancefreeshop.com 0.0.0.0 thefranssons.com 0.0.0.0 thefreelancerschool.com +0.0.0.0 thefrees.com 0.0.0.0 thefreewaterfoundation.org.za 0.0.0.0 thefront.in 0.0.0.0 thefuel.be @@ -90077,6 +90080,7 @@ 0.0.0.0 theviestdyjupcafgmcn.dns.army 0.0.0.0 theviestdyjupcafgsvb.dns.army 0.0.0.0 theviestdyjupcazfest.dns.navy +0.0.0.0 theviewsdyjupcazfeqv.dns.army 0.0.0.0 theviewsdyjupcazwsgv.dns.army 0.0.0.0 thevilla46.com 0.0.0.0 thevine-organizasyon.com @@ -90580,6 +90584,7 @@ 0.0.0.0 timelyrain.top 0.0.0.0 timenard.top 0.0.0.0 timenotbesea.xyz +0.0.0.0 timenow.pw 0.0.0.0 timenowis1.top 0.0.0.0 timeoffer.site 0.0.0.0 timeofvape.tk @@ -92345,7 +92350,6 @@ 0.0.0.0 trustinspect.com 0.0.0.0 trustlancers.com 0.0.0.0 trustorbit.com -0.0.0.0 trustpilot-scam.com 0.0.0.0 trustpropertyholdings.com 0.0.0.0 trustrambusinesssolutions.com 0.0.0.0 trustrobins.info @@ -92392,6 +92396,7 @@ 0.0.0.0 ts.7rb.xyz 0.0.0.0 ts0ev73.com 0.0.0.0 tsal.com +0.0.0.0 tsapparel.com.my 0.0.0.0 tsareva-garden.ru 0.0.0.0 tsatsi.co.za 0.0.0.0 tsauctions.com @@ -92953,7 +92958,6 @@ 0.0.0.0 u0707115.cp.regruhosting.ru 0.0.0.0 u0746219.cp.regruhosting.ru 0.0.0.0 u0774849.cp.regruhosting.ru -0.0.0.0 u1.huatu.com 0.0.0.0 u1.innerpeer.com 0.0.0.0 u11123p7833.web0104.zxcs.nl 0.0.0.0 u1141p8807.web0103.zxcs.nl @@ -93696,6 +93700,7 @@ 0.0.0.0 unitedwsdy5defenceforgorvermentsocialeme.duckdns.org 0.0.0.0 unitedwsdykesokowsbv.dns.army 0.0.0.0 unitedwsdykesokowsgs.dns.army +0.0.0.0 unitedwsdykesokowskg.dns.army 0.0.0.0 unitedwsdykesokowsku.dns.army 0.0.0.0 unitedwsdykesokowsri.dns.navy 0.0.0.0 unitedyfl.com @@ -94096,7 +94101,6 @@ 0.0.0.0 url675.textilmallorca.com 0.0.0.0 url9823.ville.labrecque.qc.ca 0.0.0.0 urlac.de -0.0.0.0 urldefense.us 0.0.0.0 urleddrug.at 0.0.0.0 urlfrance.fr 0.0.0.0 urlm.ir @@ -94223,7 +94227,6 @@ 0.0.0.0 uspslabel.itemdb.com 0.0.0.0 uss.ac.th 0.0.0.0 uss21.com -0.0.0.0 ussbd.net 0.0.0.0 usselfstoragenetwork.com 0.0.0.0 ussrback.com 0.0.0.0 ussrgun.000webhostapp.com @@ -94338,6 +94341,7 @@ 0.0.0.0 uyaiblog.com 0.0.0.0 uycqawua.applekid.cn 0.0.0.0 uydu.antalyaelektrikariza.net +0.0.0.0 uyen.vn 0.0.0.0 uyencometics.bmt.city 0.0.0.0 uyencuentra.com 0.0.0.0 uyf.com.ua @@ -98810,7 +98814,6 @@ 0.0.0.0 wotehb.com 0.0.0.0 wotsuper.pw 0.0.0.0 wotsuper3.exe -0.0.0.0 wouatiareves.ru 0.0.0.0 wourionlion.ru 0.0.0.0 woutaalexp.com 0.0.0.0 wouterwolf.com @@ -99031,6 +99034,7 @@ 0.0.0.0 wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org 0.0.0.0 wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org 0.0.0.0 wsdyalgreenkeghewsmq.dns.army +0.0.0.0 wsdyalgreenkelveskxz.dns.army 0.0.0.0 wsdyalhjchfonlinedws.dns.navy 0.0.0.0 wsdyalhjchfonlinwsdf.dns.army 0.0.0.0 wsdyalhjchfonlinwsed.dns.army @@ -99054,10 +99058,12 @@ 0.0.0.0 wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org 0.0.0.0 wsdyibgreenkegheedws.dns.navy 0.0.0.0 wsdyibgreenkeghewsyt.dns.army +0.0.0.0 wsdyibgreenventureqx.dns.army 0.0.0.0 wsdykalamikonlinedeliverystoreservwspmq.ydns.eu 0.0.0.0 wsdykung38communicationtarisupliermgapc.duckdns.org 0.0.0.0 wsdykungsb2gotchtsub.dns.army 0.0.0.0 wsdykungsb2gotchtwsp.dns.army +0.0.0.0 wsdykungsb2talenwsjf.dns.army 0.0.0.0 wsdykungsb2talenwsmz.dns.army 0.0.0.0 wsdymsloginvestmwsqd.dns.army 0.0.0.0 wsdymsloginvestmwsrw.dns.army @@ -99070,9 +99076,11 @@ 0.0.0.0 wsdynitengymndynatin.dns.army 0.0.0.0 wsdypmrimelimtdvenws.dns.army 0.0.0.0 wsdypmrimelimtdvewsd.dns.army +0.0.0.0 wsdyrkkrgorgiousejhd.dns.army 0.0.0.0 wsdyrkkrsuccessmorev.dns.army 0.0.0.0 wsdyrkkrsuccessmoven.dns.army 0.0.0.0 wsdyrmtcntlfarmtwsvb.dns.army +0.0.0.0 wsdysara1investvwsfs.dns.army 0.0.0.0 wsdyshgshg2induswsjg.dns.army 0.0.0.0 wsdyshgshgnationalindustrialandgoogledns.duckdns.org 0.0.0.0 wsdyshgshgnationalobjindustrialat23fty.duckdns.org @@ -100119,7 +100127,6 @@ 0.0.0.0 xnk.jbzie.com 0.0.0.0 xnkwintech.com 0.0.0.0 xnxxchannel.com -0.0.0.0 xnxxfullhd.com 0.0.0.0 xo4z0sl.com 0.0.0.0 xo57.com 0.0.0.0 xoangyduong.com.vn @@ -100668,7 +100675,6 @@ 0.0.0.0 yeu81.com 0.0.0.0 yeu82.com 0.0.0.0 yeuhang.tk -0.0.0.0 yeumoitruong.vn 0.0.0.0 yeuromndy.cf 0.0.0.0 yeutocviet.com 0.0.0.0 yewonder.com diff --git a/urlhaus-filter-online.tpl b/urlhaus-filter-online.tpl index 0eedbfff..43756ec0 100644 --- a/urlhaus-filter-online.tpl +++ b/urlhaus-filter-online.tpl @@ -1,6 +1,6 @@ msFilterList # Title: Online Malicious Hosts Blocklist (IE) -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -13,12 +13,11 @@ msFilterList -d 14karatvisions.com -d 1am.co.nz -d 21robo.com --d 32792.prolocksmithwinterpark.com -d 360.lcy2zzx.pw -d 360down7.miiyun.cn +-d 4et3ja.am.files.1drv.com -d 77st.net -d 8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com --d 87du.vip -d 8poieq.bn.files.1drv.com -d aatreefelling.co.za -d abcd.bg @@ -32,7 +31,6 @@ msFilterList -d aceeprc.com.aceeprc.com -d acellr.co.uk -d acteon.com.ar --d activecost.com.au -d addahealingmusic.com -d adithimedia.com -d adithimedia.memengers.com @@ -92,11 +90,14 @@ msFilterList -d artedibujoyarquitectura.com -d arwenyapi.com -d ask-regard.call-save.biz +-d asucssa.live -d atfile.com -d athenacapsg.com +-d atlasconcreteworks.com -d attach.66rpg.com -d atteuqpotentialunlimited.com -d augustair.com +-d aulist.com -d automaticrefreshments.com -d avadhanagames.com -d ayahuascasp.com.br @@ -112,6 +113,7 @@ msFilterList -d bary.sz4h.com -d bash.givemexyz.in -d bausch.kr-atlas.monaxikoslykos@zytrox.tk +-d bavhome.com -d bbia.co.uk -d bcmt.elin.co.za -d bcrg.co.za @@ -163,7 +165,6 @@ msFilterList -d bt2.elin.co.za -d btdapi.robotake.com -d buigiaphat.com.vn --d bulkyfoodja.com -d bullseyemedia.in -d busandvanrentalmalaysia.com -d buscascolegios.diit.cl @@ -177,11 +178,8 @@ msFilterList -d calgaryautorepairservice.com -d callbury.in -d camminachetipassa.it --d canadianwork.cc -d capitalgroup-kw.com -d capoeiraventrelivre.com --d carlsbadre.com --d carsidecor.com -d cashyinvestment.org -d catchperch.com -d catchpoolshetlands.co.uk @@ -218,7 +216,6 @@ msFilterList -d colorpak.pl -d columbia.aula-web.net -d community.reimclub.com --d comosairdoburaco.com.br -d competancy.indigoconsult.net -d conceptimagine.ro -d config.cqhbkjzx.com @@ -227,12 +224,14 @@ msFilterList -d consulateins.solucioneslink.com -d contributeindustry.com -d copelandscapes.com +-d corwin-tommie06f.ru.com -d coulsongraphics.com -d count.mail.163.com.impactmedfoundation.com -d covid19.cyberschool.or.id -d cpanel.shivay.net -d cr-sq.com -d craftech.nxtnet.ga +-d crearechile.cl -d creationskateboards.com -d crecerco.com -d crittersbythebay.com @@ -242,6 +241,7 @@ msFilterList -d crscorretordeimoveis.com.br -d cse-engineer.com -d csnserver.com +-d ctracknxt.in -d cubescargoexpress.com -d curasoles.co.za -d currantmedia.com @@ -260,7 +260,6 @@ msFilterList -d dating.khokhas.co.za -d datsom.vn -d davethompson.me.uk --d davidmcguinness.info -d dayspringdaisies.com -d dd.qiyuea.cn -d ddns.cyberium.cc @@ -294,14 +293,11 @@ msFilterList -d dl.installcdn-aws.com -d dl.packetstormsecurity.net -d dl.rina-roleplay.com --d dnn.alibuf.com --d dns.alibuf.com -d dockerupdate.anondns.net -d docman.orientalservices.in -d dodsonimaging.com -d doitunlimited.com -d dokan.blueberrytec.com --d dom-chel74.ru -d dom.daf.free.fr -d doncedyhall.com -d donghobinhminh.com @@ -311,6 +307,7 @@ msFilterList -d dosman.pl -d dovberger.com -d down.pcclear.com +-d down.udashi.com -d down.webbora.com -d down1.arpun.com -d download.caihong.com @@ -341,6 +338,7 @@ msFilterList -d eandgdesign.com.ng -d eastsheen-glaziers.co.uk -d ebruyatkin.com +-d edu.saicraftsman.com -d eedo.ee -d efficientegroup.com -d elbauldenora.com @@ -355,8 +353,8 @@ msFilterList -d erp.zilymax.com -d escola.probommar.org.br -d esnconsultants.com --d esrhf04.top -d essentia.org.br +-d estjh05.top -d ethereality.info -d eubanks7.com -d europeanzonexxi.com @@ -425,9 +423,11 @@ msFilterList -d goldcoastoffice365.com.au -d golden-memories-funerals.yourpageserver.com -d goldenasiacapital.com +-d goldmen.in -d gpotecnosystems.com -d gracejukes.com -d grupoinmare.com +-d gruposelt.000webhostapp.com -d gs.monerorx.com -d guide-to-cell-phones.com -d gulfac-house.com @@ -455,6 +455,7 @@ msFilterList -d hmpmall.co.kr -d hoagietesting10.com -d hoayeuthuong-my.sharepoint.com +-d holmesservices.mobiledevsite.co -d homefindersolutions.com -d hongluosi.com -d hookedupboatclub.com @@ -467,6 +468,7 @@ msFilterList -d htownbars.com -d hubtech.co.za -d huellacero.cl +-d hunchomusichub.com -d hunggiang.vn -d husamiyahschool.com -d iabmixx2020.rayadigital.online @@ -518,7 +520,6 @@ msFilterList -d jay.diamondrelationscrm.us -d jebs.net.au -d jeffdahlke.com --d jhayesconsulting.com -d jiaoyuzixun.cn -d jing-da.com.tw -d jmtc.91756.cn @@ -532,7 +533,6 @@ msFilterList -d jupiter.toxsl.in -d justinscott.com.au -d kadigital.co.uk --d kaizenjanitorial.com -d kalawatihomes.com -d kalogirosfinance.com -d kaptaanchapal.com @@ -543,17 +543,15 @@ msFilterList -d ketofitnessexpert.com -d kevinjewelry.com.co -d keywatch.yourpageserver.com --d khmerosja.net -d kingssa.co.za -d kizitox.ga -d kjcpromo.com --d kldatabase.com -d kleinendeli.co.za -d korrectconceptservices.com -d krisbadminton.com -d ktb.sch.id -d kubatoglubaklava.com.tr --d kullumanalitours.com +-d kumaralok.in -d kwanfromhongkong.com -d kz.sldov.ru -d lacasadelosalebrijes.com @@ -562,7 +560,6 @@ msFilterList -d laodongnhat.vn -d laravel.pointersoftwares.com.br -d lasermobilesounds.co.uk --d laura9630fr.com -d lauratomismith.com -d lautarosanmiguel.com -d lawforall.edu.lk @@ -664,14 +661,12 @@ msFilterList -d misterson.com -d mkontakt.az -d mktf.mx --d mmdx.com -d mmogollon.com.mx -d mncarteam.com -d modelhouseturkey.com -d modernmanna.org -d monetization.business -d moninediy.com --d mopai.sg -d motorcomunicacion.com -d moumitas.com -d msacontabil.com.br @@ -690,7 +685,7 @@ msFilterList -d nap.mgsservers.com -d navayurveda.in -d nec-i.com --d nellaimasthanbiryani.com +-d nelitrianggraeni.000webhostapp.com -d nerve.untergrund.net -d nettube.com.br -d networkwheels.co.za @@ -709,6 +704,7 @@ msFilterList -d nilinkeji.com -d nimboohomes.com -d njtiledesigncenter.com +-d nmxwllwsdyminoragenw.dns.army -d nobius.org -d nocalnoodle.elin.co.za -d nomadicbees.com @@ -722,6 +718,7 @@ msFilterList -d nyeh2o.com.au -d obseques-conseils.com -d oecteam.com +-d ohe.ie -d ohsewgorgeous.co.uk -d oknoplastik.sk -d oleholeh.memangbeda.website @@ -754,6 +751,7 @@ msFilterList -d pagos.krayem.com.mx -d palbas.cl -d palochusvet.szm.com +-d panslimiterd.com -d parallel.rockvideos.at -d parejasfelices.mi-fs.com -d parkhussion.com @@ -784,6 +782,7 @@ msFilterList -d plasfan.ind.br -d playground2.grupoaliadasca.com -d pmglance.startwriteup.com +-d pmrimewsdylimtewsogh.dns.army -d pokojewewladyslawowie.pl -d pole.com.vc -d pool.phxdir.com @@ -797,7 +796,6 @@ msFilterList -d prishaartcreations.com -d production.sparshims.com -d programaoperadoronline.com.br --d project.exquitec.com -d promotoradescomplica.com.br -d promoversdubai.com -d propertiq.elin.co.za @@ -807,7 +805,6 @@ msFilterList -d prosyarmakassar.com -d provence.elin.co.za -d prox.realunix.cc --d prueba.danielluza.com -d pujashoppe.in -d punchdialogues.com -d punjabdevelopersassociation.com.pk @@ -822,7 +819,6 @@ msFilterList -d rainbowisp.info -d rajeshtailang.com -d rakeshkhatri.in --d raodigitalmedia.com -d raquelhelena.com.br -d rarlabarchiver.ac -d rasadbar.ir @@ -836,7 +832,6 @@ msFilterList -d readymmade.com -d recyclethesurplus.com -d redbats.co.in --d redboxmultimedia.com -d redchillicrackers.com -d reifenquick.de -d relaxindulge.co.nz @@ -919,7 +914,6 @@ msFilterList -d sibernetix.fr -d sigapresschennai.com -d sige.brisainformatica.com.br --d signatureads.co.in -d siili.net -d simoneporzi.it -d simorsint.com @@ -955,7 +949,6 @@ msFilterList -d spetsesyachtcharter.gr -d spititourism.com -d spittinfire.com --d springbedspetroleum.com -d src1.minibai.com -d sreenivasapaintingworks.com -d sriglobalit.com @@ -997,12 +990,12 @@ msFilterList -d tajushariya.com -d tallyinvoicecustomization.com -d taltus.co.uk --d tapalkoedacoffee.com -d tarravalleyfoods.com.au -d tavo.cl -d tc.snpsresidential.com -d tcy.198424.com -d tdsp.yngw518.com +-d tech332.synology.me -d techgms.com -d teduae.com -d teleargentina.com @@ -1041,6 +1034,7 @@ msFilterList -d theprofinn.com -d thesummitpc.net -d theurbantutors.com +-d theviewsdyjupcazfeqv.dns.army -d thosewebbs.com -d thriveink.com -d tianangdep.com @@ -1058,6 +1052,7 @@ msFilterList -d toplevel.com.br -d topmask.co.za -d torresquinterocorp.com +-d towme.services -d toyotacollege.ac.th -d tpke.hu -d translaterjemah.com @@ -1081,8 +1076,7 @@ msFilterList -d umwelt-kirchhof.de -d unicorpbrunei.com -d uniengrisb.com --d unisoftcc.com --d unityindiversity.in +-d unitedwsdykesokowskg.dns.army -d unyazitelecom.com -d upcbpta.com -d urbantrapfest.cl @@ -1090,6 +1084,7 @@ msFilterList -d useformoney.000webhostapp.com -d uss.ac.th -d uzzepay.com.br +-d v2consultores.com -d vanzare.cabanabrazi2.ro -d vbcargo.hu -d vcah.co.uk @@ -1149,11 +1144,14 @@ msFilterList -d woodsytech.com -d wordpress.saleensuporte.com.br -d workingsolutionsrome.org --d wozata.000webhostapp.com -d wp.readhere.in -d wpdemo.101clients.com.au -d writtendeer.com -d ws5588.f3322.net +-d wsdyalgreenkelveskxz.dns.army +-d wsdykungsb2talenwsjf.dns.army +-d wsdyrkkrgorgiousejhd.dns.army +-d wsdysara1investvwsfs.dns.army -d wsdysuresbonescagegp.dns.army -d wyklej.pl -d x2vn.com diff --git a/urlhaus-filter-online.txt b/urlhaus-filter-online.txt index 1c3a7c9b..446f5aba 100644 --- a/urlhaus-filter-online.txt +++ b/urlhaus-filter-online.txt @@ -1,5 +1,5 @@ ! Title: Online Malicious URL Blocklist -! Updated: Thu, 08 Apr 2021 00:12:42 UTC +! Updated: Thu, 08 Apr 2021 12:12:46 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/urlhaus-filter ! License: https://gitlab.com/curben/urlhaus-filter#license @@ -7,7 +7,6 @@ 0-24bpautomentes.hu 0cl.sldov.ru 1.10.147.48 -1.207.196.135 1.222.196.60 1.245.4.163 1.246.222.107 @@ -17,10 +16,10 @@ 1.246.222.134 1.246.222.138 1.246.222.14 +1.246.222.153 1.246.222.16 1.246.222.165 1.246.222.20 -1.246.222.228 1.246.222.234 1.246.222.237 1.246.222.245 @@ -47,14 +46,13 @@ 1.246.223.148 1.246.223.15 1.246.223.151 -1.246.223.22 1.246.223.223 1.246.223.4 1.246.223.48 -1.246.223.54 1.246.223.58 1.246.223.59 1.246.223.6 +1.246.223.61 1.246.223.71 1.246.223.83 1.246.223.94 @@ -80,7 +78,6 @@ 102.141.240.139 103.113.99.79 103.125.218.107 -103.141.138.118 103.16.145.25 103.204.168.34 103.217.215.21 @@ -93,15 +90,11 @@ 103.4.117.26 103.79.112.254 103.82.98.170 -103.91.123.92 +103.84.240.228 +103.84.241.94 103.91.245.12 103.91.245.14 103.91.245.16 -103.91.245.17 -103.91.245.23 -103.91.245.25 -103.91.245.28 -103.91.245.36 103.91.245.46 103.91.245.47 103.92.25.90 @@ -121,6 +114,7 @@ 107.172.193.132 107.172.249.148 107.173.219.80 +107.173.23.240 107.174.250.107 107.174.61.139 107.175.197.135 @@ -134,44 +128,41 @@ 108.190.201.37 108.190.250.48 108.249.194.121 -109.104.151.108 109.124.90.229 109.233.196.232 109.235.7.228 +109.248.58.238 109.86.85.253 -109.88.185.119 109.95.200.102 109.95.200.230 109.96.127.90 109.96.57.246 109.99.37.97 110.14.58.190 -110.187.229.182 110.228.195.46 110.248.124.254 110.248.175.141 110.248.251.194 110.251.10.18 -110.253.150.248 110.253.213.198 110.255.101.184 110.35.145.127 110.35.208.21 110.35.221.77 110.35.223.92 -110.35.225.24 +110.35.233.147 110.35.235.57 110.35.4.2 110.89.10.147 110.89.222.213 -111.118.111.207 +111.118.41.173 +111.118.88.128 111.118.88.61 111.119.245.114 111.125.67.125 111.163.50.120 111.170.86.31 111.172.57.20 -111.182.235.252 111.185.171.111 111.185.177.85 111.185.23.84 @@ -186,7 +177,6 @@ 111.38.121.223 111.38.121.226 111.38.121.228 -111.38.123.136 111.38.26.243 111.38.8.81 112.111.108.184 @@ -211,7 +201,6 @@ 112.236.171.69 112.237.141.241 112.237.144.226 -112.237.209.30 112.237.75.157 112.237.99.207 112.238.143.135 @@ -241,6 +230,7 @@ 112.254.208.123 112.255.6.129 112.255.8.235 +112.26.212.80 112.27.124.111 112.27.124.117 112.27.124.131 @@ -277,6 +267,7 @@ 112.30.1.219 112.30.1.229 112.30.1.230 +112.30.1.245 112.30.1.247 112.30.1.90 112.30.1.91 @@ -284,6 +275,7 @@ 112.30.110.38 112.30.110.43 112.30.110.48 +112.30.110.62 112.30.38.19 112.30.4.103 112.30.4.124 @@ -293,16 +285,20 @@ 112.30.97.184 112.31.0.113 112.31.176.16 +112.31.177.39 112.31.240.239 112.31.87.98 112.53.224.79 +112.53.227.66 112.65.53.175 112.72.153.37 +112.72.162.159 112.72.162.49 112.72.175.147 112.72.176.112 112.72.176.84 112.72.226.202 +112.72.231.35 112.78.45.158 112.80.127.91 112.80.215.101 @@ -314,23 +310,20 @@ 113.122.238.68 113.161.58.249 113.161.78.185 -113.226.42.250 113.227.194.172 113.227.35.229 113.231.211.131 113.254.169.251 113.59.128.133 113.59.133.16 +113.59.136.39 113.59.144.42 -113.59.154.21 +113.59.191.47 113.61.204.205 -113.87.226.255 113.87.32.93 113.89.43.185 114.111.242.3 114.224.203.128 -114.226.100.56 -114.228.205.101 114.229.165.194 114.30.54.64 114.79.172.42 @@ -338,28 +331,27 @@ 115.201.38.185 115.42.47.36 115.50.227.209 -115.50.92.195 +115.53.254.187 115.55.158.93 115.56.131.242 115.56.133.96 -115.56.135.210 115.56.152.194 115.58.132.140 115.59.233.160 -115.61.112.199 115.73.3.11 115.92.174.231 +115.97.142.58 116.124.219.2 116.132.151.60 116.206.164.46 116.211.100.26 -117.196.50.5 +116.75.197.220 117.20.204.138 117.20.204.5 -117.20.210.52 117.20.220.126 117.20.243.40 117.200.76.54 +117.251.59.16 117.26.104.74 117.63.113.146 117.63.195.140 @@ -384,7 +376,6 @@ 118.233.65.93 118.42.125.246 118.43.180.33 -118.79.125.92 118.79.50.203 118.79.58.82 118.99.179.164 @@ -396,7 +387,6 @@ 119.123.238.52 119.14.143.145 119.147.213.57 -119.163.93.191 119.164.18.235 119.164.218.229 119.165.107.93 @@ -435,8 +425,9 @@ 119.56.144.75 119.56.148.115 119.56.155.57 -119.56.173.24 119.56.195.90 +119.56.206.43 +119.56.220.170 12.132.113.2 12.15.69.83 12.178.187.6 @@ -462,10 +453,10 @@ 120.193.91.233 120.209.126.235 120.209.126.239 +120.209.126.250 120.209.126.60 120.209.127.187 120.209.99.127 -120.210.89.79 120.50.66.60 120.50.93.115 120.6.8.11 @@ -492,6 +483,7 @@ 122.100.150.204 122.160.147.53 122.188.86.225 +122.199.66.28 122.199.72.23 122.199.79.27 122.202.37.85 @@ -502,6 +494,7 @@ 123.110.170.237 123.110.182.187 123.110.19.248 +123.110.200.98 123.110.238.188 123.129.2.28 123.129.84.36 @@ -538,9 +531,8 @@ 123.241.148.58 123.241.184.124 123.28.217.23 -123.4.44.113 123.5.5.242 -123.8.17.78 +123.9.193.157 124.129.221.150 124.129.76.230 124.129.78.176 @@ -553,6 +545,7 @@ 124.132.110.150 124.135.34.49 124.152.26.45 +124.153.136.175 124.153.236.6 124.160.126.238 124.163.65.64 @@ -561,6 +554,7 @@ 124.199.56.198 124.230.174.233 124.254.251.54 +124.5.112.43 124.5.92.20 124.6.0.4 124.67.89.28 @@ -571,7 +565,6 @@ 125.128.28.161 125.142.93.34 125.191.113.212 -125.209.71.6 125.40.1.235 125.40.73.68 125.43.23.193 @@ -580,6 +573,7 @@ 128.116.133.92 130.255.159.133 134.195.139.4 +134.236.252.28 135.148.36.127 138.99.204.224 139.159.226.180 @@ -592,6 +586,7 @@ 14.189.247.118 14.232.33.212 14.37.222.190 +14.42.237.237 14.45.127.110 14.46.25.17 14.46.98.241 @@ -624,7 +619,6 @@ 163.53.206.228 165.90.16.5 167.114.172.177 -168.205.223.254 170.81.238.178 171.120.222.98 171.121.255.12 @@ -634,11 +628,13 @@ 171.35.162.156 171.35.174.198 172.105.36.168 +172.105.68.51 172.114.244.127 172.245.186.107 172.245.5.185 172.245.5.190 172.245.81.19 +172.93.176.142 172.93.194.114 173.167.85.89 173.169.46.85 @@ -651,14 +647,11 @@ 173.56.119.108 173.56.92.166 173.63.64.213 -174.106.33.85 174.61.3.149 -174.61.48.94 174.73.246.193 174.81.78.7 174.83.73.163 175.10.147.167 -175.11.193.66 175.11.65.112 175.117.66.74 175.169.13.182 @@ -679,38 +672,40 @@ 176.113.161.76 176.113.161.84 176.113.161.91 +176.113.174.139 176.12.117.70 176.123.7.115 176.123.7.127 -176.123.9.243 176.124.7.225 -176.221.188.251 -176.221.251.238 176.240.84.106 177.11.92.78 177.131.226.235 177.54.82.154 178.124.182.187 -178.134.185.112 178.150.174.65 178.151.143.2 178.165.122.141 +178.17.171.144 +178.175.0.143 178.175.1.179 178.175.10.164 +178.175.10.76 178.175.10.94 178.175.101.51 178.175.102.138 178.175.102.142 178.175.102.162 178.175.102.25 -178.175.103.143 178.175.103.173 +178.175.103.52 178.175.104.112 +178.175.104.67 178.175.104.69 178.175.105.213 178.175.105.238 178.175.105.7 178.175.107.0 +178.175.107.71 178.175.108.173 178.175.108.87 178.175.109.118 @@ -718,57 +713,56 @@ 178.175.111.135 178.175.111.171 178.175.111.190 -178.175.112.111 178.175.112.135 178.175.112.159 178.175.112.198 178.175.112.85 +178.175.114.146 178.175.114.151 -178.175.114.178 178.175.114.57 178.175.115.166 178.175.116.101 178.175.116.138 +178.175.116.20 178.175.116.242 178.175.118.112 -178.175.118.116 -178.175.118.244 178.175.119.69 178.175.12.135 178.175.120.154 -178.175.121.0 178.175.121.228 +178.175.121.54 178.175.122.28 178.175.123.213 -178.175.123.223 178.175.123.232 178.175.123.248 178.175.123.26 178.175.123.91 178.175.124.4 178.175.125.14 +178.175.125.149 178.175.126.129 -178.175.126.254 178.175.126.46 178.175.127.202 -178.175.127.63 +178.175.127.223 178.175.14.14 +178.175.14.155 178.175.15.199 178.175.15.232 178.175.15.44 -178.175.17.194 +178.175.16.26 178.175.17.236 -178.175.18.75 +178.175.19.160 178.175.19.163 178.175.2.158 178.175.2.217 178.175.2.225 +178.175.2.254 178.175.2.59 178.175.20.126 178.175.20.7 178.175.20.74 -178.175.21.149 -178.175.23.119 +178.175.21.41 +178.175.22.120 178.175.24.166 178.175.24.232 178.175.25.129 @@ -776,9 +770,15 @@ 178.175.27.32 178.175.27.46 178.175.29.233 +178.175.3.86 +178.175.30.109 178.175.30.133 178.175.30.151 +178.175.31.55 178.175.32.146 +178.175.32.186 +178.175.33.179 +178.175.33.32 178.175.34.230 178.175.35.170 178.175.35.193 @@ -792,108 +792,109 @@ 178.175.38.12 178.175.4.227 178.175.4.29 +178.175.40.209 +178.175.42.46 178.175.43.121 178.175.43.217 -178.175.43.238 178.175.44.186 -178.175.44.241 178.175.45.125 178.175.45.26 -178.175.46.41 178.175.46.59 -178.175.47.15 -178.175.47.181 +178.175.47.220 178.175.47.222 178.175.47.80 -178.175.48.40 +178.175.48.140 +178.175.48.223 +178.175.48.67 178.175.5.254 178.175.5.44 -178.175.5.74 178.175.50.217 178.175.50.42 +178.175.50.54 178.175.53.101 178.175.54.186 -178.175.54.234 178.175.54.58 178.175.55.99 -178.175.56.11 178.175.56.185 178.175.56.56 -178.175.57.134 +178.175.56.64 178.175.57.14 178.175.57.183 +178.175.57.204 178.175.58.230 178.175.58.234 178.175.58.235 178.175.59.106 178.175.60.247 178.175.61.103 -178.175.61.210 -178.175.62.241 178.175.62.60 178.175.64.156 -178.175.64.17 178.175.64.35 +178.175.65.189 178.175.65.208 +178.175.66.186 178.175.68.123 -178.175.68.209 178.175.68.44 178.175.68.57 +178.175.69.79 178.175.7.156 178.175.70.218 178.175.70.250 178.175.70.74 -178.175.72.148 +178.175.72.126 178.175.72.158 178.175.72.75 178.175.73.238 178.175.75.181 178.175.75.205 +178.175.75.214 +178.175.77.248 178.175.77.47 178.175.78.2 178.175.78.242 -178.175.78.243 178.175.79.146 +178.175.79.198 178.175.79.66 -178.175.8.248 178.175.8.85 +178.175.8.93 178.175.80.142 +178.175.80.167 178.175.81.185 178.175.81.192 178.175.81.226 -178.175.83.224 +178.175.81.240 178.175.84.195 178.175.84.215 +178.175.86.117 178.175.86.182 -178.175.86.47 178.175.86.59 -178.175.87.146 178.175.87.16 178.175.87.207 178.175.87.42 178.175.88.102 -178.175.88.207 +178.175.88.85 178.175.89.121 +178.175.89.132 178.175.89.45 178.175.89.69 178.175.91.223 178.175.92.144 -178.175.92.33 178.175.93.113 -178.175.93.200 178.175.93.234 178.175.93.98 178.175.94.224 +178.175.94.248 178.175.94.27 178.175.94.32 178.175.94.40 -178.175.95.60 -178.175.96.106 +178.175.95.105 +178.175.95.188 178.175.96.125 +178.175.96.93 178.175.97.127 -178.175.97.227 178.175.99.106 178.175.99.209 +178.175.99.21 178.19.183.14 178.205.101.33 178.21.164.68 @@ -904,7 +905,6 @@ 178.48.235.59 178.95.136.35 179.159.58.134 -179.4.187.39 179.43.176.41 179.43.176.48 179.60.84.7 @@ -941,6 +941,7 @@ 181.49.236.4 181.49.59.162 181.80.69.94 +182.112.177.134 182.115.179.201 182.119.206.219 182.119.225.221 @@ -953,13 +954,14 @@ 182.233.0.252 182.235.252.31 182.53.197.62 -183.105.104.83 183.105.225.154 183.109.169.45 183.143.148.105 183.188.50.93 -183.83.8.225 +183.83.1.1 +183.83.14.20 184.164.185.41 +184.175.115.10 184.74.149.230 184.82.15.135 185.106.209.68 @@ -974,7 +976,6 @@ 185.215.113.93 185.221.3.244 185.222.58.152 -185.224.129.224 185.228.141.74 185.233.186.151 185.245.96.94 @@ -984,6 +985,7 @@ 185.55.1.182 185.68.230.207 185.8.173.159 +185.81.154.208 185.81.157.186 185.82.217.185 185.82.217.213 @@ -1011,6 +1013,8 @@ 188.152.41.141 188.169.178.50 188.169.179.127 +188.169.199.59 +188.169.30.30 188.169.36.163 188.242.167.159 188.242.242.144 @@ -1040,6 +1044,7 @@ 190.216.140.123 190.65.206.162 190.85.213.51 +190.92.4.231 190.98.37.135 190.98.37.200 190.98.41.33 @@ -1053,7 +1058,6 @@ 192.227.230.72 192.227.230.74 192.227.230.76 -192.236.147.58 192.99.240.77 194.113.107.243 194.147.142.230 @@ -1065,11 +1069,10 @@ 195.24.94.187 195.5.3.87 196.202.26.182 +196.218.48.82 196.221.148.90 196.221.166.203 197.50.27.115 -198.23.133.218 -198.23.174.104 198.23.213.61 198.23.251.105 198.46.132.132 @@ -1077,6 +1080,7 @@ 2.239.22.188 2.36.231.201 2.37.149.230 +2.37.203.65 2.45.111.158 2.45.4.24 2.55.125.182 @@ -1090,32 +1094,29 @@ 200.194.4.24 200.30.132.50 201.170.46.2 +201.171.40.215 201.184.163.170 201.187.102.73 201.200.254.86 201.203.221.20 201.203.27.37 202.107.233.41 -202.150.176.100 202.166.217.54 202.175.103.10 202.29.95.12 202.4.124.58 202.51.176.114 202.51.191.174 -202.74.236.9 203.109.201.243 203.159.80.128 203.159.80.129 +203.159.80.164 203.170.123.78 203.189.156.107 203.204.232.18 203.229.21.56 203.236.190.28 -203.238.86.202 -203.243.142.132 203.70.166.107 -203.77.80.159 203.80.119.166 203.80.171.138 203.82.36.34 @@ -1130,7 +1131,6 @@ 209.141.40.31 209.146.98.50 210.124.149.19 -210.180.17.140 210.216.152.122 210.216.153.142 210.57.234.93 @@ -1139,19 +1139,20 @@ 210.68.242.114 211.187.132.204 211.187.75.220 -211.200.160.239 211.204.215.157 211.210.66.179 211.210.93.93 211.216.66.105 211.237.114.96 211.237.120.13 +211.237.246.137 211.238.83.238 211.247.5.96 211.32.122.110 211.93.191.153 212.122.86.105 212.143.227.22 +212.156.215.178 212.46.197.114 212.56.197.230 213.123.206.197 @@ -1162,28 +1163,30 @@ 213.163.104.99 213.163.111.201 213.163.114.136 -213.163.114.165 -213.163.115.104 213.163.116.153 +213.163.118.10 +213.163.118.216 213.163.126.20 213.163.126.201 -213.163.126.243 213.163.126.7 +213.186.69.101 213.189.178.163 213.240.218.15 213.249.156.189 -213.91.244.58 213.92.254.52 216.158.238.236 216.170.240.98 216.183.54.169 +216.183.54.196 216.36.12.98 217.11.75.162 +217.12.209.82 218.12.181.110 -218.161.69.135 218.2.40.34 218.234.165.18 218.238.246.3 +218.255.226.166 +218.32.118.1 218.35.207.119 218.35.227.133 218.35.68.35 @@ -1193,11 +1196,10 @@ 218.79.103.159 218.93.102.63 218.93.102.75 +219.155.234.33 219.155.29.165 219.155.64.104 219.157.139.165 -219.157.202.92 -219.157.214.235 219.241.6.180 219.68.1.148 219.68.1.84 @@ -1211,8 +1213,8 @@ 21robo.com 220.118.168.155 220.126.237.74 -220.132.89.154 220.200.22.163 +220.81.44.181 220.90.159.188 221.0.133.84 221.124.78.15 @@ -1238,11 +1240,13 @@ 222.132.125.138 222.133.103.120 222.135.9.5 +222.137.133.125 222.137.139.86 222.137.73.214 -222.138.201.129 222.140.17.245 +222.142.210.144 222.185.116.233 +222.186.20.19 222.187.9.178 222.211.72.66 222.236.85.220 @@ -1265,6 +1269,7 @@ 23.24.213.121 23.243.149.13 23.243.21.167 +23.95.122.24 23.95.89.21 24.103.74.180 24.11.141.134 @@ -1299,7 +1304,6 @@ 27.147.40.128 27.184.251.135 27.193.217.210 -27.194.149.142 27.194.192.66 27.197.23.215 27.199.232.65 @@ -1329,7 +1333,6 @@ 27.208.247.130 27.208.25.59 27.208.34.2 -27.209.208.122 27.209.231.15 27.21.151.205 27.210.107.125 @@ -1372,10 +1375,10 @@ 27.223.242.164 27.35.129.198 27.35.154.13 -27.35.2.30 +27.35.171.36 27.35.212.124 27.35.58.5 -27.7.204.255 +27.6.255.101 31.0.98.131 31.11.51.57 31.13.23.180 @@ -1402,7 +1405,6 @@ 31.30.119.23 31.32.120.79 32.208.157.193 -32792.prolocksmithwinterpark.com 34.122.44.188 35.184.169.169 36.108.231.218 @@ -1418,6 +1420,7 @@ 36.66.105.159 36.66.133.125 36.66.139.36 +36.67.152.161 36.89.18.133 36.91.89.187 360.lcy2zzx.pw @@ -1494,33 +1497,32 @@ 40.88.2.151 41.139.209.46 41.165.130.43 -41.190.63.174 41.193.192.100 41.219.185.171 41.226.60.115 41.72.203.82 41.76.157.2 41.86.18.200 -41.86.18.201 +41.86.5.164 41.86.5.197 +42.202.101.118 42.202.101.199 +42.224.51.229 42.228.60.114 42.229.173.80 42.230.91.1 42.231.208.64 +42.236.212.157 42.56.15.227 42.61.99.155 -42.82.217.241 +43.230.207.204 43.241.106.183 -43.241.108.134 -43.252.8.94 45.133.1.242 45.133.203.192 45.135.134.228 45.14.149.178 45.14.149.182 45.14.149.204 -45.141.84.182 45.141.84.184 45.144.225.118 45.144.225.135 @@ -1530,6 +1532,7 @@ 45.144.225.27 45.148.10.47 45.148.10.94 +45.156.22.230 45.176.109.205 45.176.111.159 45.176.111.35 @@ -1547,7 +1550,6 @@ 45.92.108.35 45.95.169.153 46.114.28.132 -46.161.185.15 46.172.75.231 46.20.63.218 46.214.27.4 @@ -1579,6 +1581,7 @@ 49.213.170.49 49.213.178.183 49.213.179.129 +4et3ja.am.files.1drv.com 5.14.122.233 5.188.62.111 5.2.70.50 @@ -1597,10 +1600,8 @@ 58.115.174.4 58.125.191.4 58.126.247.118 -58.141.122.109 58.142.166.120 58.142.200.124 -58.218.67.253 58.22.212.107 58.226.129.29 58.229.194.122 @@ -1611,7 +1612,6 @@ 58.241.78.55 58.243.126.133 58.72.165.153 -58.72.165.39 58.76.151.51 58.97.206.33 59.0.211.161 @@ -1622,6 +1622,7 @@ 59.151.246.125 59.173.193.208 59.23.114.97 +59.26.181.228 59.30.12.254 60.13.61.12 60.208.135.42 @@ -1645,7 +1646,6 @@ 60.253.44.99 60.253.51.127 60.253.60.174 -60.253.8.81 60.7.10.121 60.7.8.43 61.164.96.98 @@ -1676,17 +1676,19 @@ 62.141.73.58 62.219.131.205 62.219.143.46 -62.219.227.31 62.31.126.33 62.38.149.66 62.38.222.98 62.43.207.148 62.90.165.236 63.245.122.93 +64.233.154.99 +65.0.168.152 65.125.128.196 65.21.58.252 65.26.155.131 65.35.61.255 +66.108.199.144 66.229.214.115 66.57.55.210 66.74.7.197 @@ -1747,7 +1749,6 @@ 73.70.164.42 74.101.1.159 74.108.224.112 -74.119.195.101 74.194.117.165 74.195.115.176 74.199.84.77 @@ -1851,6 +1852,7 @@ 84.40.127.242 84.42.20.217 8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com +85.105.11.216 85.105.123.251 85.105.135.187 85.105.180.33 @@ -1863,13 +1865,13 @@ 85.74.215.180 85.97.130.227 86.35.43.220 -87.110.105.250 +87.117.11.46 87.172.19.130 87.61.89.40 -87du.vip 88.119.171.253 88.2.208.71 88.2.219.179 +88.218.17.110 88.218.17.149 88.225.222.128 88.247.96.19 @@ -1878,10 +1880,12 @@ 88.249.244.180 88.250.204.12 88.250.226.26 +88.250.240.245 88.250.254.90 89.122.183.130 89.136.197.170 89.22.152.244 +89.248.112.202 89.29.213.33 89.40.85.166 8poieq.bn.files.1drv.com @@ -1957,7 +1961,6 @@ accesslinksgroup.com aceeprc.com.aceeprc.com acellr.co.uk acteon.com.ar -activecost.com.au addahealingmusic.com adithimedia.com adithimedia.memengers.com @@ -2018,11 +2021,14 @@ aps-sv.com artedibujoyarquitectura.com arwenyapi.com ask-regard.call-save.biz +asucssa.live atfile.com athenacapsg.com +atlasconcreteworks.com attach.66rpg.com atteuqpotentialunlimited.com augustair.com +aulist.com automaticrefreshments.com avadhanagames.com ayahuascasp.com.br @@ -2038,6 +2044,7 @@ bangladeshunbound.com bary.sz4h.com bash.givemexyz.in bausch.kr-atlas.monaxikoslykos@zytrox.tk +bavhome.com bbia.co.uk bcmt.elin.co.za bcrg.co.za @@ -2089,7 +2096,6 @@ browardinsurancemiami.solucioneslink.com bt2.elin.co.za btdapi.robotake.com buigiaphat.com.vn -bulkyfoodja.com bullseyemedia.in busandvanrentalmalaysia.com buscascolegios.diit.cl @@ -2103,11 +2109,8 @@ cacaoprojects.com calgaryautorepairservice.com callbury.in camminachetipassa.it -canadianwork.cc capitalgroup-kw.com capoeiraventrelivre.com -carlsbadre.com -carsidecor.com cashyinvestment.org catchperch.com catchpoolshetlands.co.uk @@ -2144,7 +2147,6 @@ colinde.pricesne.com colorpak.pl columbia.aula-web.net community.reimclub.com -comosairdoburaco.com.br competancy.indigoconsult.net conceptimagine.ro config.cqhbkjzx.com @@ -2153,12 +2155,14 @@ constructoralyon.com consulateins.solucioneslink.com contributeindustry.com copelandscapes.com +corwin-tommie06f.ru.com coulsongraphics.com count.mail.163.com.impactmedfoundation.com covid19.cyberschool.or.id cpanel.shivay.net cr-sq.com craftech.nxtnet.ga +crearechile.cl creationskateboards.com crecerco.com crittersbythebay.com @@ -2168,6 +2172,7 @@ crmroche.manivelasst.com crscorretordeimoveis.com.br cse-engineer.com csnserver.com +ctracknxt.in cubescargoexpress.com curasoles.co.za currantmedia.com @@ -2186,7 +2191,6 @@ datapolish.com dating.khokhas.co.za datsom.vn davethompson.me.uk -davidmcguinness.info dayspringdaisies.com dd.qiyuea.cn ddns.cyberium.cc @@ -2220,14 +2224,11 @@ dl.198424.com dl.installcdn-aws.com dl.packetstormsecurity.net dl.rina-roleplay.com -dnn.alibuf.com -dns.alibuf.com dockerupdate.anondns.net docman.orientalservices.in dodsonimaging.com doitunlimited.com dokan.blueberrytec.com -dom-chel74.ru dom.daf.free.fr doncedyhall.com donghobinhminh.com @@ -2237,6 +2238,7 @@ dosame.com dosman.pl dovberger.com down.pcclear.com +down.udashi.com down.webbora.com down1.arpun.com download.caihong.com @@ -2267,6 +2269,7 @@ e.sldov.ru eandgdesign.com.ng eastsheen-glaziers.co.uk ebruyatkin.com +edu.saicraftsman.com eedo.ee efficientegroup.com elbauldenora.com @@ -2281,8 +2284,8 @@ erp.nanotechproautocare.com erp.zilymax.com escola.probommar.org.br esnconsultants.com -esrhf04.top essentia.org.br +estjh05.top ethereality.info eubanks7.com europeanzonexxi.com @@ -2351,9 +2354,11 @@ goldcoastoffice365.com goldcoastoffice365.com.au golden-memories-funerals.yourpageserver.com goldenasiacapital.com +goldmen.in gpotecnosystems.com gracejukes.com grupoinmare.com +gruposelt.000webhostapp.com gs.monerorx.com guide-to-cell-phones.com gulfac-house.com @@ -2381,6 +2386,7 @@ hitstation.nl hmpmall.co.kr hoagietesting10.com hoayeuthuong-my.sharepoint.com +holmesservices.mobiledevsite.co homefindersolutions.com hongluosi.com hookedupboatclub.com @@ -2393,6 +2399,7 @@ hsmwebapp.com htownbars.com hubtech.co.za huellacero.cl +hunchomusichub.com hunggiang.vn husamiyahschool.com iabmixx2020.rayadigital.online @@ -2444,7 +2451,6 @@ jathra.co.uk jay.diamondrelationscrm.us jebs.net.au jeffdahlke.com -jhayesconsulting.com jiaoyuzixun.cn jing-da.com.tw jmtc.91756.cn @@ -2458,7 +2464,6 @@ jumpmanualjacobhiller.com jupiter.toxsl.in justinscott.com.au kadigital.co.uk -kaizenjanitorial.com kalawatihomes.com kalogirosfinance.com kaptaanchapal.com @@ -2469,17 +2474,15 @@ kensingtondriving.com ketofitnessexpert.com kevinjewelry.com.co keywatch.yourpageserver.com -khmerosja.net kingssa.co.za kizitox.ga kjcpromo.com -kldatabase.com kleinendeli.co.za korrectconceptservices.com krisbadminton.com ktb.sch.id kubatoglubaklava.com.tr -kullumanalitours.com +kumaralok.in kwanfromhongkong.com kz.sldov.ru lacasadelosalebrijes.com @@ -2488,7 +2491,6 @@ lameguard.ru laodongnhat.vn laravel.pointersoftwares.com.br lasermobilesounds.co.uk -laura9630fr.com lauratomismith.com lautarosanmiguel.com lawforall.edu.lk @@ -2590,14 +2592,12 @@ mis.nbcc.ac.th misterson.com mkontakt.az mktf.mx -mmdx.com mmogollon.com.mx mncarteam.com modelhouseturkey.com modernmanna.org monetization.business moninediy.com -mopai.sg motorcomunicacion.com moumitas.com msacontabil.com.br @@ -2616,7 +2616,7 @@ namnyak.co.ke nap.mgsservers.com navayurveda.in nec-i.com -nellaimasthanbiryani.com +nelitrianggraeni.000webhostapp.com nerve.untergrund.net nettube.com.br networkwheels.co.za @@ -2635,6 +2635,7 @@ nilehouse.co.ug nilinkeji.com nimboohomes.com njtiledesigncenter.com +nmxwllwsdyminoragenw.dns.army nobius.org nocalnoodle.elin.co.za nomadicbees.com @@ -2648,6 +2649,7 @@ nyasabigbullets.com nyeh2o.com.au obseques-conseils.com oecteam.com +ohe.ie ohsewgorgeous.co.uk oknoplastik.sk oleholeh.memangbeda.website @@ -2680,6 +2682,7 @@ pacwebdesigns.com pagos.krayem.com.mx palbas.cl palochusvet.szm.com +panslimiterd.com parallel.rockvideos.at parejasfelices.mi-fs.com parkhussion.com @@ -2710,6 +2713,7 @@ pink99.com plasfan.ind.br playground2.grupoaliadasca.com pmglance.startwriteup.com +pmrimewsdylimtewsogh.dns.army pokojewewladyslawowie.pl pole.com.vc pool.phxdir.com @@ -2723,7 +2727,6 @@ preview2.behalen.com prishaartcreations.com production.sparshims.com programaoperadoronline.com.br -project.exquitec.com promotoradescomplica.com.br promoversdubai.com propertiq.elin.co.za @@ -2733,7 +2736,6 @@ prosupport.cl prosyarmakassar.com provence.elin.co.za prox.realunix.cc -prueba.danielluza.com pujashoppe.in punchdialogues.com punjabdevelopersassociation.com.pk @@ -2748,7 +2750,6 @@ radioafifense.deploys.live rainbowisp.info rajeshtailang.com rakeshkhatri.in -raodigitalmedia.com raquelhelena.com.br rarlabarchiver.ac rasadbar.ir @@ -2762,7 +2763,6 @@ readwrite26.nl readymmade.com recyclethesurplus.com redbats.co.in -redboxmultimedia.com redchillicrackers.com reifenquick.de relaxindulge.co.nz @@ -2846,7 +2846,6 @@ shopsofe.com sibernetix.fr sigapresschennai.com sige.brisainformatica.com.br -signatureads.co.in siili.net simoneporzi.it simorsint.com @@ -2882,7 +2881,6 @@ spent.com.pl spetsesyachtcharter.gr spititourism.com spittinfire.com -springbedspetroleum.com src1.minibai.com sreenivasapaintingworks.com sriglobalit.com @@ -2924,12 +2922,12 @@ tafsantoursandtravels.com tajushariya.com tallyinvoicecustomization.com taltus.co.uk -tapalkoedacoffee.com tarravalleyfoods.com.au tavo.cl tc.snpsresidential.com tcy.198424.com tdsp.yngw518.com +tech332.synology.me techgms.com teduae.com teleargentina.com @@ -2968,6 +2966,7 @@ themansionkasauli.com theprofinn.com thesummitpc.net theurbantutors.com +theviewsdyjupcazfeqv.dns.army thosewebbs.com thriveink.com tianangdep.com @@ -2985,6 +2984,7 @@ topcell9.com toplevel.com.br topmask.co.za torresquinterocorp.com +towme.services toyotacollege.ac.th tpke.hu translaterjemah.com @@ -3008,8 +3008,7 @@ ultimate-24.de umwelt-kirchhof.de unicorpbrunei.com uniengrisb.com -unisoftcc.com -unityindiversity.in +unitedwsdykesokowskg.dns.army unyazitelecom.com upcbpta.com urbantrapfest.cl @@ -3017,6 +3016,7 @@ used-jeans.fr useformoney.000webhostapp.com uss.ac.th uzzepay.com.br +v2consultores.com vanzare.cabanabrazi2.ro vbcargo.hu vcah.co.uk @@ -3076,11 +3076,14 @@ wolfgang-brodte.de woodsytech.com wordpress.saleensuporte.com.br workingsolutionsrome.org -wozata.000webhostapp.com wp.readhere.in wpdemo.101clients.com.au writtendeer.com ws5588.f3322.net +wsdyalgreenkelveskxz.dns.army +wsdykungsb2talenwsjf.dns.army +wsdyrkkrgorgiousejhd.dns.army +wsdysara1investvwsfs.dns.army wsdysuresbonescagegp.dns.army wyklej.pl x2vn.com @@ -3114,8 +3117,17 @@ zz.690tx.com ||bitbucket.org/labesoftware/update/downloads/install_plugin_x64_x86.exe$all ||bitbucket.org/labesoftware/update/downloads/vpn_free.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/1.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/2.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/3.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/clr.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/dianthus.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/n.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/newred.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/omar.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/serv.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/test.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/updachrome.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/updatedata.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/updatev.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/work.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/ya.exe$all @@ -3202,65 +3214,57 @@ zz.690tx.com ||codeload.github.com/meteoradminz/hidden-tear/zip/master$all ||colfincas.com/tmp/protected-cek9qz4zvk2n65e-c5d84gi5/security-cloud/kypqw-52kkq0n9ywj9oa/$all ||docs.google.com/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq$all +||docs.google.com/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq$all ||drive.google.com.it-barcelona.com/frm0reseen/prntscrnofamzorderid.jpg.exe$all ||drive.google.com/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm$all +||drive.google.com/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g$all ||drive.google.com/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss$all ||drive.google.com/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch$all ||drive.google.com/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g$all -||drive.google.com/uc?export=download&id=152yoztzpbx_bbpxepfackfklg8c1eao6$all -||drive.google.com/uc?export=download&id=15hcgek7odccdafzf-9gvibnlgkirj4uo$all ||drive.google.com/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox$all +||drive.google.com/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo$all ||drive.google.com/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w$all -||drive.google.com/uc?export=download&id=194lqzukzvt-jtdxmihcvhd0yk1sxoybk$all ||drive.google.com/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig$all ||drive.google.com/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld$all ||drive.google.com/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn$all ||drive.google.com/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw$all ||drive.google.com/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio$all ||drive.google.com/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv$all -||drive.google.com/uc?export=download&id=1cos43rmscrescxk3u40qjuqbwr-pydsn$all ||drive.google.com/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben$all +||drive.google.com/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a$all ||drive.google.com/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e$all ||drive.google.com/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv$all ||drive.google.com/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd$all ||drive.google.com/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6$all ||drive.google.com/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei$all ||drive.google.com/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr$all -||drive.google.com/uc?export=download&id=1jkov2g5s1xkcq4bfb3uvmd6inhadatrg$all ||drive.google.com/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd$all -||drive.google.com/uc?export=download&id=1kjcylye1dbmhystyyotz-3pagktkhlhq$all +||drive.google.com/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx$all ||drive.google.com/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu$all ||drive.google.com/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer$all ||drive.google.com/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp$all -||drive.google.com/uc?export=download&id=1mwgdd3lxuuk-bnsrm1rpclom0cmx7wob$all ||drive.google.com/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y$all ||drive.google.com/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd$all -||drive.google.com/uc?export=download&id=1nmf6kty3xsoygjxjhb-bsafvlfy-0lt2$all ||drive.google.com/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw$all ||drive.google.com/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol$all -||drive.google.com/uc?export=download&id=1p5fvqkxzwoiu_uauzbmrxpklsetculad$all ||drive.google.com/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk$all ||drive.google.com/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s$all ||drive.google.com/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej$all -||drive.google.com/uc?export=download&id=1q1dwckludrpqijtrpw14_60d5nu7n97t$all ||drive.google.com/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p$all ||drive.google.com/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl$all ||drive.google.com/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko$all ||drive.google.com/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq$all -||drive.google.com/uc?export=download&id=1sjvkrinuscxqmbkdeusxaezazbiagnv3$all -||drive.google.com/uc?export=download&id=1so1trfuzt5-giahetghfhmd-_ot3rq35$all ||drive.google.com/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn$all ||drive.google.com/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w$all ||drive.google.com/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno$all ||drive.google.com/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t$all ||drive.google.com/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb$all +||drive.google.com/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy$all ||drive.google.com/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh$all ||drive.google.com/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e$all ||drive.google.com/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi$all ||drive.google.com/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58$all ||drive.google.com/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi$all -||drive.google.com/uc?export=download&id=1yhflwpk3yeyrdhlhanctlind-5j24iwv$all -||drive.google.com/uc?export=download&id=1yqpuxjbnjokc5fjgt-8xzuybr97rtvg2$all ||drive.google.com/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy$all ||drive.google.com/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr$all ||drive.google.com/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0$all @@ -3310,6 +3314,8 @@ zz.690tx.com ||nhipcauytevietnhat.com/efficiency-all-iuehb/bjug3jyhuyilwhcqs3ykssaqqw7tpyvmypb91wtzdbluio1ekope5vrbbcx8zhdar9yt/$all ||note.youdao.com/yws/api/personal/file/web3a243b322cf83ca7cae587a92916bac7?method=download&inline=true&sharekey=649ac0bb5d5b13d15cbf50b2609e193a$all ||oldschoolvalue.s3.amazonaws.com/spreadsheets/osv_stock_valuation-sample-dummy.exe$all +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm$all +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$all ||onedrive.live.com/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa$all ||onedrive.live.com/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq$all ||onedrive.live.com/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe$all @@ -3356,6 +3362,7 @@ zz.690tx.com ||onedrive.live.com/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0$all ||onedrive.live.com/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte$all ||onedrive.live.com/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte$all +||onedrive.live.com/download?cid=16b1c02dce9ea41f&resid=16b1c02dce9ea41f!286&authkey=almwisomhv3c0zc$all ||onedrive.live.com/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54$all ||onedrive.live.com/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54$all ||onedrive.live.com/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g$all @@ -3375,6 +3382,14 @@ zz.690tx.com ||onedrive.live.com/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg$all ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4$all ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc$all +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom$all +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom$all ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po$all ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe$all ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk$all @@ -3386,6 +3401,10 @@ zz.690tx.com ||onedrive.live.com/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga$all ||onedrive.live.com/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28$all ||onedrive.live.com/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk$all ||onedrive.live.com/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0$all ||onedrive.live.com/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620$all ||onedrive.live.com/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo$all @@ -3432,8 +3451,10 @@ zz.690tx.com ||onedrive.live.com/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm$all ||onedrive.live.com/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm$all ||onedrive.live.com/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik$all +||onedrive.live.com/download?cid=44d422e98133708b&resid=44d422e98133708b%21109&authkey=adzxmpjk-etbkjq$all ||onedrive.live.com/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy$all ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0$all +||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0$all ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw$all ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw$all ||onedrive.live.com/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y$all @@ -3449,6 +3470,7 @@ zz.690tx.com ||onedrive.live.com/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8$all ||onedrive.live.com/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc$all ||onedrive.live.com/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y$all +||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc$all @@ -3539,10 +3561,15 @@ zz.690tx.com ||onedrive.live.com/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe$all ||onedrive.live.com/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i$all ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8$all +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq$all +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s$all ||onedrive.live.com/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa$all ||onedrive.live.com/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe$all ||onedrive.live.com/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi$all ||onedrive.live.com/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e$all +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e!1094&authkey=anqjzd7pr18fu90$all +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211094&authkey=anqjzd7pr18fu90$all +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211099&authkey=alxq-bvz7nqbv4c$all ||onedrive.live.com/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk$all ||onedrive.live.com/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4$all ||onedrive.live.com/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo$all @@ -3613,6 +3640,8 @@ zz.690tx.com ||onedrive.live.com/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4$all ||onedrive.live.com/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk$all ||onedrive.live.com/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk$all +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y$all +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y$all ||onedrive.live.com/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0$all ||onedrive.live.com/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s$all ||onedrive.live.com/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my$all @@ -3632,11 +3661,6 @@ zz.690tx.com ||onedrive.live.com/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli$all ||onedrive.live.com/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm$all ||onedrive.live.com/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935!778&authkey=aaezyk4ypt-elma$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21772&authkey=akeozmv0aafqlbg$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21774&authkey=aly_m3fnrvh6dfq$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21775&authkey=abblpjxi4mwomgs$all -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21777&authkey=ahmuwqi4jg8rvho$all ||onedrive.live.com/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc$all ||onedrive.live.com/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w$all ||onedrive.live.com/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm$all @@ -3706,6 +3730,7 @@ zz.690tx.com ||onedrive.live.com/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0$all ||onedrive.live.com/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m$all ||onedrive.live.com/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8$all +||onedrive.live.com/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$all ||onedrive.live.com/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g$all ||onedrive.live.com/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g$all ||onedrive.live.com/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90$all @@ -3714,6 +3739,7 @@ zz.690tx.com ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm$all ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai$all ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk$all +||onedrive.live.com/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta$all ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa$all ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa$all ||onedrive.live.com/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e$all @@ -3773,11 +3799,6 @@ zz.690tx.com ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q$all ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw$all ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!141&authkey=alya4infudqs53o$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!142&authkey=aiemnxi-s-5vrz0$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21141&authkey=alya4infudqs53o$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0$all -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0&c=3ii9gcd&r=5onulz3wldybwlmup37su3&k=7s1&s=kzymn52eroemh1tamvmlsfsn9jtvwguukky5hlxcfgw$all ||onedrive.live.com/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe$all ||onedrive.live.com/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq$all ||onedrive.live.com/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4$all @@ -3811,6 +3832,7 @@ zz.690tx.com ||onedrive.live.com/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha$all ||onedrive.live.com/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha$all ||onedrive.live.com/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke$all +||onedrive.live.com/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21349&authkey=ae9ea8jdsa7vmom$all ||onedrive.live.com/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da$all ||onedrive.live.com/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu$all ||onedrive.live.com/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu$all @@ -3865,6 +3887,7 @@ zz.690tx.com ||onedrive.live.com/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21330&authkey=adxnzkb0a09pizw$all ||onedrive.live.com/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21333&authkey=aielwtaiuvcttlm$all ||onedrive.live.com/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21334&authkey=agsvox_t7qim4ta$all +||paste.ee/r/a39ev$all ||pastebin.com/raw/77jhk0iw$all ||pastebin.com/raw/89hkc7wb$all ||pastebin.com/raw/yqvsvlvq$all diff --git a/urlhaus-filter-rpz-online.conf b/urlhaus-filter-rpz-online.conf index 3f4ba64c..8fcc6871 100644 --- a/urlhaus-filter-rpz-online.conf +++ b/urlhaus-filter-rpz-online.conf @@ -1,12 +1,12 @@ ; Title: Online Malicious Domains RPZ Blocklist -; Updated: Thu, 08 Apr 2021 00:12:42 UTC +; Updated: Thu, 08 Apr 2021 12:12:46 UTC ; Expires: 1 day (update frequency) ; Homepage: https://gitlab.com/curben/urlhaus-filter ; License: https://gitlab.com/curben/urlhaus-filter#license ; Source: https://urlhaus.abuse.ch/api/ $TTL 30 -@ IN SOA rpz.curben.gitlab.io. hostmaster.rpz.curben.gitlab.io. 1617840775 86400 3600 604800 30 +@ IN SOA rpz.curben.gitlab.io. hostmaster.rpz.curben.gitlab.io. 1617883978 86400 3600 604800 30 NS localhost. 0-24bpautomentes.hu CNAME . @@ -15,12 +15,11 @@ $TTL 30 14karatvisions.com CNAME . 1am.co.nz CNAME . 21robo.com CNAME . -32792.prolocksmithwinterpark.com CNAME . 360.lcy2zzx.pw CNAME . 360down7.miiyun.cn CNAME . +4et3ja.am.files.1drv.com CNAME . 77st.net CNAME . 8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com CNAME . -87du.vip CNAME . 8poieq.bn.files.1drv.com CNAME . aatreefelling.co.za CNAME . abcd.bg CNAME . @@ -34,7 +33,6 @@ accesslinksgroup.com CNAME . aceeprc.com.aceeprc.com CNAME . acellr.co.uk CNAME . acteon.com.ar CNAME . -activecost.com.au CNAME . addahealingmusic.com CNAME . adithimedia.com CNAME . adithimedia.memengers.com CNAME . @@ -94,11 +92,14 @@ aps-sv.com CNAME . artedibujoyarquitectura.com CNAME . arwenyapi.com CNAME . ask-regard.call-save.biz CNAME . +asucssa.live CNAME . atfile.com CNAME . athenacapsg.com CNAME . +atlasconcreteworks.com CNAME . attach.66rpg.com CNAME . atteuqpotentialunlimited.com CNAME . augustair.com CNAME . +aulist.com CNAME . automaticrefreshments.com CNAME . avadhanagames.com CNAME . ayahuascasp.com.br CNAME . @@ -114,6 +115,7 @@ bangladeshunbound.com CNAME . bary.sz4h.com CNAME . bash.givemexyz.in CNAME . bausch.kr-atlas.monaxikoslykos@zytrox.tk CNAME . +bavhome.com CNAME . bbia.co.uk CNAME . bcmt.elin.co.za CNAME . bcrg.co.za CNAME . @@ -165,7 +167,6 @@ browardinsurancemiami.solucioneslink.com CNAME . bt2.elin.co.za CNAME . btdapi.robotake.com CNAME . buigiaphat.com.vn CNAME . -bulkyfoodja.com CNAME . bullseyemedia.in CNAME . busandvanrentalmalaysia.com CNAME . buscascolegios.diit.cl CNAME . @@ -179,11 +180,8 @@ cacaoprojects.com CNAME . calgaryautorepairservice.com CNAME . callbury.in CNAME . camminachetipassa.it CNAME . -canadianwork.cc CNAME . capitalgroup-kw.com CNAME . capoeiraventrelivre.com CNAME . -carlsbadre.com CNAME . -carsidecor.com CNAME . cashyinvestment.org CNAME . catchperch.com CNAME . catchpoolshetlands.co.uk CNAME . @@ -220,7 +218,6 @@ colinde.pricesne.com CNAME . colorpak.pl CNAME . columbia.aula-web.net CNAME . community.reimclub.com CNAME . -comosairdoburaco.com.br CNAME . competancy.indigoconsult.net CNAME . conceptimagine.ro CNAME . config.cqhbkjzx.com CNAME . @@ -229,12 +226,14 @@ constructoralyon.com CNAME . consulateins.solucioneslink.com CNAME . contributeindustry.com CNAME . copelandscapes.com CNAME . +corwin-tommie06f.ru.com CNAME . coulsongraphics.com CNAME . count.mail.163.com.impactmedfoundation.com CNAME . covid19.cyberschool.or.id CNAME . cpanel.shivay.net CNAME . cr-sq.com CNAME . craftech.nxtnet.ga CNAME . +crearechile.cl CNAME . creationskateboards.com CNAME . crecerco.com CNAME . crittersbythebay.com CNAME . @@ -244,6 +243,7 @@ crmroche.manivelasst.com CNAME . crscorretordeimoveis.com.br CNAME . cse-engineer.com CNAME . csnserver.com CNAME . +ctracknxt.in CNAME . cubescargoexpress.com CNAME . curasoles.co.za CNAME . currantmedia.com CNAME . @@ -262,7 +262,6 @@ datapolish.com CNAME . dating.khokhas.co.za CNAME . datsom.vn CNAME . davethompson.me.uk CNAME . -davidmcguinness.info CNAME . dayspringdaisies.com CNAME . dd.qiyuea.cn CNAME . ddns.cyberium.cc CNAME . @@ -296,14 +295,11 @@ dl.198424.com CNAME . dl.installcdn-aws.com CNAME . dl.packetstormsecurity.net CNAME . dl.rina-roleplay.com CNAME . -dnn.alibuf.com CNAME . -dns.alibuf.com CNAME . dockerupdate.anondns.net CNAME . docman.orientalservices.in CNAME . dodsonimaging.com CNAME . doitunlimited.com CNAME . dokan.blueberrytec.com CNAME . -dom-chel74.ru CNAME . dom.daf.free.fr CNAME . doncedyhall.com CNAME . donghobinhminh.com CNAME . @@ -313,6 +309,7 @@ dosame.com CNAME . dosman.pl CNAME . dovberger.com CNAME . down.pcclear.com CNAME . +down.udashi.com CNAME . down.webbora.com CNAME . down1.arpun.com CNAME . download.caihong.com CNAME . @@ -343,6 +340,7 @@ e.sldov.ru CNAME . eandgdesign.com.ng CNAME . eastsheen-glaziers.co.uk CNAME . ebruyatkin.com CNAME . +edu.saicraftsman.com CNAME . eedo.ee CNAME . efficientegroup.com CNAME . elbauldenora.com CNAME . @@ -357,8 +355,8 @@ erp.nanotechproautocare.com CNAME . erp.zilymax.com CNAME . escola.probommar.org.br CNAME . esnconsultants.com CNAME . -esrhf04.top CNAME . essentia.org.br CNAME . +estjh05.top CNAME . ethereality.info CNAME . eubanks7.com CNAME . europeanzonexxi.com CNAME . @@ -427,9 +425,11 @@ goldcoastoffice365.com CNAME . goldcoastoffice365.com.au CNAME . golden-memories-funerals.yourpageserver.com CNAME . goldenasiacapital.com CNAME . +goldmen.in CNAME . gpotecnosystems.com CNAME . gracejukes.com CNAME . grupoinmare.com CNAME . +gruposelt.000webhostapp.com CNAME . gs.monerorx.com CNAME . guide-to-cell-phones.com CNAME . gulfac-house.com CNAME . @@ -457,6 +457,7 @@ hitstation.nl CNAME . hmpmall.co.kr CNAME . hoagietesting10.com CNAME . hoayeuthuong-my.sharepoint.com CNAME . +holmesservices.mobiledevsite.co CNAME . homefindersolutions.com CNAME . hongluosi.com CNAME . hookedupboatclub.com CNAME . @@ -469,6 +470,7 @@ hsmwebapp.com CNAME . htownbars.com CNAME . hubtech.co.za CNAME . huellacero.cl CNAME . +hunchomusichub.com CNAME . hunggiang.vn CNAME . husamiyahschool.com CNAME . iabmixx2020.rayadigital.online CNAME . @@ -520,7 +522,6 @@ jathra.co.uk CNAME . jay.diamondrelationscrm.us CNAME . jebs.net.au CNAME . jeffdahlke.com CNAME . -jhayesconsulting.com CNAME . jiaoyuzixun.cn CNAME . jing-da.com.tw CNAME . jmtc.91756.cn CNAME . @@ -534,7 +535,6 @@ jumpmanualjacobhiller.com CNAME . jupiter.toxsl.in CNAME . justinscott.com.au CNAME . kadigital.co.uk CNAME . -kaizenjanitorial.com CNAME . kalawatihomes.com CNAME . kalogirosfinance.com CNAME . kaptaanchapal.com CNAME . @@ -545,17 +545,15 @@ kensingtondriving.com CNAME . ketofitnessexpert.com CNAME . kevinjewelry.com.co CNAME . keywatch.yourpageserver.com CNAME . -khmerosja.net CNAME . kingssa.co.za CNAME . kizitox.ga CNAME . kjcpromo.com CNAME . -kldatabase.com CNAME . kleinendeli.co.za CNAME . korrectconceptservices.com CNAME . krisbadminton.com CNAME . ktb.sch.id CNAME . kubatoglubaklava.com.tr CNAME . -kullumanalitours.com CNAME . +kumaralok.in CNAME . kwanfromhongkong.com CNAME . kz.sldov.ru CNAME . lacasadelosalebrijes.com CNAME . @@ -564,7 +562,6 @@ lameguard.ru CNAME . laodongnhat.vn CNAME . laravel.pointersoftwares.com.br CNAME . lasermobilesounds.co.uk CNAME . -laura9630fr.com CNAME . lauratomismith.com CNAME . lautarosanmiguel.com CNAME . lawforall.edu.lk CNAME . @@ -666,14 +663,12 @@ mis.nbcc.ac.th CNAME . misterson.com CNAME . mkontakt.az CNAME . mktf.mx CNAME . -mmdx.com CNAME . mmogollon.com.mx CNAME . mncarteam.com CNAME . modelhouseturkey.com CNAME . modernmanna.org CNAME . monetization.business CNAME . moninediy.com CNAME . -mopai.sg CNAME . motorcomunicacion.com CNAME . moumitas.com CNAME . msacontabil.com.br CNAME . @@ -692,7 +687,7 @@ namnyak.co.ke CNAME . nap.mgsservers.com CNAME . navayurveda.in CNAME . nec-i.com CNAME . -nellaimasthanbiryani.com CNAME . +nelitrianggraeni.000webhostapp.com CNAME . nerve.untergrund.net CNAME . nettube.com.br CNAME . networkwheels.co.za CNAME . @@ -711,6 +706,7 @@ nilehouse.co.ug CNAME . nilinkeji.com CNAME . nimboohomes.com CNAME . njtiledesigncenter.com CNAME . +nmxwllwsdyminoragenw.dns.army CNAME . nobius.org CNAME . nocalnoodle.elin.co.za CNAME . nomadicbees.com CNAME . @@ -724,6 +720,7 @@ nyasabigbullets.com CNAME . nyeh2o.com.au CNAME . obseques-conseils.com CNAME . oecteam.com CNAME . +ohe.ie CNAME . ohsewgorgeous.co.uk CNAME . oknoplastik.sk CNAME . oleholeh.memangbeda.website CNAME . @@ -756,6 +753,7 @@ pacwebdesigns.com CNAME . pagos.krayem.com.mx CNAME . palbas.cl CNAME . palochusvet.szm.com CNAME . +panslimiterd.com CNAME . parallel.rockvideos.at CNAME . parejasfelices.mi-fs.com CNAME . parkhussion.com CNAME . @@ -786,6 +784,7 @@ pink99.com CNAME . plasfan.ind.br CNAME . playground2.grupoaliadasca.com CNAME . pmglance.startwriteup.com CNAME . +pmrimewsdylimtewsogh.dns.army CNAME . pokojewewladyslawowie.pl CNAME . pole.com.vc CNAME . pool.phxdir.com CNAME . @@ -799,7 +798,6 @@ preview2.behalen.com CNAME . prishaartcreations.com CNAME . production.sparshims.com CNAME . programaoperadoronline.com.br CNAME . -project.exquitec.com CNAME . promotoradescomplica.com.br CNAME . promoversdubai.com CNAME . propertiq.elin.co.za CNAME . @@ -809,7 +807,6 @@ prosupport.cl CNAME . prosyarmakassar.com CNAME . provence.elin.co.za CNAME . prox.realunix.cc CNAME . -prueba.danielluza.com CNAME . pujashoppe.in CNAME . punchdialogues.com CNAME . punjabdevelopersassociation.com.pk CNAME . @@ -824,7 +821,6 @@ radioafifense.deploys.live CNAME . rainbowisp.info CNAME . rajeshtailang.com CNAME . rakeshkhatri.in CNAME . -raodigitalmedia.com CNAME . raquelhelena.com.br CNAME . rarlabarchiver.ac CNAME . rasadbar.ir CNAME . @@ -838,7 +834,6 @@ readwrite26.nl CNAME . readymmade.com CNAME . recyclethesurplus.com CNAME . redbats.co.in CNAME . -redboxmultimedia.com CNAME . redchillicrackers.com CNAME . reifenquick.de CNAME . relaxindulge.co.nz CNAME . @@ -921,7 +916,6 @@ shopsofe.com CNAME . sibernetix.fr CNAME . sigapresschennai.com CNAME . sige.brisainformatica.com.br CNAME . -signatureads.co.in CNAME . siili.net CNAME . simoneporzi.it CNAME . simorsint.com CNAME . @@ -957,7 +951,6 @@ spent.com.pl CNAME . spetsesyachtcharter.gr CNAME . spititourism.com CNAME . spittinfire.com CNAME . -springbedspetroleum.com CNAME . src1.minibai.com CNAME . sreenivasapaintingworks.com CNAME . sriglobalit.com CNAME . @@ -999,12 +992,12 @@ tafsantoursandtravels.com CNAME . tajushariya.com CNAME . tallyinvoicecustomization.com CNAME . taltus.co.uk CNAME . -tapalkoedacoffee.com CNAME . tarravalleyfoods.com.au CNAME . tavo.cl CNAME . tc.snpsresidential.com CNAME . tcy.198424.com CNAME . tdsp.yngw518.com CNAME . +tech332.synology.me CNAME . techgms.com CNAME . teduae.com CNAME . teleargentina.com CNAME . @@ -1043,6 +1036,7 @@ themansionkasauli.com CNAME . theprofinn.com CNAME . thesummitpc.net CNAME . theurbantutors.com CNAME . +theviewsdyjupcazfeqv.dns.army CNAME . thosewebbs.com CNAME . thriveink.com CNAME . tianangdep.com CNAME . @@ -1060,6 +1054,7 @@ topcell9.com CNAME . toplevel.com.br CNAME . topmask.co.za CNAME . torresquinterocorp.com CNAME . +towme.services CNAME . toyotacollege.ac.th CNAME . tpke.hu CNAME . translaterjemah.com CNAME . @@ -1083,8 +1078,7 @@ ultimate-24.de CNAME . umwelt-kirchhof.de CNAME . unicorpbrunei.com CNAME . uniengrisb.com CNAME . -unisoftcc.com CNAME . -unityindiversity.in CNAME . +unitedwsdykesokowskg.dns.army CNAME . unyazitelecom.com CNAME . upcbpta.com CNAME . urbantrapfest.cl CNAME . @@ -1092,6 +1086,7 @@ used-jeans.fr CNAME . useformoney.000webhostapp.com CNAME . uss.ac.th CNAME . uzzepay.com.br CNAME . +v2consultores.com CNAME . vanzare.cabanabrazi2.ro CNAME . vbcargo.hu CNAME . vcah.co.uk CNAME . @@ -1151,11 +1146,14 @@ wolfgang-brodte.de CNAME . woodsytech.com CNAME . wordpress.saleensuporte.com.br CNAME . workingsolutionsrome.org CNAME . -wozata.000webhostapp.com CNAME . wp.readhere.in CNAME . wpdemo.101clients.com.au CNAME . writtendeer.com CNAME . ws5588.f3322.net CNAME . +wsdyalgreenkelveskxz.dns.army CNAME . +wsdykungsb2talenwsjf.dns.army CNAME . +wsdyrkkrgorgiousejhd.dns.army CNAME . +wsdysara1investvwsfs.dns.army CNAME . wsdysuresbonescagegp.dns.army CNAME . wyklej.pl CNAME . x2vn.com CNAME . diff --git a/urlhaus-filter-rpz.conf b/urlhaus-filter-rpz.conf index 4049cfd9..b451d246 100644 --- a/urlhaus-filter-rpz.conf +++ b/urlhaus-filter-rpz.conf @@ -1,12 +1,12 @@ ; Title: Malicious Domains RPZ Blocklist -; Updated: Thu, 08 Apr 2021 00:12:42 UTC +; Updated: Thu, 08 Apr 2021 12:12:46 UTC ; Expires: 1 day (update frequency) ; Homepage: https://gitlab.com/curben/urlhaus-filter ; License: https://gitlab.com/curben/urlhaus-filter#license ; Source: https://urlhaus.abuse.ch/api/ $TTL 30 -@ IN SOA rpz.curben.gitlab.io. hostmaster.rpz.curben.gitlab.io. 1617840775 86400 3600 604800 30 +@ IN SOA rpz.curben.gitlab.io. hostmaster.rpz.curben.gitlab.io. 1617883978 86400 3600 604800 30 NS localhost. 0-24bpautomentes.hu CNAME . @@ -243,6 +243,7 @@ $TTL 30 123moviesfx.com CNAME . 123sellfast.com CNAME . 123sex.co CNAME . +123tadi.com CNAME . 123xyz.xyz CNAME . 124.com.ua CNAME . 124.cpanel.realwebsitesite.com CNAME . @@ -1195,6 +1196,7 @@ $TTL 30 4ele.pl CNAME . 4ertybhdfrt.gq CNAME . 4esports.de CNAME . +4et3ja.am.files.1drv.com CNAME . 4evakleen.com.au CNAME . 4eventfacilities.nl CNAME . 4evernails.nl CNAME . @@ -1781,6 +1783,7 @@ $TTL 30 999.buzz CNAME . 999.co.id CNAME . 999.rajaojek.com CNAME . +999080321newfolder1002002131-service1002.space CNAME . 999102com.cn CNAME . 99bkx.com CNAME . 99centsdigitals.com CNAME . @@ -3968,6 +3971,7 @@ ahiraatfashion.com CNAME . ahiskatv.net CNAME . ahitekniktarti.com CNAME . ahiyangrup.com.tr CNAME . +ahjianlong.cf CNAME . ahjuric.si CNAME . ahk.smu8street.ru CNAME . ahkha.com CNAME . @@ -4392,6 +4396,7 @@ akito.be CNAME . akivj07.top CNAME . akktis.com CNAME . akkurtmadencilik.com CNAME . +aklatdelmundo.com CNAME . akleigh.com CNAME . aklin.ir CNAME . aklocalshop.com CNAME . @@ -5104,7 +5109,6 @@ alladinonlinee.com CNAME . allainesconsultancyinc.com CNAME . allamanolibrary.com CNAME . allan-it.com CNAME . -allanabolicsteam.net CNAME . allanelect.co.uk CNAME . allangillphotography.com CNAME . allanhollowell.com CNAME . @@ -5378,6 +5382,7 @@ alona.org.cy CNAME . aloneintheweb.com CNAME . aloneskisehir.com CNAME . alongthelines.com CNAME . +alongwalker.com CNAME . alonhadat24h.vn CNAME . alooshop.ir CNAME . aloravan.com CNAME . @@ -6135,7 +6140,6 @@ an9news.com CNAME . ana.plecko.eu CNAME . anaaj.pk CNAME . anabim.com CNAME . -anabolicsteroidsbuy.info CNAME . anaceb.com CNAME . anadearmas.net CNAME . anadelgbt.org CNAME . @@ -10108,7 +10112,6 @@ b94yhzk.com CNAME . b97pm6.com CNAME . ba3capital.com CNAME . baacsetu.org CNAME . -baadababada.ru CNAME . baaders-namibia.com CNAME . baakcafe.com CNAME . baamiraan.ir CNAME . @@ -10230,7 +10233,6 @@ backup.utlitslaekning.is CNAME . backup.xn----8sba7bmrlhv0a.xn--p1ai CNAME . backup2.robinandelaine.com CNAME . backupcom.e-twow.uk CNAME . -backupez.com CNAME . backupfashions.com CNAME . backupsitedev.flywheelsites.com CNAME . backupsql.datasiswebcontable.com CNAME . @@ -11613,7 +11615,6 @@ belayadver.com CNAME . belaythakayni.com CNAME . belboks.com CNAME . belboy.in CNAME . -belcineloweek.ru CNAME . belconger.com CNAME . belcorpisl.com CNAME . belcvet.com CNAME . @@ -14172,7 +14173,6 @@ bobbyterry.top CNAME . bobbyworld.top CNAME . bobcar.com.my CNAME . bobcatofchico.com CNAME . -bobcatofredding.com CNAME . bobcook.ca CNAME . bobdolph.com CNAME . bobenstetter.net CNAME . @@ -15424,7 +15424,6 @@ bucketlistrecipes.com CNAME . bucketstrong.s3-us-west-1.amazonaws.com CNAME . buckeyechartershiltonhead.com CNAME . buckeyeoptical.com CNAME . -buckeyesecurity.net CNAME . buckinghamandlloyds.com CNAME . buckleman.co.id CNAME . bucklindata.net CNAME . @@ -15513,6 +15512,7 @@ buildchem.pk CNAME . buildcraftindia.com CNAME . buildentconstructions.com CNAME . builder.acasia.mx CNAME . +builder.makemoneywith.website CNAME . buildersmerchantsfederation-my.sharepoint.com CNAME . buildgreenindustries.com CNAME . building-company.lt CNAME . @@ -16056,7 +16056,6 @@ c.mymortgagegenius.ca CNAME . c.oooooooooo.ga CNAME . c.pieshua.com CNAME . c.teamworx.ph CNAME . -c.top4top.io CNAME . c.top4top.net CNAME . c.vivi.casa CNAME . c.vollar.ga CNAME . @@ -16728,6 +16727,7 @@ capitalnewsagency.com CNAME . capitalonefinanceltd.in CNAME . capitalpellets.com CNAME . capitalpremiumfinancinginc.com CNAME . +capitalprint.co.za CNAME . capitalprivateasset.com CNAME . capitalrealestate.us CNAME . capitalrh.com.br CNAME . @@ -21568,6 +21568,7 @@ covid19.peaceforchildren.net CNAME . covid19map.digital CNAME . covid19quarantin.com CNAME . covid19safety.myftp.org CNAME . +covid19vaccinations.hopto.org CNAME . covid19vaccine.hopto.org CNAME . covid2023.info CNAME . covidbase.info CNAME . @@ -22926,6 +22927,7 @@ dacle.eu CNAME . daclim.ro CNAME . daco-precision.thomaswebs.net CNAME . daco.nyccomputerconsulting.com CNAME . +dacsancaonguyen.vn CNAME . dactridaudaday.com CNAME . dactyltech.co.za CNAME . dacviadokese.com CNAME . @@ -31570,6 +31572,7 @@ estiloraropremium.com.br CNAME . estimating.training CNAME . estimatorfind.com CNAME . estimetercume.com CNAME . +estjh05.top CNAME . estore.qurvex.com CNAME . estoyadieta.com CNAME . estrategias-corporativas.com CNAME . @@ -31745,7 +31748,6 @@ etwqsx23.duckdns.org CNAME . etxse.xyz CNAME . etysu02scnabr03wzaxue.com CNAME . eu-easy.com CNAME . -eu.wildfire.paloaltonetworks.com CNAME . eu1.salesforce.com CNAME . eu283iwoqodjspqisjdf.com CNAME . eu5-cdn.devid.info CNAME . @@ -33889,7 +33891,6 @@ files.danwin1210.me CNAME . files.dropmybin.me CNAME . files.enjin.com CNAME . files.gathercdn.com CNAME . -files.hrloo.com CNAME . files.l-d.tech CNAME . files.martellexpress.us CNAME . files.mirai-2viv.vn CNAME . @@ -35622,6 +35623,7 @@ friendsstarintl.com CNAME . friendzonecafe.com CNAME . frietfun.be CNAME . frigolutasima.net CNAME . +frigoprehrana.com CNAME . frigoriferivignola.it CNAME . frigotechniek.be CNAME . frigsales.com CNAME . @@ -36103,7 +36105,6 @@ fuzzymiles.com CNAME . fv1-2.failiem.lv CNAME . fv13.failiem.lv CNAME . fv15.failiem.lv CNAME . -fv2-2.failiem.lv CNAME . fv2-7.failiem.lv CNAME . fv3.failiem.lv CNAME . fv6.failiem.lv CNAME . @@ -36181,7 +36182,6 @@ g0ogle.free.fr CNAME . g0zh8lb3.com CNAME . g15aocbenedict.com CNAME . g1ba4tt4ngq5nl7w.xyz CNAME . -g1smurt.ru CNAME . g20digital.com.br CNAME . g237.cn CNAME . g2creditsolutions.com CNAME . @@ -36269,9 +36269,6 @@ gadanie-lidia.ru CNAME . gadaniya-magiya.site CNAME . gadcoafrica.com CNAME . gaddco.com CNAME . -gade4senate.com CNAME . -gadebrigade.com CNAME . -gadeforussenate.com CNAME . gadem.ug CNAME . gadesoluciones.pe CNAME . gadget-plaza.ru CNAME . @@ -38419,6 +38416,7 @@ gomiles.vn CNAME . gomitra.com CNAME . gomovies.cl CNAME . gomsubattrangxuatkhau.com CNAME . +gomsuminhlongthainguyen.vn CNAME . gomus.com.br CNAME . gomyfiles.info CNAME . gomypass.com CNAME . @@ -39917,7 +39915,6 @@ h-w-c.net CNAME . h.epelcdn.com CNAME . h.eurotrading.com.pl CNAME . h.j990981.ru CNAME . -h.top4top.io CNAME . h.valerana44.ru CNAME . h002295863.nichost.ru CNAME . h0h.org CNAME . @@ -42147,7 +42144,6 @@ home-spy-shop.com CNAME . home.99eurowebsite.ie CNAME . home.barley-plus.com CNAME . home.dawang.ink CNAME . -home.earthlink.net CNAME . home.evrstudio.com CNAME . home.healthiestu.com CNAME . home.isdes.com CNAME . @@ -42517,6 +42513,7 @@ hosteriapuestadelsol.com CNAME . hostfleek.com CNAME . hostgo.com.br CNAME . hostile-gaming.fr CNAME . +hostimpel.com CNAME . hosting-c.iuro.nl CNAME . hosting.drupwayinfotech.in CNAME . hosting.mrsofttech.com CNAME . @@ -48973,6 +48970,7 @@ kabek.vn CNAME . kabelinieseti.ru CNAME . kabiguru.org CNAME . kabiledans.com CNAME . +kabimmo.com CNAME . kabinarf.ru CNAME . kabiru.ru CNAME . kabiryogashramlimbdi.com CNAME . @@ -50390,7 +50388,6 @@ killu.in CNAME . kilnrefractory.com CNAME . kilolo.site CNAME . kilop.goodvibeskickin.com CNAME . -kilopaskal.ru CNAME . kimaco.com CNAME . kimberly.digital CNAME . kimberly5esthetique.com CNAME . @@ -50722,7 +50719,6 @@ klasterpolskanatura.pl CNAME . klaus-moersch.de CNAME . klausnerlaw.com CNAME . klaussen.net CNAME . -klaustrofebia.ru CNAME . klavze28.com CNAME . klbay.net CNAME . kldatabase.com CNAME . @@ -53624,6 +53620,7 @@ library.arihantmbainstitute.ac.in CNAME . library.cifor.org CNAME . library.dhl-xom.com CNAME . library.iainbengkulu.ac.id CNAME . +library.mju.ac.th CNAME . library.phibi.my.id CNAME . library.piet.co.in CNAME . library.strophicmusic.com CNAME . @@ -55396,7 +55393,6 @@ luminousinvestment.com CNAME . luminouspla.net CNAME . luminouspneuma.com CNAME . lumnus.com.br CNAME . -lumoura.com CNAME . lumperpush.com CNAME . lumsdancorp.com CNAME . lun.otrweb.ru CNAME . @@ -55558,6 +55554,7 @@ lyhnb.club CNAME . lykangblog.com CNAME . lykusglobal.com CNAME . lylevr.com CNAME . +lyllacarter.com CNAME . lylydressforless.com CNAME . lymcomercial.cl CNAME . lymfodrenaze.eu CNAME . @@ -58714,6 +58711,7 @@ medicina.uanl.mx CNAME . medicinadellavoromb.it CNAME . medicinaesteticaorlandini.it CNAME . medicinageriatrica.com.br CNAME . +medicinainterna-critica.com CNAME . medicinaonline.rjsrwaco.watchdogdns.duckdns.org CNAME . medicine.softberg.ro CNAME . mediclaim.odhavnidhi.org CNAME . @@ -61884,6 +61882,7 @@ mtbplus.de CNAME . mtcinteriordesign.co.uk CNAME . mtcr.co.za CNAME . mtcuadrado.com CNAME . +mtdc.com.my CNAME . mte1.cn CNAME . mtechagency.com CNAME . mteestore.com CNAME . @@ -62580,7 +62579,6 @@ myhygienemart.com CNAME . myimmigrationlawmarketingpartner.com CNAME . myimmogroup.be CNAME . myinfoart.online CNAME . -myinstabuzzz.co CNAME . myinstantguru.com CNAME . myinternetjobs.com CNAME . myintromationsz.win CNAME . @@ -62606,6 +62604,7 @@ mylifestoryfilm.com CNAME . mylinkguard.com CNAME . mylistbuildingtraffic.com CNAME . mylisting.martinface.com CNAME . +myliverpoolnews.cf CNAME . myloanbaazar.com CNAME . myloanexpert.in CNAME . mylocal.dk CNAME . @@ -64195,6 +64194,7 @@ news.iid-mit.com.tw CNAME . news.intertours.org.rs CNAME . news.leta.com.vn CNAME . news.lwinmoenaing.me CNAME . +news.makemoneywith.website CNAME . news.medicaid.ir CNAME . news.omumusic.net CNAME . news.palette69.com CNAME . @@ -64978,6 +64978,7 @@ nms.evertechit.live CNAME . nmsk.online CNAME . nmsr.info CNAME . nmvconstructions.com CNAME . +nmxwllwsdyminoragenw.dns.army CNAME . nn-webdesign.be CNAME . nn.5ctelematics.com CNAME . nnasout.com CNAME . @@ -65758,7 +65759,6 @@ nvdvdgp.com CNAME . nvdweb.azurewebsites.net CNAME . nveeusa.com CNAME . nvelj12qyyfi03kqxy.xyz CNAME . -nvgeeforsegt.ru CNAME . nvgp.com.au CNAME . nvi.edu.vn CNAME . nvl.netsmartz.net CNAME . @@ -66976,7 +66976,6 @@ onlusarcadia.it CNAME . only4atalg.ml CNAME . onlyapteka.ru CNAME . onlyart.in CNAME . -onlybamboofabrics.com CNAME . onlycane.in CNAME . onlychild.org CNAME . onlycocktaildresses.com CNAME . @@ -68966,6 +68965,7 @@ payyosafoolayzp.com CNAME . pazarcheto.com CNAME . pazargezer.com CNAME . pazcomau-my.sharepoint.com CNAME . +pazpus.com CNAME . pb-xt.com CNAME . pb.divaasolutions.com CNAME . pb128o6c2favwk.com CNAME . @@ -70711,6 +70711,7 @@ pmrimesndylimtdvensn.dns.army CNAME . pmrimestdylimtdvenst.dns.army CNAME . pmrimestdylimtdvests.dns.army CNAME . pmrimestdylimtstwork.dns.army CNAME . +pmrimewsdylimtewsogh.dns.army CNAME . pmrimewsdylimtwswods.dns.army CNAME . pms.stercomagento.com CNAME . pmsports.de CNAME . @@ -72429,6 +72430,7 @@ prostranstvorosta.ru CNAME . prosupport.cl CNAME . prosvyaz.kz CNAME . prosyarmakassar.com CNAME . +prosystemsug.com CNAME . prosysvinorosso.com CNAME . prot.drupal8.softikom.lv CNAME . protaciohospital.com CNAME . @@ -72439,7 +72441,6 @@ protech.binarybizz.com CNAME . protech.mn CNAME . protechcarpetcare.com CNAME . protechgroup1.com CNAME . -protect.mimecast-offshore.com CNAME . protectiadatelor.biz CNAME . protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org CNAME . protection.pecol.eu CNAME . @@ -73639,6 +73640,7 @@ quatanggmt.com CNAME . quatanghoanglong.com CNAME . quatangluuniemhue.com CNAME . quatangtaynguyen.com CNAME . +quatangtaynguyen.vn CNAME . quatest.sixstarsent.com CNAME . quatet365.com CNAME . quatram.de CNAME . @@ -73704,6 +73706,7 @@ quickbook.online CNAME . quickbookstechnicalsupportphonenumber.com CNAME . quickboooks.host CNAME . quickboooks.space CNAME . +quickcompanyreg.co.za CNAME . quickfingers.net CNAME . quickinsolutions.com CNAME . quicklifecare.com CNAME . @@ -76305,7 +76308,6 @@ roads.stamperinc.org CNAME . roadscompass.com CNAME . roadtravelcars.com CNAME . roanokecellphonerepair.com CNAME . -roanokemortgages.com CNAME . roastedguarmeal.com CNAME . roba.nu CNAME . robaitec.com CNAME . @@ -78677,6 +78679,7 @@ savannaopticalsgh.com CNAME . savasaachi.systems CNAME . savaspark.com.tr CNAME . save-room.info CNAME . +save.makemoneywith.website CNAME . save24x7.com CNAME . saveanimal.org CNAME . savecannabis.org CNAME . @@ -82337,6 +82340,7 @@ slrent.com CNAME . slrpros.com CNAME . sls-eg.com CNAME . sls-security.ru CNAME . +slsbearings.com.sg CNAME . slservicebd.com CNAME . slubnefury.pl CNAME . slugard.5gbfree.com CNAME . @@ -84269,7 +84273,6 @@ srmfiresafety.com CNAME . srnirob.com CNAME . srno.hu CNAME . sromano.it CNAME . -sromecorlduce.ru CNAME . sroomf70nasiru.duckdns.org CNAME . srooooiva.ru CNAME . srpresse.fr CNAME . @@ -86098,7 +86101,6 @@ sunfloro.com CNAME . sunflowerschoolandcollege.com CNAME . sunfruit.com.tn CNAME . sunganak.in CNAME . -sungardspo.com CNAME . sungazer.com.au CNAME . sunglasses2020.com CNAME . sungvalopkhongsam.com CNAME . @@ -89498,6 +89500,7 @@ thefoxfestival.com CNAME . thefragrancefreeshop.com CNAME . thefranssons.com CNAME . thefreelancerschool.com CNAME . +thefrees.com CNAME . thefreewaterfoundation.org.za CNAME . thefront.in CNAME . thefuel.be CNAME . @@ -90082,6 +90085,7 @@ theviestdyjupcafgcms.dns.army CNAME . theviestdyjupcafgmcn.dns.army CNAME . theviestdyjupcafgsvb.dns.army CNAME . theviestdyjupcazfest.dns.navy CNAME . +theviewsdyjupcazfeqv.dns.army CNAME . theviewsdyjupcazwsgv.dns.army CNAME . thevilla46.com CNAME . thevine-organizasyon.com CNAME . @@ -90585,6 +90589,7 @@ timelyent.com CNAME . timelyrain.top CNAME . timenard.top CNAME . timenotbesea.xyz CNAME . +timenow.pw CNAME . timenowis1.top CNAME . timeoffer.site CNAME . timeofvape.tk CNAME . @@ -92350,7 +92355,6 @@ trusticar.lt CNAME . trustinspect.com CNAME . trustlancers.com CNAME . trustorbit.com CNAME . -trustpilot-scam.com CNAME . trustpropertyholdings.com CNAME . trustrambusinesssolutions.com CNAME . trustrobins.info CNAME . @@ -92397,6 +92401,7 @@ ts-deals.me CNAME . ts.7rb.xyz CNAME . ts0ev73.com CNAME . tsal.com CNAME . +tsapparel.com.my CNAME . tsareva-garden.ru CNAME . tsatsi.co.za CNAME . tsauctions.com CNAME . @@ -92958,7 +92963,6 @@ u0649681.cp.regruhosting.ru CNAME . u0707115.cp.regruhosting.ru CNAME . u0746219.cp.regruhosting.ru CNAME . u0774849.cp.regruhosting.ru CNAME . -u1.huatu.com CNAME . u1.innerpeer.com CNAME . u11123p7833.web0104.zxcs.nl CNAME . u1141p8807.web0103.zxcs.nl CNAME . @@ -93701,6 +93705,7 @@ unitedworks.info CNAME . unitedwsdy5defenceforgorvermentsocialeme.duckdns.org CNAME . unitedwsdykesokowsbv.dns.army CNAME . unitedwsdykesokowsgs.dns.army CNAME . +unitedwsdykesokowskg.dns.army CNAME . unitedwsdykesokowsku.dns.army CNAME . unitedwsdykesokowsri.dns.navy CNAME . unitedyfl.com CNAME . @@ -94101,7 +94106,6 @@ url5459.41southbar.com CNAME . url675.textilmallorca.com CNAME . url9823.ville.labrecque.qc.ca CNAME . urlac.de CNAME . -urldefense.us CNAME . urleddrug.at CNAME . urlfrance.fr CNAME . urlm.ir CNAME . @@ -94228,7 +94232,6 @@ uspeshnybusiness.ru CNAME . uspslabel.itemdb.com CNAME . uss.ac.th CNAME . uss21.com CNAME . -ussbd.net CNAME . usselfstoragenetwork.com CNAME . ussrback.com CNAME . ussrgun.000webhostapp.com CNAME . @@ -94343,6 +94346,7 @@ uy-akwaibom.ru CNAME . uyaiblog.com CNAME . uycqawua.applekid.cn CNAME . uydu.antalyaelektrikariza.net CNAME . +uyen.vn CNAME . uyencometics.bmt.city CNAME . uyencuentra.com CNAME . uyf.com.ua CNAME . @@ -98815,7 +98819,6 @@ wotan.info CNAME . wotehb.com CNAME . wotsuper.pw CNAME . wotsuper3.exe CNAME . -wouatiareves.ru CNAME . wourionlion.ru CNAME . woutaalexp.com CNAME . wouterwolf.com CNAME . @@ -99036,6 +99039,7 @@ wsdshipping.com CNAME . wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org CNAME . wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org CNAME . wsdyalgreenkeghewsmq.dns.army CNAME . +wsdyalgreenkelveskxz.dns.army CNAME . wsdyalhjchfonlinedws.dns.navy CNAME . wsdyalhjchfonlinwsdf.dns.army CNAME . wsdyalhjchfonlinwsed.dns.army CNAME . @@ -99059,10 +99063,12 @@ wsdyclntnjkcloudwsgh.dns.army CNAME . wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org CNAME . wsdyibgreenkegheedws.dns.navy CNAME . wsdyibgreenkeghewsyt.dns.army CNAME . +wsdyibgreenventureqx.dns.army CNAME . wsdykalamikonlinedeliverystoreservwspmq.ydns.eu CNAME . wsdykung38communicationtarisupliermgapc.duckdns.org CNAME . wsdykungsb2gotchtsub.dns.army CNAME . wsdykungsb2gotchtwsp.dns.army CNAME . +wsdykungsb2talenwsjf.dns.army CNAME . wsdykungsb2talenwsmz.dns.army CNAME . wsdymsloginvestmwsqd.dns.army CNAME . wsdymsloginvestmwsrw.dns.army CNAME . @@ -99075,9 +99081,11 @@ wsdynitengymndynatem.dns.army CNAME . wsdynitengymndynatin.dns.army CNAME . wsdypmrimelimtdvenws.dns.army CNAME . wsdypmrimelimtdvewsd.dns.army CNAME . +wsdyrkkrgorgiousejhd.dns.army CNAME . wsdyrkkrsuccessmorev.dns.army CNAME . wsdyrkkrsuccessmoven.dns.army CNAME . wsdyrmtcntlfarmtwsvb.dns.army CNAME . +wsdysara1investvwsfs.dns.army CNAME . wsdyshgshg2induswsjg.dns.army CNAME . wsdyshgshgnationalindustrialandgoogledns.duckdns.org CNAME . wsdyshgshgnationalobjindustrialat23fty.duckdns.org CNAME . @@ -100124,7 +100132,6 @@ xnjwkaelsf.gq CNAME . xnk.jbzie.com CNAME . xnkwintech.com CNAME . xnxxchannel.com CNAME . -xnxxfullhd.com CNAME . xo4z0sl.com CNAME . xo57.com CNAME . xoangyduong.com.vn CNAME . @@ -100673,7 +100680,6 @@ yeu49.com CNAME . yeu81.com CNAME . yeu82.com CNAME . yeuhang.tk CNAME . -yeumoitruong.vn CNAME . yeuromndy.cf CNAME . yeutocviet.com CNAME . yewonder.com CNAME . diff --git a/urlhaus-filter-snort2-online.rules b/urlhaus-filter-snort2-online.rules index 90bbb01a..40955c49 100644 --- a/urlhaus-filter-snort2-online.rules +++ b/urlhaus-filter-snort2-online.rules @@ -1,5 +1,5 @@ # Title: Online Malicious URL Snort2 Ruleset -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -7,778 +7,778 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"0-24bpautomentes.hu"; content:"Host"; http_header; classtype:trojan-activity; sid:100000001; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"0cl.sldov.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100000002; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.10.147.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000003; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.207.196.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000004; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.222.196.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000005; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.245.4.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000006; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000007; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100000008; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000009; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000010; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000011; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000012; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000013; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.222.196.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000004; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.245.4.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000005; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000006; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100000007; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000008; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000009; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000010; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000011; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000012; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100000013; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000014; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100000015; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000016; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000017; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000018; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.237"; content:"Host"; http_header; classtype:trojan-activity; sid:100000019; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100000020; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.249"; content:"Host"; http_header; classtype:trojan-activity; sid:100000021; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000022; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100000023; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000024; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100000025; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000026; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100000027; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100000028; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000029; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000030; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100000031; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000032; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000033; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100000034; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100000035; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100000036; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000037; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000038; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000039; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000040; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100000041; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100000042; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000043; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.22"; content:"Host"; http_header; classtype:trojan-activity; sid:100000044; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000045; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000046; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000047; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000048; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000049; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000050; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000051; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100000052; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100000053; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000054; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.247.221.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000055; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.247.221.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100000056; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.250.159.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000057; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.65.166.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000058; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.82.104.89"; content:"Host"; http_header; classtype:trojan-activity; sid:100000059; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"100.12.184.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100000060; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"100.12.51.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100000061; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"100.8.77.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000062; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1008691.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100000063; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.108.130.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000064; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.16.183.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100000065; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.229.85.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000066; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.255.36.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000067; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.28.105.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000068; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.28.218.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100000069; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.28.76.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100000070; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.66.81.70"; content:"Host"; http_header; classtype:trojan-activity; sid:100000071; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.75.157.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000072; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"102.130.115.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000073; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"102.141.240.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000074; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.113.99.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100000075; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.125.218.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000076; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.141.138.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000077; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.16.145.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000078; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.204.168.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100000079; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.217.215.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100000080; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.219.152.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000081; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.224.200.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000082; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.224.200.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100000083; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.237.21.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100000084; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.238.228.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100000085; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.240.249.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000086; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.4.117.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000087; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.79.112.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000088; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.82.98.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100000089; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.123.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000090; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100000091; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000092; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000093; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000094; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100000095; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000096; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000097; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100000098; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000099; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100000100; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.92.25.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000101; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.92.25.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100000102; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.97.184.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100000103; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.168.98.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000104; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.184.75.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100000105; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.206.93.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000106; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.33.52.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000107; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.61.86.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100000108; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.7.141.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100000109; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"106.1.111.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000110; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"106.104.172.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100000111; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"106.104.193.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100000112; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"106.105.33.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100000113; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.172.104.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100000114; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.172.193.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000115; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.172.249.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100000116; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.173.219.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100000117; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.174.250.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000118; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.174.61.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000119; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.175.197.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000120; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.175.31.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000121; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.175.33.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000122; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.181.136.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100000123; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.194.242.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100000124; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.219.185.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000125; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.220.119.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000126; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.221.96.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000127; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"108.190.201.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100000128; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"108.190.250.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000129; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"108.249.194.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000130; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.104.151.108"; content:"Host"; http_header; classtype:trojan-activity; sid:100000131; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.124.90.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000132; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.233.196.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000133; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.235.7.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000134; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.86.85.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100000135; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.88.185.119"; content:"Host"; http_header; classtype:trojan-activity; sid:100000136; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.95.200.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100000137; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.95.200.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000138; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.96.127.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000139; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.96.57.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100000140; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.99.37.97"; content:"Host"; http_header; classtype:trojan-activity; sid:100000141; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.14.58.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000142; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.187.229.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000143; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.228.195.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000144; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.248.124.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000145; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.248.175.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000146; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.248.251.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000147; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.251.10.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100000148; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.253.150.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000149; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.253.213.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000150; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.255.101.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000151; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.145.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000152; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.208.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100000153; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.221.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100000154; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.223.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000155; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.225.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100000156; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.235.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000157; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.4.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000158; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.89.10.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000159; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.89.222.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000160; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.118.111.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000161; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.118.88.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000162; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.119.245.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100000163; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.125.67.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100000164; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.163.50.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100000165; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.170.86.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100000166; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.172.57.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000167; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.182.235.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100000168; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.171.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100000169; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.177.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000170; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.23.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100000171; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.230.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100000172; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.27.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100000173; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.49.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000174; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.103.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100000175; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.103.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000176; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.104.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000177; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.106.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000178; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.121.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000179; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.121.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000180; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.121.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100000181; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.121.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000182; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.123.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100000183; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.26.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100000184; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.8.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100000185; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.111.108.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000186; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.133.222.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000187; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.170.124.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000188; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.170.233.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100000189; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.186.210.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100000190; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.186.96.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100000191; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.187.91.117"; content:"Host"; http_header; classtype:trojan-activity; sid:100000192; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.214.127.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000193; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.225.187.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000194; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.225.236.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100000195; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.225.239.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000196; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.225.43.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100000197; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.226.162.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100000198; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.226.67.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000199; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.228.180.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100000200; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.229.178.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100000201; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.230.168.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100000202; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.234.218.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000203; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.235.188.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100000204; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.236.171.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000205; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.141.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000206; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.144.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100000207; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.209.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100000208; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.75.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100000209; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.99.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000210; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.238.143.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000211; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.238.190.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000212; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.238.227.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000213; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.238.39.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000214; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.240.216.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000215; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.245.12.89"; content:"Host"; http_header; classtype:trojan-activity; sid:100000216; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.245.8.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100000217; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.246.126.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000218; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.246.162.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100000219; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.246.180.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100000220; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.100.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000221; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.16.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000222; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.191.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000223; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.214.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000224; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.240.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100000225; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.82.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100000226; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.248.148.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000227; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.248.197.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000228; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.249.109.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000229; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.249.118.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100000230; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.250.102.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000231; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.251.218.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100000232; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.252.196.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000233; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.252.221.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000234; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.254.208.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100000235; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.255.6.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100000236; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.255.8.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000237; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100000238; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.117"; content:"Host"; http_header; classtype:trojan-activity; sid:100000239; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100000240; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000241; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100000242; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000243; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000244; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.143"; content:"Host"; http_header; classtype:trojan-activity; sid:100000245; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000246; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000247; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100000248; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000249; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000250; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000251; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100000252; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.175"; content:"Host"; http_header; classtype:trojan-activity; sid:100000253; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000254; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100000255; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100000256; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.127.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100000257; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.80.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100000258; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.82.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100000259; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.83.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100000260; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.85.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000261; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.87.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000262; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.88.116"; content:"Host"; http_header; classtype:trojan-activity; sid:100000263; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.91.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100000264; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000265; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000266; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.168"; content:"Host"; http_header; classtype:trojan-activity; sid:100000267; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000268; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100000269; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100000270; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100000271; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000272; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000273; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.247"; content:"Host"; http_header; classtype:trojan-activity; sid:100000274; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000275; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000276; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000277; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100000278; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100000279; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000280; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.38.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000281; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100000282; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.124"; content:"Host"; http_header; classtype:trojan-activity; sid:100000283; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100000284; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000285; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000286; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.97.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000287; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.0.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000288; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.176.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000289; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.240.239"; content:"Host"; http_header; classtype:trojan-activity; sid:100000290; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.87.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000291; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.53.224.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100000292; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.65.53.175"; content:"Host"; http_header; classtype:trojan-activity; sid:100000293; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.153.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100000294; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.162.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100000295; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.175.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000296; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.176.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000297; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.176.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100000298; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.226.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000299; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.78.45.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000300; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.80.127.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000301; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.80.215.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100000302; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.82.146.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100000303; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.82.18.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100000304; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.82.224.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000305; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.93.29.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100000306; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.11.95.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000307; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.122.238.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000308; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.161.58.249"; content:"Host"; http_header; classtype:trojan-activity; sid:100000309; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.161.78.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000310; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.226.42.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100000311; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.227.194.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100000312; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.227.35.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000313; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.231.211.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100000314; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.254.169.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100000315; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.128.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100000316; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.133.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000317; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.144.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000318; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.154.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100000319; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.61.204.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100000320; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.87.226.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100000321; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.87.32.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000322; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.89.43.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000323; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.111.242.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100000324; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.224.203.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100000325; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.226.100.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100000326; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.228.205.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100000327; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.229.165.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000328; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.30.54.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100000329; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.79.172.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000330; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.165.216.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000331; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.201.38.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000332; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.42.47.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100000333; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.50.227.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100000334; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.50.92.195"; content:"Host"; http_header; classtype:trojan-activity; sid:100000335; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.55.158.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000336; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.56.131.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000337; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.56.133.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100000338; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.56.135.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100000339; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.56.152.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000340; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.58.132.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100000341; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.59.233.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100000342; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.61.112.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100000343; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.73.3.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100000344; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.92.174.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100000345; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.124.219.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000346; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.132.151.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000347; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.206.164.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000348; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.211.100.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000349; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.196.50.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100000350; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.204.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000351; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.204.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100000352; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.210.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100000353; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.220.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000354; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.243.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100000355; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.200.76.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000356; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.26.104.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000357; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.63.113.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000358; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.63.195.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100000359; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.63.53.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100000360; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.86.105.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000361; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.176.104.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000362; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.176.157.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100000363; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.176.7.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000364; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.223.32.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000365; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.223.5.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100000366; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.223.72.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000367; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.12.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000368; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.128.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000369; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.208.215"; content:"Host"; http_header; classtype:trojan-activity; sid:100000370; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.209.108"; content:"Host"; http_header; classtype:trojan-activity; sid:100000371; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.214.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100000372; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.88.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000373; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.96.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100000374; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.96.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000375; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.233.221.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000376; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.233.63.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000377; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.233.65.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000378; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.42.125.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100000379; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.43.180.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000380; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.79.125.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000381; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.79.50.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100000382; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.79.58.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100000383; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.99.179.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000384; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.99.183.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000385; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.99.239.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000386; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.102.179.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000387; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.108.161.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000388; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.112.185.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000389; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.123.238.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100000390; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.14.143.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100000391; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.147.213.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000392; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.163.93.191"; content:"Host"; http_header; classtype:trojan-activity; sid:100000393; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.164.18.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000394; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.164.218.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000395; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.165.107.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000396; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.165.241.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000397; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.165.27.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100000398; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.165.68.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100000399; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.166.170.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000400; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.166.97.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000401; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.167.26.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000402; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.177.147.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100000403; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.178.248.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100000404; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.179.43.1"; content:"Host"; http_header; classtype:trojan-activity; sid:100000405; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.18.38.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000406; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.180.106.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000407; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.180.33.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000408; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.181.119.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100000409; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.181.124.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100000410; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.182.97.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000411; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.183.115.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100000412; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.184.172.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100000413; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.187.195.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000414; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.187.245.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000415; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.189.137.195"; content:"Host"; http_header; classtype:trojan-activity; sid:100000416; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.189.227.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000417; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.150.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000418; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.187.206"; content:"Host"; http_header; classtype:trojan-activity; sid:100000419; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.215.221"; content:"Host"; http_header; classtype:trojan-activity; sid:100000420; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.240.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000421; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.255.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100000422; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.204.30.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000423; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.250.129.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100000424; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.251.105.221"; content:"Host"; http_header; classtype:trojan-activity; sid:100000425; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.131.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100000426; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.143.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000427; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.143.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100000428; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.144.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000429; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.148.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100000430; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.155.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000431; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.173.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100000432; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.195.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000433; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.132.113.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000434; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.15.69.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100000435; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.178.187.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000436; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.178.187.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000437; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.178.187.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000438; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.178.187.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100000439; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.207.39.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100000440; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.25.204.189"; content:"Host"; http_header; classtype:trojan-activity; sid:100000441; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.0.255.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000442; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.142.222.22"; content:"Host"; http_header; classtype:trojan-activity; sid:100000443; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.150.213.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000444; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.151.248.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000445; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100000446; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.183"; content:"Host"; http_header; classtype:trojan-activity; sid:100000447; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000448; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000449; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000450; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100000451; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000452; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100000453; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100000454; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100000455; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100000456; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.126.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000457; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.126.239"; content:"Host"; http_header; classtype:trojan-activity; sid:100000458; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.126.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000459; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.127.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100000460; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.99.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000461; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.210.89.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100000462; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.50.66.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000463; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.50.93.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100000464; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.6.8.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100000465; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.7.75.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000466; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.100.114.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000467; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.100.96.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000468; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.121.44.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000469; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.123.53.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000470; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.127.155.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100000471; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.141.11.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100000472; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.15.142.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100000473; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.159.22.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000474; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.170.234.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100000475; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.170.8.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000476; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.185.31.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000477; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.190.36.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000478; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.20.104.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000479; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.225.11.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000480; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.237.226.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000481; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.24.116.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000482; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.25.54.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000483; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.254.76.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000484; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.88.99.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100000485; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.100.150.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100000486; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.160.147.53"; content:"Host"; http_header; classtype:trojan-activity; sid:100000487; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.188.86.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000488; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.199.72.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100000489; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.199.79.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100000490; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.202.37.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000491; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.254.33.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100000492; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.0.240.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000493; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.10.15.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000494; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.124.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000495; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.170.237"; content:"Host"; http_header; classtype:trojan-activity; sid:100000496; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.182.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100000497; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.19.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000498; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.238.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100000499; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.129.2.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000500; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.129.84.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100000501; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.130.208.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100000502; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.130.27.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000503; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.130.37.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000504; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.131.186.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100000505; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.132.219.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000506; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.133.98.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000507; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.134.14.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000508; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.154.236.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100000509; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.159.8.100"; content:"Host"; http_header; classtype:trojan-activity; sid:100000510; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.183.16.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100000511; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.191.164.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000512; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.192.101.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000513; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.193.53.237"; content:"Host"; http_header; classtype:trojan-activity; sid:100000514; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.194.235.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100000515; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.194.35.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000516; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.194.52.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100000517; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.194.60.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000518; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.195.112.240"; content:"Host"; http_header; classtype:trojan-activity; sid:100000519; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.195.184.191"; content:"Host"; http_header; classtype:trojan-activity; sid:100000520; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.195.98.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000521; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.212.29.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000522; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.213.225.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000523; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.233.130.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000524; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.233.152.249"; content:"Host"; http_header; classtype:trojan-activity; sid:100000525; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.234.116.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000526; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.234.184.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000527; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.240.103.89"; content:"Host"; http_header; classtype:trojan-activity; sid:100000528; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.240.181.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000529; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.240.79.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000530; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.241.11.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000531; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.241.148.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000532; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.241.184.124"; content:"Host"; http_header; classtype:trojan-activity; sid:100000533; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.28.217.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100000534; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.4.44.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000535; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.5.5.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000536; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.8.17.78"; content:"Host"; http_header; classtype:trojan-activity; sid:100000537; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.129.221.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100000538; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.129.76.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000539; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.129.78.176"; content:"Host"; http_header; classtype:trojan-activity; sid:100000540; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.130.40.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100000541; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.104.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100000542; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.151.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000543; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.24.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000544; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.26.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100000545; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.54.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000546; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.132.110.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100000547; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.135.34.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100000548; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.152.26.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000549; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.153.236.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000550; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.160.126.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000551; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.163.65.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100000552; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.165.123.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000553; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.187.111.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100000554; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.199.56.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000555; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.230.174.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100000556; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.254.251.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000557; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.5.92.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000558; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.6.0.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000559; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.67.89.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000560; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.7.254.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000561; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.80.46.73"; content:"Host"; http_header; classtype:trojan-activity; sid:100000562; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.93.94.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000563; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.105.217.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100000564; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.128.28.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000565; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.142.93.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100000566; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.191.113.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100000567; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.209.71.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000568; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.40.1.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000569; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.40.73.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000570; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.43.23.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000571; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.46.142.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100000572; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.46.255.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100000573; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"128.116.133.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000574; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"130.255.159.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100000575; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"134.195.139.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000576; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"135.148.36.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000577; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"138.99.204.224"; content:"Host"; http_header; classtype:trojan-activity; sid:100000578; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"139.159.226.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100000579; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"139.170.173.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000580; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"139.216.102.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000581; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.102.17.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000582; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.136.80.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000583; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.138.8.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100000584; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.160.34.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100000585; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.189.247.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000586; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.232.33.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100000587; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.37.222.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000588; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.45.127.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000589; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.46.25.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000590; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.46.98.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000591; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.50.129.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000592; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.55.29.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000593; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"142.11.216.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100000594; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"142.177.56.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000595; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"143.198.120.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000596; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"146.71.79.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000597; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"148.69.108.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000598; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.255.15.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000599; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.255.15.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000600; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.255.15.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100000601; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.255.15.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000602; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14karatvisions.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100000603; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"150.116.207.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000604; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"151.177.163.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100000605; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"151.33.230.191"; content:"Host"; http_header; classtype:trojan-activity; sid:100000606; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"153.101.234.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100000607; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"153.101.47.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100000608; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"153.3.152.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100000609; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"153.34.135.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000610; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"157.230.219.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000611; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"158.101.165.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000612; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"158.174.213.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100000613; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"158.51.125.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100000614; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"159.224.74.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000615; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.194.28.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000616; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.209.98.174"; content:"Host"; http_header; classtype:trojan-activity; sid:100000617; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"163.53.206.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000618; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"165.90.16.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100000619; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"167.114.172.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000620; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"168.205.223.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000621; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"170.81.238.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100000622; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.120.222.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000623; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.121.255.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100000624; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.123.14.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000625; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.34.176.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000626; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.34.179.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100000627; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.35.162.156"; content:"Host"; http_header; classtype:trojan-activity; sid:100000628; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.35.174.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000629; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.105.36.168"; content:"Host"; http_header; classtype:trojan-activity; sid:100000630; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.114.244.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000631; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.245.186.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000632; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.245.5.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000633; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.245.5.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000634; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.245.81.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000635; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.93.194.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100000636; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.167.85.89"; content:"Host"; http_header; classtype:trojan-activity; sid:100000637; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.169.46.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000638; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.19.58.108"; content:"Host"; http_header; classtype:trojan-activity; sid:100000639; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.233.85.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100000640; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.235.209.70"; content:"Host"; http_header; classtype:trojan-activity; sid:100000641; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.25.113.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000642; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.52.95.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000643; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.52.97.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000644; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.56.119.108"; content:"Host"; http_header; classtype:trojan-activity; sid:100000645; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.56.92.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100000646; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.63.64.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000647; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.106.33.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000648; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.61.3.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100000649; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.61.48.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000650; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.73.246.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000651; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.81.78.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000652; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.83.73.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000653; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.10.147.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100000654; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.11.193.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000655; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.11.65.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000656; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.117.66.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000657; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.169.13.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000658; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.201.104.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100000659; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.208.230.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000660; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.213.25.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100000661; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.42.46.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000662; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.7.184.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100000663; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.9.24.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000664; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.111.174.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000665; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.111.174.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100000666; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.111.174.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000667; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.111.174.67"; content:"Host"; http_header; classtype:trojan-activity; sid:100000668; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100000669; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000670; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000671; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000672; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.76"; content:"Host"; http_header; classtype:trojan-activity; sid:100000673; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100000674; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000675; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.12.117.70"; content:"Host"; http_header; classtype:trojan-activity; sid:100000676; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.123.7.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100000677; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.123.7.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000678; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.123.9.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100000679; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.124.7.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000680; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.221.188.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100000681; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.221.251.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000682; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.240.84.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100000683; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"177.11.92.78"; content:"Host"; http_header; classtype:trojan-activity; sid:100000684; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"177.131.226.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000685; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"177.54.82.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000686; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.124.182.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100000687; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.134.185.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000688; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.150.174.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100000689; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.151.143.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000690; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.165.122.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000691; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.1.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100000692; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.10.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000693; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.10.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000694; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.101.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100000695; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.102.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000696; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.102.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100000697; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.102.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000698; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.102.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000699; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.103.143"; content:"Host"; http_header; classtype:trojan-activity; sid:100000700; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.103.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000701; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.104.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000702; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.104.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000703; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.105.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000704; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.105.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000705; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.105.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000706; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.107.0"; content:"Host"; http_header; classtype:trojan-activity; sid:100000707; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.108.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000708; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.108.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100000709; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.109.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000710; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.110.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100000711; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.111.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000712; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.111.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100000713; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.111.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000714; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100000715; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000716; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000717; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000718; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000719; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.114.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000720; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.114.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100000721; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.114.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000722; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.115.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100000723; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.116.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100000724; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.116.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000725; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.116.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000726; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.118.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000727; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.118.116"; content:"Host"; http_header; classtype:trojan-activity; sid:100000728; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.118.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000729; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.119.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000730; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.12.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000731; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.120.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000732; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.121.0"; content:"Host"; http_header; classtype:trojan-activity; sid:100000733; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.121.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000734; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.122.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000735; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000736; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000737; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000738; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000739; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000740; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000741; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.124.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000742; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.125.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000743; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.126.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100000744; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.126.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000745; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.126.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000746; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.127.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000747; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.127.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100000748; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.14.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000749; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.15.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100000750; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.15.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000751; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.15.44"; content:"Host"; http_header; classtype:trojan-activity; sid:100000752; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.17.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000753; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.17.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100000754; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.18.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000755; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.19.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000756; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000757; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000758; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000759; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000760; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.20.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000761; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.20.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000762; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.20.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000763; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.21.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100000764; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.23.119"; content:"Host"; http_header; classtype:trojan-activity; sid:100000765; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.24.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100000766; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.24.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000767; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.25.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100000768; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.25.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000769; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.27.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100000770; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.27.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000771; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.29.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100000772; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.30.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100000773; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.30.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000774; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.32.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000775; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000017; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.237"; content:"Host"; http_header; classtype:trojan-activity; sid:100000018; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100000019; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.249"; content:"Host"; http_header; classtype:trojan-activity; sid:100000020; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000021; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100000022; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000023; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100000024; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000025; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100000026; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100000027; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000028; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000029; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100000030; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000031; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.222.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000032; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100000033; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100000034; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100000035; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000036; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000037; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000038; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000039; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100000040; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100000041; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000042; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000043; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000044; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000045; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000046; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000047; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000048; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000049; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100000050; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100000051; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.246.223.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000052; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.247.221.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000053; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.247.221.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100000054; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.250.159.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000055; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.65.166.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000056; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.82.104.89"; content:"Host"; http_header; classtype:trojan-activity; sid:100000057; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"100.12.184.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100000058; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"100.12.51.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100000059; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"100.8.77.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000060; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1008691.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100000061; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.108.130.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000062; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.16.183.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100000063; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.229.85.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000064; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.255.36.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000065; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.28.105.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000066; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.28.218.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100000067; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.28.76.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100000068; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.66.81.70"; content:"Host"; http_header; classtype:trojan-activity; sid:100000069; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"101.75.157.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000070; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"102.130.115.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000071; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"102.141.240.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000072; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.113.99.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100000073; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.125.218.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000074; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.16.145.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000075; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.204.168.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100000076; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.217.215.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100000077; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.219.152.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000078; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.224.200.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000079; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.224.200.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100000080; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.237.21.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100000081; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.238.228.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100000082; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.240.249.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000083; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.4.117.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000084; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.79.112.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000085; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.82.98.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100000086; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.84.240.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000087; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.84.241.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000088; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100000089; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000090; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000091; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000092; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.91.245.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100000093; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.92.25.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000094; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.92.25.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100000095; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.97.184.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100000096; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.168.98.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000097; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.184.75.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100000098; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.206.93.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000099; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.33.52.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000100; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.61.86.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100000101; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.7.141.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100000102; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"106.1.111.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000103; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"106.104.172.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100000104; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"106.104.193.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100000105; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"106.105.33.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100000106; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.172.104.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100000107; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.172.193.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000108; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.172.249.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100000109; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.173.219.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100000110; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.173.23.240"; content:"Host"; http_header; classtype:trojan-activity; sid:100000111; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.174.250.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000112; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.174.61.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000113; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.175.197.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000114; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.175.31.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000115; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.175.33.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000116; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.181.136.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100000117; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.194.242.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100000118; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.219.185.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000119; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.220.119.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000120; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.221.96.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000121; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"108.190.201.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100000122; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"108.190.250.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000123; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"108.249.194.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000124; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.124.90.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000125; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.233.196.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000126; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.235.7.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000127; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.248.58.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000128; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.86.85.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100000129; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.95.200.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100000130; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.95.200.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000131; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.96.127.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000132; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.96.57.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100000133; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"109.99.37.97"; content:"Host"; http_header; classtype:trojan-activity; sid:100000134; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.14.58.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000135; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.228.195.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000136; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.248.124.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000137; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.248.175.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000138; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.248.251.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000139; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.251.10.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100000140; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.253.213.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000141; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.255.101.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000142; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.145.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000143; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.208.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100000144; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.221.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100000145; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.223.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000146; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.233.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000147; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.235.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000148; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.35.4.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000149; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.89.10.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000150; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"110.89.222.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000151; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.118.41.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000152; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.118.88.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100000153; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.118.88.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000154; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.119.245.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100000155; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.125.67.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100000156; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.163.50.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100000157; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.170.86.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100000158; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.172.57.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000159; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.171.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100000160; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.177.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000161; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.23.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100000162; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.230.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100000163; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.27.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100000164; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.185.49.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000165; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.103.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100000166; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.103.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000167; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.104.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000168; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.106.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000169; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.121.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000170; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.121.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000171; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.121.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100000172; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.121.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000173; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.26.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100000174; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"111.38.8.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100000175; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.111.108.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000176; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.133.222.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000177; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.170.124.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000178; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.170.233.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100000179; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.186.210.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100000180; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.186.96.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100000181; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.187.91.117"; content:"Host"; http_header; classtype:trojan-activity; sid:100000182; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.214.127.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000183; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.225.187.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000184; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.225.236.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100000185; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.225.239.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000186; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.225.43.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100000187; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.226.162.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100000188; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.226.67.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000189; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.228.180.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100000190; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.229.178.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100000191; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.230.168.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100000192; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.234.218.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000193; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.235.188.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100000194; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.236.171.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000195; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.141.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000196; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.144.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100000197; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.75.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100000198; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.237.99.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000199; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.238.143.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000200; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.238.190.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000201; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.238.227.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000202; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.238.39.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000203; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.240.216.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000204; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.245.12.89"; content:"Host"; http_header; classtype:trojan-activity; sid:100000205; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.245.8.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100000206; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.246.126.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000207; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.246.162.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100000208; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.246.180.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100000209; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.100.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000210; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.16.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000211; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.191.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000212; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.214.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000213; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.240.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100000214; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.247.82.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100000215; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.248.148.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000216; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.248.197.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000217; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.249.109.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000218; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.249.118.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100000219; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.250.102.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000220; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.251.218.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100000221; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.252.196.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000222; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.252.221.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000223; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.254.208.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100000224; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.255.6.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100000225; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.255.8.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000226; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.26.212.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100000227; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100000228; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.117"; content:"Host"; http_header; classtype:trojan-activity; sid:100000229; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100000230; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000231; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100000232; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000233; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000234; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.143"; content:"Host"; http_header; classtype:trojan-activity; sid:100000235; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000236; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000237; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100000238; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000239; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000240; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000241; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100000242; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.175"; content:"Host"; http_header; classtype:trojan-activity; sid:100000243; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000244; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100000245; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.124.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100000246; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.127.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100000247; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.80.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100000248; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.82.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100000249; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.83.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100000250; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.85.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000251; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.87.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000252; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.88.116"; content:"Host"; http_header; classtype:trojan-activity; sid:100000253; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.27.91.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100000254; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000255; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000256; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.168"; content:"Host"; http_header; classtype:trojan-activity; sid:100000257; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000258; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100000259; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100000260; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100000261; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000262; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000263; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100000264; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.247"; content:"Host"; http_header; classtype:trojan-activity; sid:100000265; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000266; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.1.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000267; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000268; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100000269; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100000270; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000271; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.110.62"; content:"Host"; http_header; classtype:trojan-activity; sid:100000272; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.38.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000273; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100000274; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.124"; content:"Host"; http_header; classtype:trojan-activity; sid:100000275; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100000276; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000277; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.4.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000278; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.30.97.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000279; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.0.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000280; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.176.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000281; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.177.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100000282; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.240.239"; content:"Host"; http_header; classtype:trojan-activity; sid:100000283; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.31.87.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000284; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.53.224.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100000285; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.53.227.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000286; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.65.53.175"; content:"Host"; http_header; classtype:trojan-activity; sid:100000287; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.153.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100000288; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.162.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000289; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.162.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100000290; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.175.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000291; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.176.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000292; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.176.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100000293; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.226.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000294; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.72.231.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000295; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.78.45.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000296; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.80.127.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000297; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.80.215.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100000298; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.82.146.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100000299; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.82.18.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100000300; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.82.224.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000301; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"112.93.29.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100000302; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.11.95.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000303; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.122.238.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000304; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.161.58.249"; content:"Host"; http_header; classtype:trojan-activity; sid:100000305; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.161.78.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000306; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.227.194.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100000307; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.227.35.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000308; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.231.211.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100000309; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.254.169.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100000310; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.128.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100000311; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.133.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000312; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.136.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100000313; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.144.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000314; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.59.191.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100000315; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.61.204.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100000316; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.87.32.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000317; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"113.89.43.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000318; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.111.242.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100000319; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.224.203.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100000320; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.229.165.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000321; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.30.54.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100000322; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.79.172.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000323; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.165.216.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000324; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.201.38.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000325; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.42.47.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100000326; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.50.227.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100000327; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.53.254.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100000328; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.55.158.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000329; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.56.131.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000330; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.56.133.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100000331; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.56.152.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000332; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.58.132.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100000333; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.59.233.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100000334; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.73.3.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100000335; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.92.174.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100000336; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"115.97.142.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000337; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.124.219.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000338; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.132.151.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000339; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.206.164.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000340; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.211.100.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000341; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.75.197.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100000342; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.204.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000343; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.204.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100000344; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.220.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000345; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.20.243.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100000346; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.200.76.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000347; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.251.59.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000348; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.26.104.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000349; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.63.113.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000350; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.63.195.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100000351; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.63.53.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100000352; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"117.86.105.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000353; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.176.104.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000354; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.176.157.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100000355; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.176.7.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000356; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.223.32.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000357; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.223.5.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100000358; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.223.72.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000359; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.12.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000360; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.128.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000361; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.208.215"; content:"Host"; http_header; classtype:trojan-activity; sid:100000362; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.209.108"; content:"Host"; http_header; classtype:trojan-activity; sid:100000363; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.214.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100000364; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.88.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000365; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.96.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100000366; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.232.96.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000367; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.233.221.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000368; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.233.63.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000369; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.233.65.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000370; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.42.125.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100000371; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.43.180.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000372; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.79.50.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100000373; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.79.58.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100000374; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.99.179.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000375; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.99.183.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000376; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"118.99.239.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000377; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.102.179.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000378; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.108.161.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000379; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.112.185.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000380; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.123.238.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100000381; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.14.143.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100000382; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.147.213.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000383; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.164.18.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000384; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.164.218.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000385; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.165.107.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000386; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.165.241.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000387; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.165.27.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100000388; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.165.68.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100000389; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.166.170.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000390; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.166.97.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000391; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.167.26.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000392; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.177.147.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100000393; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.178.248.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100000394; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.179.43.1"; content:"Host"; http_header; classtype:trojan-activity; sid:100000395; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.18.38.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000396; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.180.106.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000397; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.180.33.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000398; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.181.119.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100000399; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.181.124.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100000400; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.182.97.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000401; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.183.115.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100000402; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.184.172.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100000403; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.187.195.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000404; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.187.245.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000405; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.189.137.195"; content:"Host"; http_header; classtype:trojan-activity; sid:100000406; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.189.227.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000407; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.150.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000408; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.187.206"; content:"Host"; http_header; classtype:trojan-activity; sid:100000409; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.215.221"; content:"Host"; http_header; classtype:trojan-activity; sid:100000410; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.240.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000411; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.191.255.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100000412; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.204.30.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000413; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.250.129.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100000414; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.251.105.221"; content:"Host"; http_header; classtype:trojan-activity; sid:100000415; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.131.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100000416; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.143.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000417; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.143.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100000418; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.144.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000419; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.148.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100000420; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.155.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000421; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.195.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100000422; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.206.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100000423; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"119.56.220.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100000424; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.132.113.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000425; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.15.69.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100000426; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.178.187.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000427; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.178.187.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000428; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.178.187.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000429; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.178.187.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100000430; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.207.39.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100000431; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"12.25.204.189"; content:"Host"; http_header; classtype:trojan-activity; sid:100000432; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.0.255.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000433; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.142.222.22"; content:"Host"; http_header; classtype:trojan-activity; sid:100000434; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.150.213.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000435; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.151.248.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000436; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100000437; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.183"; content:"Host"; http_header; classtype:trojan-activity; sid:100000438; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000439; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000440; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000441; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100000442; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000443; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100000444; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100000445; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100000446; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.193.91.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100000447; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.126.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000448; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.126.239"; content:"Host"; http_header; classtype:trojan-activity; sid:100000449; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.126.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100000450; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.126.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000451; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.127.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100000452; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.209.99.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000453; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.50.66.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000454; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.50.93.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100000455; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.6.8.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100000456; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"120.7.75.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000457; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.100.114.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000458; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.100.96.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000459; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.121.44.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000460; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.123.53.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000461; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.127.155.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100000462; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.141.11.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100000463; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.15.142.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100000464; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.159.22.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000465; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.170.234.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100000466; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.170.8.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000467; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.185.31.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000468; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.190.36.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000469; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.20.104.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000470; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.225.11.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000471; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.237.226.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000472; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.24.116.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000473; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.25.54.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000474; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.254.76.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000475; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.88.99.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100000476; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.100.150.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100000477; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.160.147.53"; content:"Host"; http_header; classtype:trojan-activity; sid:100000478; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.188.86.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000479; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.199.66.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000480; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.199.72.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100000481; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.199.79.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100000482; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.202.37.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000483; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"122.254.33.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100000484; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.0.240.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000485; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.10.15.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000486; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.124.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000487; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.170.237"; content:"Host"; http_header; classtype:trojan-activity; sid:100000488; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.182.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100000489; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.19.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000490; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.200.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000491; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.110.238.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100000492; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.129.2.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000493; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.129.84.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100000494; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.130.208.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100000495; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.130.27.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000496; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.130.37.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000497; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.131.186.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100000498; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.132.219.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000499; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.133.98.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000500; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.134.14.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000501; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.154.236.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100000502; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.159.8.100"; content:"Host"; http_header; classtype:trojan-activity; sid:100000503; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.183.16.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100000504; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.191.164.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000505; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.192.101.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000506; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.193.53.237"; content:"Host"; http_header; classtype:trojan-activity; sid:100000507; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.194.235.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100000508; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.194.35.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000509; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.194.52.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100000510; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.194.60.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000511; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.195.112.240"; content:"Host"; http_header; classtype:trojan-activity; sid:100000512; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.195.184.191"; content:"Host"; http_header; classtype:trojan-activity; sid:100000513; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.195.98.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000514; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.212.29.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000515; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.213.225.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000516; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.233.130.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000517; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.233.152.249"; content:"Host"; http_header; classtype:trojan-activity; sid:100000518; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.234.116.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000519; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.234.184.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000520; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.240.103.89"; content:"Host"; http_header; classtype:trojan-activity; sid:100000521; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.240.181.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000522; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.240.79.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000523; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.241.11.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000524; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.241.148.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000525; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.241.184.124"; content:"Host"; http_header; classtype:trojan-activity; sid:100000526; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.28.217.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100000527; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.5.5.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000528; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"123.9.193.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100000529; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.129.221.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100000530; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.129.76.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000531; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.129.78.176"; content:"Host"; http_header; classtype:trojan-activity; sid:100000532; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.130.40.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100000533; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.104.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100000534; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.151.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000535; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.24.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000536; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.26.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100000537; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.131.54.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000538; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.132.110.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100000539; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.135.34.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100000540; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.152.26.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000541; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.153.136.175"; content:"Host"; http_header; classtype:trojan-activity; sid:100000542; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.153.236.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000543; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.160.126.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000544; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.163.65.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100000545; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.165.123.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000546; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.187.111.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100000547; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.199.56.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000548; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.230.174.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100000549; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.254.251.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000550; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.5.112.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100000551; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.5.92.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000552; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.6.0.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000553; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.67.89.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000554; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.7.254.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000555; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.80.46.73"; content:"Host"; http_header; classtype:trojan-activity; sid:100000556; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"124.93.94.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000557; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.105.217.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100000558; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.128.28.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000559; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.142.93.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100000560; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.191.113.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100000561; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.40.1.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000562; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.40.73.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000563; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.43.23.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000564; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.46.142.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100000565; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"125.46.255.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100000566; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"128.116.133.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000567; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"130.255.159.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100000568; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"134.195.139.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000569; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"134.236.252.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000570; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"135.148.36.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000571; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"138.99.204.224"; content:"Host"; http_header; classtype:trojan-activity; sid:100000572; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"139.159.226.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100000573; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"139.170.173.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000574; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"139.216.102.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000575; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.102.17.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000576; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.136.80.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000577; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.138.8.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100000578; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.160.34.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100000579; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.189.247.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000580; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.232.33.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100000581; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.37.222.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000582; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.42.237.237"; content:"Host"; http_header; classtype:trojan-activity; sid:100000583; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.45.127.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000584; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.46.25.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000585; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.46.98.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000586; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.50.129.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000587; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14.55.29.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000588; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"142.11.216.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100000589; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"142.177.56.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000590; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"143.198.120.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000591; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"146.71.79.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000592; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"148.69.108.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000593; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.255.15.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000594; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.255.15.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000595; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.255.15.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100000596; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.255.15.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000597; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"14karatvisions.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100000598; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"150.116.207.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000599; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"151.177.163.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100000600; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"151.33.230.191"; content:"Host"; http_header; classtype:trojan-activity; sid:100000601; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"153.101.234.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100000602; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"153.101.47.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100000603; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"153.3.152.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100000604; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"153.34.135.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100000605; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"157.230.219.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100000606; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"158.101.165.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000607; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"158.174.213.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100000608; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"158.51.125.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100000609; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"159.224.74.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000610; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.194.28.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000611; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.209.98.174"; content:"Host"; http_header; classtype:trojan-activity; sid:100000612; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"163.53.206.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000613; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"165.90.16.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100000614; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"167.114.172.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000615; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"170.81.238.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100000616; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.120.222.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000617; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.121.255.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100000618; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.123.14.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000619; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.34.176.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000620; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.34.179.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100000621; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.35.162.156"; content:"Host"; http_header; classtype:trojan-activity; sid:100000622; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"171.35.174.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000623; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.105.36.168"; content:"Host"; http_header; classtype:trojan-activity; sid:100000624; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.105.68.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100000625; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.114.244.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000626; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.245.186.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000627; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.245.5.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000628; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.245.5.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000629; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.245.81.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100000630; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.93.176.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100000631; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.93.194.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100000632; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.167.85.89"; content:"Host"; http_header; classtype:trojan-activity; sid:100000633; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.169.46.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000634; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.19.58.108"; content:"Host"; http_header; classtype:trojan-activity; sid:100000635; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.233.85.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100000636; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.235.209.70"; content:"Host"; http_header; classtype:trojan-activity; sid:100000637; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.25.113.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000638; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.52.95.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000639; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.52.97.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000640; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.56.119.108"; content:"Host"; http_header; classtype:trojan-activity; sid:100000641; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.56.92.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100000642; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"173.63.64.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000643; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.61.3.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100000644; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.73.246.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000645; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.81.78.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000646; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"174.83.73.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000647; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.10.147.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100000648; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.11.65.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000649; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.117.66.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000650; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.169.13.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000651; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.201.104.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100000652; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.208.230.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000653; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.213.25.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100000654; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.42.46.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000655; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.7.184.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100000656; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"175.9.24.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100000657; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.111.174.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000658; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.111.174.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100000659; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.111.174.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000660; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.111.174.67"; content:"Host"; http_header; classtype:trojan-activity; sid:100000661; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100000662; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000663; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000664; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000665; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.76"; content:"Host"; http_header; classtype:trojan-activity; sid:100000666; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100000667; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.161.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000668; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.113.174.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100000669; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.12.117.70"; content:"Host"; http_header; classtype:trojan-activity; sid:100000670; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.123.7.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100000671; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.123.7.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000672; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.124.7.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000673; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"176.240.84.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100000674; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"177.11.92.78"; content:"Host"; http_header; classtype:trojan-activity; sid:100000675; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"177.131.226.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000676; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"177.54.82.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000677; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.124.182.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100000678; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.150.174.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100000679; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.151.143.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000680; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.165.122.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100000681; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.17.171.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000682; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.0.143"; content:"Host"; http_header; classtype:trojan-activity; sid:100000683; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.1.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100000684; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.10.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000685; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.10.76"; content:"Host"; http_header; classtype:trojan-activity; sid:100000686; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.10.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000687; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.101.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100000688; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.102.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000689; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.102.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100000690; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.102.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000691; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.102.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100000692; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.103.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000693; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.103.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100000694; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.104.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000695; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.104.67"; content:"Host"; http_header; classtype:trojan-activity; sid:100000696; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.104.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000697; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.105.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000698; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.105.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000699; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.105.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000700; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.107.0"; content:"Host"; http_header; classtype:trojan-activity; sid:100000701; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.107.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100000702; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.108.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000703; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.108.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100000704; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.109.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000705; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.110.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100000706; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.111.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000707; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.111.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100000708; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.111.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100000709; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000710; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000711; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000712; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.112.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000713; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.114.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000714; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.114.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000715; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.114.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000716; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.115.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100000717; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.116.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100000718; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.116.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100000719; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.116.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000720; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.116.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000721; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.118.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000722; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.119.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000723; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.12.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000724; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.120.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000725; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.121.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100000726; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.121.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000727; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.122.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100000728; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000729; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000730; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000731; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000732; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.123.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000733; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.124.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000734; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.125.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000735; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.125.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100000736; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.126.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100000737; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.126.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000738; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.127.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100000739; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.127.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000740; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.14.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000741; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.14.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100000742; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.15.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100000743; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.15.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000744; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.15.44"; content:"Host"; http_header; classtype:trojan-activity; sid:100000745; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.16.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000746; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.17.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100000747; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.19.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100000748; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.19.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100000749; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000750; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000751; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000752; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000753; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.2.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000754; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.20.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000755; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.20.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000756; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.20.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000757; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.21.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000758; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.22.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100000759; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.24.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100000760; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.24.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000761; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.25.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100000762; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.25.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100000763; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.27.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100000764; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.27.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000765; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.29.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100000766; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.3.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100000767; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.30.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100000768; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.30.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100000769; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.30.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000770; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.31.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100000771; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.32.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000772; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.32.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000773; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.33.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100000774; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.33.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100000775; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.34.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000776; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.35.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100000777; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.35.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100000778; rev:1;) @@ -792,119 +792,119 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.38.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100000786; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.4.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100000787; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.4.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100000788; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.43.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000789; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.43.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000790; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.43.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000791; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.44.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000792; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.44.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000793; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.40.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100000789; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.42.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000790; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.43.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000791; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.43.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000792; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.44.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000793; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.45.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100000794; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.45.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100000795; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.46.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000796; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.46.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000797; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.47.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100000798; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.47.181"; content:"Host"; http_header; classtype:trojan-activity; sid:100000799; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.47.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000800; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.47.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100000801; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.48.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100000802; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.46.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000796; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.47.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100000797; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.47.222"; content:"Host"; http_header; classtype:trojan-activity; sid:100000798; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.47.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100000799; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.48.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100000800; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.48.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000801; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.48.67"; content:"Host"; http_header; classtype:trojan-activity; sid:100000802; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.5.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100000803; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.5.44"; content:"Host"; http_header; classtype:trojan-activity; sid:100000804; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.5.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000805; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.50.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000806; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.50.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000807; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.50.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100000805; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.50.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000806; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.50.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000807; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.53.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100000808; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.54.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000809; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.54.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000810; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.54.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000811; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.55.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000812; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.56.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100000813; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.56.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000814; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.56.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100000815; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.57.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000816; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.57.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000817; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.57.183"; content:"Host"; http_header; classtype:trojan-activity; sid:100000818; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.58.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000819; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.58.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000820; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.58.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000821; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.59.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100000822; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.60.247"; content:"Host"; http_header; classtype:trojan-activity; sid:100000823; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.61.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100000824; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.61.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100000825; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.62.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100000826; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.62.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000827; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.64.156"; content:"Host"; http_header; classtype:trojan-activity; sid:100000828; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.64.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100000829; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.64.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000830; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.65.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100000831; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.68.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100000832; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.68.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100000833; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.68.44"; content:"Host"; http_header; classtype:trojan-activity; sid:100000834; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.68.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000835; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.7.156"; content:"Host"; http_header; classtype:trojan-activity; sid:100000836; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.70.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100000837; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.70.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100000838; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.70.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000839; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.72.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100000840; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.72.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000841; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.72.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000842; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.73.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000843; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.75.181"; content:"Host"; http_header; classtype:trojan-activity; sid:100000844; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.75.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100000845; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.54.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100000810; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.55.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100000811; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.56.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000812; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.56.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100000813; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.56.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100000814; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.57.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000815; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.57.183"; content:"Host"; http_header; classtype:trojan-activity; sid:100000816; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.57.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100000817; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.58.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000818; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.58.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000819; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.58.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000820; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.59.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100000821; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.60.247"; content:"Host"; http_header; classtype:trojan-activity; sid:100000822; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.61.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100000823; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.62.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000824; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.64.156"; content:"Host"; http_header; classtype:trojan-activity; sid:100000825; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.64.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000826; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.65.189"; content:"Host"; http_header; classtype:trojan-activity; sid:100000827; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.65.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100000828; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.66.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000829; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.68.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100000830; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.68.44"; content:"Host"; http_header; classtype:trojan-activity; sid:100000831; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.68.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100000832; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.69.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100000833; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.7.156"; content:"Host"; http_header; classtype:trojan-activity; sid:100000834; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.70.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100000835; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.70.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100000836; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.70.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000837; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.72.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100000838; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.72.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100000839; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.72.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100000840; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.73.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000841; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.75.181"; content:"Host"; http_header; classtype:trojan-activity; sid:100000842; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.75.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100000843; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.75.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100000844; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.77.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000845; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.77.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100000846; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.78.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100000847; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.78.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000848; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.78.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100000849; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.79.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000850; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.79.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000849; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.79.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100000850; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.79.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100000851; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.8.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000852; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.8.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000853; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.8.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000852; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.8.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000853; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.80.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100000854; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.81.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000855; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.81.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100000856; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.81.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100000857; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.83.224"; content:"Host"; http_header; classtype:trojan-activity; sid:100000858; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.84.195"; content:"Host"; http_header; classtype:trojan-activity; sid:100000859; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.84.215"; content:"Host"; http_header; classtype:trojan-activity; sid:100000860; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.86.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000861; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.86.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100000862; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.86.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000863; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.87.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100000864; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.80.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100000855; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.81.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000856; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.81.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100000857; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.81.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100000858; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.81.240"; content:"Host"; http_header; classtype:trojan-activity; sid:100000859; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.84.195"; content:"Host"; http_header; classtype:trojan-activity; sid:100000860; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.84.215"; content:"Host"; http_header; classtype:trojan-activity; sid:100000861; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.86.117"; content:"Host"; http_header; classtype:trojan-activity; sid:100000862; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.86.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000863; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.86.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000864; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.87.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100000865; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.87.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000866; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.87.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100000867; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.88.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100000868; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.88.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000869; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.88.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000869; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.89.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000870; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.89.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000871; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.89.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000872; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.91.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000873; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.92.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000874; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.92.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000875; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.89.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000871; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.89.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000872; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.89.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100000873; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.91.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100000874; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.92.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100000875; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.93.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100000876; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.93.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100000877; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.93.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000878; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.93.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000879; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.94.224"; content:"Host"; http_header; classtype:trojan-activity; sid:100000880; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.93.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000877; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.93.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000878; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.94.224"; content:"Host"; http_header; classtype:trojan-activity; sid:100000879; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.94.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100000880; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.94.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100000881; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.94.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100000882; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.94.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100000883; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.95.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100000884; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.96.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100000885; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.95.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100000884; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.95.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100000885; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.96.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100000886; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.97.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000887; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.97.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100000888; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.96.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000887; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.97.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100000888; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.99.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100000889; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.99.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100000890; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.19.183.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000891; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.205.101.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000892; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.21.164.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000893; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.217.8.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000894; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.22.117.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100000895; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.222.252.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000896; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.34.183.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100000897; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.48.235.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000898; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.95.136.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000899; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.159.58.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000900; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.4.187.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100000901; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.175.99.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100000891; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.19.183.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100000892; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.205.101.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100000893; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.21.164.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000894; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.217.8.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100000895; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.22.117.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100000896; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.222.252.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000897; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.34.183.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100000898; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.48.235.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100000899; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.95.136.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100000900; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.159.58.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000901; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.43.176.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000902; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.43.176.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100000903; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.60.84.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100000904; rev:1;) @@ -941,196 +941,196 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"181.49.236.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100000935; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"181.49.59.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100000936; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"181.80.69.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000937; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.115.179.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100000938; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.119.206.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100000939; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.119.225.221"; content:"Host"; http_header; classtype:trojan-activity; sid:100000940; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.119.228.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100000941; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.120.16.22"; content:"Host"; http_header; classtype:trojan-activity; sid:100000942; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.120.16.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000943; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.126.116.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100000944; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.127.139.169"; content:"Host"; http_header; classtype:trojan-activity; sid:100000945; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.160.98.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100000946; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.233.0.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100000947; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.235.252.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100000948; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.53.197.62"; content:"Host"; http_header; classtype:trojan-activity; sid:100000949; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.105.104.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100000950; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.112.177.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100000938; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.115.179.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100000939; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.119.206.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100000940; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.119.225.221"; content:"Host"; http_header; classtype:trojan-activity; sid:100000941; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.119.228.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100000942; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.120.16.22"; content:"Host"; http_header; classtype:trojan-activity; sid:100000943; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.120.16.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100000944; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.126.116.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100000945; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.127.139.169"; content:"Host"; http_header; classtype:trojan-activity; sid:100000946; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.160.98.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100000947; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.233.0.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100000948; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.235.252.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100000949; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"182.53.197.62"; content:"Host"; http_header; classtype:trojan-activity; sid:100000950; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.105.225.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100000951; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.109.169.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000952; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.143.148.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100000953; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.188.50.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000954; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.83.8.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100000955; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"184.164.185.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000956; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"184.74.149.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000957; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"184.82.15.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000958; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.106.209.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000959; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.107.3.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000960; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.117.2.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000961; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.172.110.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000962; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.174.101.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000963; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.181.10.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000964; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.21.106.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100000965; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.215.113.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000966; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.215.113.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000967; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.215.113.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000968; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.221.3.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000969; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.222.58.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100000970; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.224.129.224"; content:"Host"; http_header; classtype:trojan-activity; sid:100000971; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.228.141.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000972; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.233.186.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000973; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.245.96.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000974; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.26.113.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100000975; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.34.16.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100000976; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.38.142.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100000977; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.55.1.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000978; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.68.230.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000979; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.8.173.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000980; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.81.157.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000981; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.217.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000982; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.217.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000983; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.219.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100000984; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.219.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000985; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.219.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100000986; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.151.144.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000987; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.219.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000988; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.243.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000989; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.243.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100000990; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.243.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000991; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.253.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100000992; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.225.120.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000993; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.232.44.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100000994; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.28.60.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000995; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.34.4.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100000996; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.73.188.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000997; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"187.12.10.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000998; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"187.188.124.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100000999; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.10.21.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100001000; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.10.231.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100001001; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.13.179.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100001002; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.138.200.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100001003; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.143.220.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100001004; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.152.41.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100001005; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.169.178.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001006; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.169.179.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100001007; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.169.36.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001008; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.242.167.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001009; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.242.242.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001010; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.83.202.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100001011; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.0.42.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100001012; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.109.178.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001013; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.110.161.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100001014; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.111.151.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001015; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.119.207.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001016; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.12.99.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001017; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100001018; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100001019; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100001020; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001021; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001022; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.76"; content:"Host"; http_header; classtype:trojan-activity; sid:100001023; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.130.15.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100001024; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.130.20.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100001025; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.147.16.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100001026; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.159.240.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100001027; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.187.55.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100001028; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.210.214.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001029; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.213.177.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100001030; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.213.226.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001031; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.213.49.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100001032; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.214.24.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001033; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.216.140.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100001034; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.65.206.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100001035; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.85.213.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001036; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.98.37.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001037; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.98.37.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001038; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.98.41.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001039; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"191.255.248.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001040; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.153.57.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001041; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.210.175.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001042; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.185.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100001043; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.209.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100001044; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.220.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100001045; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.228.67"; content:"Host"; http_header; classtype:trojan-activity; sid:100001046; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.230.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001047; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.230.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001048; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.230.76"; content:"Host"; http_header; classtype:trojan-activity; sid:100001049; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.236.147.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001050; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.99.240.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001051; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.113.107.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001052; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.147.142.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001053; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.15.36.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001054; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.152.35.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001055; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.38.20.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001056; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"195.139.126.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001057; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"195.228.231.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001058; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"195.24.94.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100001059; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"195.5.3.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100001060; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"196.202.26.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001061; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"196.221.148.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100001062; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"196.221.166.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001063; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"197.50.27.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001064; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.23.133.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001065; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.23.174.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100001066; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.23.213.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100001067; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.23.251.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001068; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.46.132.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001069; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1am.co.nz"; content:"Host"; http_header; classtype:trojan-activity; sid:100001070; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.239.22.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001071; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.36.231.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001072; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.37.149.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001073; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.45.111.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100001074; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.45.4.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100001075; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.55.125.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001076; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.55.92.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100001077; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.56.8.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100001078; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.57.122.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001079; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.83.152.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001080; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"20.185.42.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100001081; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"200.105.167.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001082; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"200.111.189.70"; content:"Host"; http_header; classtype:trojan-activity; sid:100001083; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"200.194.4.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100001084; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"200.30.132.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001085; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.170.46.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100001086; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.184.163.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100001087; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.187.102.73"; content:"Host"; http_header; classtype:trojan-activity; sid:100001088; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.200.254.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100001089; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.203.221.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001090; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.203.27.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100001091; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.107.233.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001092; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.150.176.100"; content:"Host"; http_header; classtype:trojan-activity; sid:100001093; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.166.217.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100001094; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.175.103.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100001095; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.29.95.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001096; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.4.124.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001097; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.51.176.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001098; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.51.191.174"; content:"Host"; http_header; classtype:trojan-activity; sid:100001099; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.74.236.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100001100; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.109.201.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001101; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.159.80.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100001102; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.159.80.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001103; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.170.123.78"; content:"Host"; http_header; classtype:trojan-activity; sid:100001104; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.189.156.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001105; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.204.232.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001106; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.229.21.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100001107; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.236.190.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001108; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.238.86.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100001109; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.243.142.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001110; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.70.166.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001111; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.77.80.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001112; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.80.119.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001113; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.80.171.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001114; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.82.36.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001115; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.93.6.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001116; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"204.195.116.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100001117; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"206.248.137.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001118; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"206.47.41.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001119; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"207.5.32.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100001120; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"208.163.58.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001121; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"208.75.27.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100001122; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"209.141.40.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100001123; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"209.141.40.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001124; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"209.146.98.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001125; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"210.124.149.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100001126; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"210.180.17.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100001127; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.83.1.1"; content:"Host"; http_header; classtype:trojan-activity; sid:100000955; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.83.14.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100000956; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"184.164.185.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000957; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"184.175.115.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100000958; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"184.74.149.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100000959; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"184.82.15.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100000960; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.106.209.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100000961; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.107.3.8"; content:"Host"; http_header; classtype:trojan-activity; sid:100000962; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.117.2.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100000963; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.172.110.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100000964; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.174.101.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100000965; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.181.10.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100000966; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.21.106.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100000967; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.215.113.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000968; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.215.113.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100000969; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.215.113.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000970; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.221.3.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100000971; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.222.58.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100000972; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.228.141.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000973; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.233.186.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100000974; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.245.96.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100000975; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.26.113.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100000976; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.34.16.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100000977; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.38.142.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100000978; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.55.1.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100000979; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.68.230.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100000980; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.8.173.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100000981; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.81.154.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100000982; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.81.157.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100000983; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.217.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100000984; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.217.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100000985; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.219.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100000986; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.219.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000987; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.82.219.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100000988; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.151.144.85"; content:"Host"; http_header; classtype:trojan-activity; sid:100000989; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.219.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100000990; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.243.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100000991; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.243.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100000992; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.243.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100000993; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.179.253.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100000994; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.225.120.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000995; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.232.44.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100000996; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.28.60.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100000997; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.34.4.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100000998; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.73.188.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100000999; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"187.12.10.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001000; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"187.188.124.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100001001; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.10.21.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100001002; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.10.231.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100001003; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.13.179.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100001004; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.138.200.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100001005; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.143.220.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100001006; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.152.41.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100001007; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.169.178.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001008; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.169.179.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100001009; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.169.199.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100001010; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.169.30.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100001011; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.169.36.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001012; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.242.167.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001013; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.242.242.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001014; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"188.83.202.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100001015; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.0.42.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100001016; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.109.178.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001017; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.110.161.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100001018; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.111.151.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001019; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.119.207.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001020; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.12.99.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001021; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.160"; content:"Host"; http_header; classtype:trojan-activity; sid:100001022; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100001023; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100001024; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001025; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001026; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.122.112.76"; content:"Host"; http_header; classtype:trojan-activity; sid:100001027; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.130.15.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100001028; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.130.20.14"; content:"Host"; http_header; classtype:trojan-activity; sid:100001029; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.147.16.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100001030; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.159.240.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100001031; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.187.55.150"; content:"Host"; http_header; classtype:trojan-activity; sid:100001032; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.210.214.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001033; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.213.177.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100001034; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.213.226.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001035; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.213.49.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100001036; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.214.24.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001037; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.216.140.123"; content:"Host"; http_header; classtype:trojan-activity; sid:100001038; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.65.206.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100001039; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.85.213.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001040; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.92.4.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001041; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.98.37.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001042; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.98.37.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001043; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"190.98.41.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001044; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"191.255.248.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001045; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.153.57.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001046; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.210.175.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001047; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.185.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100001048; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.209.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100001049; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.220.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100001050; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.228.67"; content:"Host"; http_header; classtype:trojan-activity; sid:100001051; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.230.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001052; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.230.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001053; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.227.230.76"; content:"Host"; http_header; classtype:trojan-activity; sid:100001054; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.99.240.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001055; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.113.107.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001056; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.147.142.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001057; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.15.36.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001058; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.152.35.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001059; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"194.38.20.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001060; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"195.139.126.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001061; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"195.228.231.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001062; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"195.24.94.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100001063; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"195.5.3.87"; content:"Host"; http_header; classtype:trojan-activity; sid:100001064; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"196.202.26.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001065; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"196.218.48.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001066; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"196.221.148.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100001067; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"196.221.166.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001068; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"197.50.27.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001069; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.23.213.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100001070; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.23.251.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001071; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.46.132.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001072; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"1am.co.nz"; content:"Host"; http_header; classtype:trojan-activity; sid:100001073; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.239.22.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001074; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.36.231.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001075; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.37.149.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001076; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.37.203.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001077; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.45.111.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100001078; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.45.4.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100001079; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.55.125.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001080; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.55.92.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100001081; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.56.8.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100001082; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.57.122.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001083; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.83.152.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001084; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"20.185.42.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100001085; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"200.105.167.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001086; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"200.111.189.70"; content:"Host"; http_header; classtype:trojan-activity; sid:100001087; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"200.194.4.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100001088; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"200.30.132.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001089; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.170.46.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100001090; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.171.40.215"; content:"Host"; http_header; classtype:trojan-activity; sid:100001091; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.184.163.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100001092; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.187.102.73"; content:"Host"; http_header; classtype:trojan-activity; sid:100001093; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.200.254.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100001094; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.203.221.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001095; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"201.203.27.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100001096; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.107.233.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001097; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.166.217.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100001098; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.175.103.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100001099; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.29.95.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001100; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.4.124.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001101; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.51.176.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001102; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.51.191.174"; content:"Host"; http_header; classtype:trojan-activity; sid:100001103; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.109.201.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001104; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.159.80.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100001105; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.159.80.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001106; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.159.80.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001107; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.170.123.78"; content:"Host"; http_header; classtype:trojan-activity; sid:100001108; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.189.156.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001109; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.204.232.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001110; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.229.21.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100001111; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.236.190.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001112; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.70.166.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001113; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.80.119.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001114; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.80.171.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001115; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.82.36.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001116; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"203.93.6.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001117; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"204.195.116.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100001118; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"206.248.137.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001119; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"206.47.41.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001120; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"207.5.32.6"; content:"Host"; http_header; classtype:trojan-activity; sid:100001121; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"208.163.58.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001122; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"208.75.27.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100001123; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"209.141.40.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100001124; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"209.141.40.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001125; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"209.146.98.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001126; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"210.124.149.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100001127; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"210.216.152.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001128; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"210.216.153.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100001129; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"210.57.234.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100001130; rev:1;) @@ -1139,479 +1139,479 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"210.68.242.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001133; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.187.132.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100001134; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.187.75.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001135; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.200.160.239"; content:"Host"; http_header; classtype:trojan-activity; sid:100001136; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.204.215.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100001137; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.210.66.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100001138; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.210.93.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100001139; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.216.66.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001140; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.237.114.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001141; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.237.120.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001142; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.204.215.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100001136; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.210.66.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100001137; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.210.93.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100001138; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.216.66.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001139; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.237.114.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001140; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.237.120.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001141; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.237.246.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100001142; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.238.83.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100001143; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.247.5.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001144; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.32.122.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100001145; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"211.93.191.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001146; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"212.122.86.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001147; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"212.143.227.22"; content:"Host"; http_header; classtype:trojan-activity; sid:100001148; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"212.46.197.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001149; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"212.56.197.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001150; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.123.206.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100001151; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.135.178.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100001152; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.14.173.117"; content:"Host"; http_header; classtype:trojan-activity; sid:100001153; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.149.190.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100001154; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.104.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001155; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.104.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001156; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.111.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001157; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.114.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100001158; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.114.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001159; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.115.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100001160; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.116.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001161; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.126.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001162; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.126.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001163; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.126.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001164; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"212.156.215.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001149; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"212.46.197.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001150; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"212.56.197.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001151; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.123.206.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100001152; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.135.178.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100001153; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.14.173.117"; content:"Host"; http_header; classtype:trojan-activity; sid:100001154; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.149.190.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100001155; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.104.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001156; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.104.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001157; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.111.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001158; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.114.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100001159; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.116.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001160; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.118.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100001161; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.118.216"; content:"Host"; http_header; classtype:trojan-activity; sid:100001162; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.126.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001163; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.126.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001164; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.163.126.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001165; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.189.178.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001166; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.240.218.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001167; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.249.156.189"; content:"Host"; http_header; classtype:trojan-activity; sid:100001168; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.91.244.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001169; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.186.69.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100001166; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.189.178.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001167; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.240.218.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001168; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.249.156.189"; content:"Host"; http_header; classtype:trojan-activity; sid:100001169; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"213.92.254.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001170; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"216.158.238.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001171; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"216.170.240.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001172; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"216.183.54.169"; content:"Host"; http_header; classtype:trojan-activity; sid:100001173; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"216.36.12.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001174; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"217.11.75.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100001175; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.12.181.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100001176; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.161.69.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001177; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.2.40.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001178; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.234.165.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001179; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.238.246.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100001180; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.35.207.119"; content:"Host"; http_header; classtype:trojan-activity; sid:100001181; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.35.227.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001182; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.35.68.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001183; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.35.81.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100001184; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.56.93.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001185; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.59.116.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001186; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.79.103.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001187; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.93.102.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001188; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.93.102.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100001189; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.155.29.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001190; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.155.64.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100001191; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.157.139.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001192; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.157.202.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100001193; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.157.214.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100001194; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.241.6.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001195; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.1.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100001196; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.1.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001197; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.163.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001198; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.171.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001199; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.245.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001200; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.5.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100001201; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.69.71.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100001202; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.80.217.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001203; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.85.145.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001204; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"21robo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001205; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.118.168.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100001206; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.126.237.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001207; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.132.89.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100001208; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.200.22.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001209; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.90.159.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001210; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.0.133.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001211; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.124.78.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001212; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.157.191.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001213; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.160.136.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001214; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.201.54.97"; content:"Host"; http_header; classtype:trojan-activity; sid:100001215; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.202.232.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001216; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.214.130.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100001217; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.214.251.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001218; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.116.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001219; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.172.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100001220; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.184.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001221; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.252.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001222; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.8.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001223; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.232.183.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001224; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.235.137.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001225; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.3.112.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001226; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.3.43.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100001227; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.3.68.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001228; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.108.17.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001229; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.118.248.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001230; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.119.65.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100001231; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.132.125.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001232; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.133.103.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100001233; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.135.9.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100001234; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.137.139.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100001235; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.137.73.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100001236; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.138.201.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001237; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.140.17.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100001238; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.185.116.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100001239; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.187.9.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001240; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.211.72.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001241; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.236.85.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001242; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.238.230.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001243; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.239.83.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100001244; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.248.64.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100001245; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.92.9.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100001246; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.95.190.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001247; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.99.171.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100001248; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.13.87.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001249; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.131.201.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001250; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.166.117.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100001251; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.167.118.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100001252; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.212.234.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001253; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.212.5.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001254; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.212.73.175"; content:"Host"; http_header; classtype:trojan-activity; sid:100001255; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.115.118.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100001256; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.125.186.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001257; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.126.120.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100001258; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.24.213.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001259; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.243.149.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001260; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.243.21.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001261; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.95.89.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100001262; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.103.74.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001263; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.11.141.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001264; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.119.158.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001265; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.137.147.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100001266; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.137.233.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001267; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.158.25.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001268; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.176.206.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001269; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.184.1.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001270; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.192.191.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001271; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.225.114.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100001272; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.227.190.78"; content:"Host"; http_header; classtype:trojan-activity; sid:100001273; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.35.245.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001274; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.39.181.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001275; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.39.34.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001276; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.42.229.143"; content:"Host"; http_header; classtype:trojan-activity; sid:100001277; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.45.4.1"; content:"Host"; http_header; classtype:trojan-activity; sid:100001278; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.51.91.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100001279; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.53.163.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100001280; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.53.163.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100001281; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.89.140.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100001282; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.1.245.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001283; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.1.245.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001284; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.105.106.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001285; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.105.152.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001286; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.116.84.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001287; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.117.105.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001288; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.14.211.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100001289; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.14.81.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001290; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.141.218.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100001291; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.147.29.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001292; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.147.40.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100001293; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.184.251.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001294; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.193.217.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100001295; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.194.149.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100001296; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.194.192.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001297; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.197.23.215"; content:"Host"; http_header; classtype:trojan-activity; sid:100001298; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.199.232.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001299; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.199.34.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100001300; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.200.110.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100001301; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.200.32.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100001302; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.201.183.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001303; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.202.182.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001304; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.102.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001305; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.116.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100001306; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.165.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001307; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.185.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001308; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.255.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001309; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.28.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001310; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.4.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001311; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.47.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100001312; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.68.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001313; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.87.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100001314; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.94.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001315; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.204.253.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001316; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.205.178.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100001317; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.206.136.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100001318; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.206.154.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001319; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.206.80.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001320; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.119.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100001321; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.237.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001322; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.247.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001323; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.25.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100001324; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.34.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100001325; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.209.208.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001326; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.209.231.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001327; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.21.151.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001328; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.107.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001329; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.234.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001330; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.236.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001331; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.32.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001332; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.63.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001333; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.104.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001334; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.109.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001335; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.110.189"; content:"Host"; http_header; classtype:trojan-activity; sid:100001336; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.175.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100001337; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.255.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100001338; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.66.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001339; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.84.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001340; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.214.37.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001341; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.139.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001342; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.190.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100001343; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.212.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001344; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.253.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001345; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.71.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001346; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.98.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001347; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.128.156"; content:"Host"; http_header; classtype:trojan-activity; sid:100001348; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.144.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001349; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.225.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001350; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.227.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100001351; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.234.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001352; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.217.191.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001353; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.218.248.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001354; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.132.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100001355; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.151.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001356; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.160.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001357; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.176.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001358; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.83.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001359; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.220.20.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001360; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.220.249.0"; content:"Host"; http_header; classtype:trojan-activity; sid:100001361; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.220.85.168"; content:"Host"; http_header; classtype:trojan-activity; sid:100001362; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.221.239.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100001363; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.222.241.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100001364; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.222.76.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100001365; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.223.242.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001366; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.129.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100001367; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.154.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001368; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.2.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100001369; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.212.124"; content:"Host"; http_header; classtype:trojan-activity; sid:100001370; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.58.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100001371; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.7.204.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001372; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.0.98.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001373; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.11.51.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001374; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.13.23.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001375; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.124.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001376; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.146.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001377; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.179.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001378; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.184.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100001379; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.191.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001380; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.194.67"; content:"Host"; http_header; classtype:trojan-activity; sid:100001381; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.216.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001382; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.219.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001383; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.24.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001384; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.30.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001385; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.63.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001386; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.65.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100001387; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.79.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001388; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.94.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001389; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.179.201.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100001390; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.195.84.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100001391; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.210.20.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001392; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.210.20.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100001393; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.210.20.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100001394; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.28.7.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001395; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.30.119.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100001396; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.32.120.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100001397; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"32.208.157.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100001398; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"32792.prolocksmithwinterpark.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001399; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"34.122.44.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001400; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"35.184.169.169"; content:"Host"; http_header; classtype:trojan-activity; sid:100001401; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.108.231.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001402; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.248.83.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001403; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.249.49.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100001404; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.250.203.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100001405; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.251.157.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100001406; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.251.18.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001407; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.251.51.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001408; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.255.90.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100001409; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.33.160.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001410; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.34.150.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001411; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.66.105.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001412; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.66.133.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001413; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.66.139.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001414; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.89.18.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001415; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.91.89.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100001416; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"360.lcy2zzx.pw"; content:"Host"; http_header; classtype:trojan-activity; sid:100001417; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"360down7.miiyun.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100001418; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.222.98.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001419; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.233.60.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100001420; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.34.179.221"; content:"Host"; http_header; classtype:trojan-activity; sid:100001421; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.34.180.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100001422; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.44.238.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001423; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.52.118.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001424; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.54.14.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001425; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.113.245.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001426; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.113.98.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100001427; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.117.31.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100001428; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.162.104.119"; content:"Host"; http_header; classtype:trojan-activity; sid:100001429; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.162.98.216"; content:"Host"; http_header; classtype:trojan-activity; sid:100001430; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.65.196.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001431; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.66.44.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001432; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.104.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001433; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.125.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100001434; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.146.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100001435; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.206.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100001436; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.92.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001437; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.68.171.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001438; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.68.249.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001439; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.68.60.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100001440; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.72.167.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100001441; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.72.67.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001442; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.73.10.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100001443; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.73.163.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001444; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.73.168.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100001445; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.73.203.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100001446; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.76.194.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001447; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.76.78.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100001448; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.113.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001449; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.114.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100001450; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.150.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001451; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.209.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001452; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.48.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001453; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.63.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100001454; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.79.166.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001455; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.79.218.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100001456; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.79.91.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001457; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.79.93.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100001458; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.127.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100001459; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.18.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100001460; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.191.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100001461; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.205.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001462; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.24.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100001463; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.36.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100001464; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.37.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001465; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.81.251.0"; content:"Host"; http_header; classtype:trojan-activity; sid:100001466; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.81.27.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001467; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.81.29.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001468; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.81.70.88"; content:"Host"; http_header; classtype:trojan-activity; sid:100001469; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.83.94.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100001470; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.84.115.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100001471; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.85.54.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001472; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.86.211.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001473; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.86.234.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100001474; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.86.78.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001475; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.87.63.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001476; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.87.93.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001477; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.143.176"; content:"Host"; http_header; classtype:trojan-activity; sid:100001478; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.155.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001479; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.233.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001480; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.67.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100001481; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.72.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100001482; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.89.145.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100001483; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.89.146.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001484; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.89.63.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100001485; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.90.176.191"; content:"Host"; http_header; classtype:trojan-activity; sid:100001486; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.90.86.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100001487; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"40.88.2.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100001488; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.139.209.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100001489; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.165.130.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100001490; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.190.63.174"; content:"Host"; http_header; classtype:trojan-activity; sid:100001491; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.193.192.100"; content:"Host"; http_header; classtype:trojan-activity; sid:100001492; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.219.185.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100001493; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.226.60.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001494; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.72.203.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001495; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.76.157.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100001496; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.86.18.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001497; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.86.18.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001498; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.86.5.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100001499; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.202.101.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001500; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.228.60.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001501; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.229.173.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100001502; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.230.91.1"; content:"Host"; http_header; classtype:trojan-activity; sid:100001503; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.231.208.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001504; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.56.15.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001505; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.61.99.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100001506; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.82.217.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100001507; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"43.241.106.183"; content:"Host"; http_header; classtype:trojan-activity; sid:100001508; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"43.241.108.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001509; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"43.252.8.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001510; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.133.1.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001511; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.133.203.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100001512; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.135.134.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100001513; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.14.149.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001514; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.14.149.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001515; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.14.149.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100001516; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.141.84.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001517; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.141.84.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100001518; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001519; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001520; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001521; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001522; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001523; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100001524; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.148.10.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100001525; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.148.10.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001526; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.176.109.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001527; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.176.111.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001528; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.176.111.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001529; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.201.167.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001530; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.22.209.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001531; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.232.73.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100001532; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.248.194.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100001533; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.27.253.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100001534; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.51.104.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100001535; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.6.24.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100001536; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.85.90.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001537; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.85.90.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001538; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.89.26.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100001539; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.9.148.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100001540; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.92.108.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001541; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.95.169.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001542; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.114.28.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001543; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.161.185.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001544; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.172.75.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001545; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.20.63.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001546; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.214.27.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001547; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.214.35.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001548; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.236.65.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001549; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.24.130.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001550; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.241.120.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001551; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.243.179.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001552; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.249.33.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100001553; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.25.242.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100001554; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.42.118.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100001555; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.42.86.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100001556; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.97.76.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001557; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.103.219.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001558; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.145.152.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100001559; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.151.23.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100001560; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.157.97.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100001561; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.16.131.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001562; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.21.202.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001563; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.46.231.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100001564; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.142.162.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100001565; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.142.87.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001566; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.143.43.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100001567; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.156.35.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001568; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.158.201.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001569; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.159.20.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001570; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.159.21.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100001571; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.174.182.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001572; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.213.170.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100001573; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.213.178.183"; content:"Host"; http_header; classtype:trojan-activity; sid:100001574; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.213.179.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001575; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.14.122.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100001576; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.188.62.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100001577; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.2.70.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001578; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.53.146.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100001579; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.95.226.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100001580; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.115.174.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100001581; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.115.174.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100001582; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.115.174.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100001583; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.121.91.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001584; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.247.83.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001585; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.252.47.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001586; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"54.36.114.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100001587; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"54.36.180.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001588; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.114.246.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100001589; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.115.162.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100001590; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.115.174.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001591; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.125.191.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001592; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.126.247.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001593; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.141.122.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001594; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.142.166.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100001595; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.142.200.124"; content:"Host"; http_header; classtype:trojan-activity; sid:100001596; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.218.67.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100001597; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.22.212.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001598; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.226.129.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001599; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.229.194.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001600; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.230.89.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001601; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.237.125.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001602; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.238.42.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100001603; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.240.147.97"; content:"Host"; http_header; classtype:trojan-activity; sid:100001604; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.241.78.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100001605; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.243.126.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001606; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.72.165.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001607; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.72.165.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100001608; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"216.183.54.196"; content:"Host"; http_header; classtype:trojan-activity; sid:100001174; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"216.36.12.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001175; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"217.11.75.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100001176; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"217.12.209.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001177; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.12.181.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100001178; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.2.40.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001179; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.234.165.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001180; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.238.246.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100001181; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.255.226.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001182; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.32.118.1"; content:"Host"; http_header; classtype:trojan-activity; sid:100001183; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.35.207.119"; content:"Host"; http_header; classtype:trojan-activity; sid:100001184; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.35.227.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001185; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.35.68.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001186; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.35.81.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100001187; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.56.93.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001188; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.59.116.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001189; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.79.103.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001190; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.93.102.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001191; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"218.93.102.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100001192; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.155.234.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001193; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.155.29.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001194; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.155.64.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100001195; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.157.139.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001196; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.241.6.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001197; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.1.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100001198; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.1.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001199; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.163.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001200; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.171.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001201; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.245.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001202; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.68.5.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100001203; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.69.71.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100001204; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.80.217.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001205; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"219.85.145.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001206; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"21robo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001207; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.118.168.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100001208; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.126.237.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001209; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.200.22.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001210; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.81.44.181"; content:"Host"; http_header; classtype:trojan-activity; sid:100001211; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"220.90.159.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001212; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.0.133.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001213; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.124.78.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001214; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.157.191.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001215; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.160.136.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001216; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.201.54.97"; content:"Host"; http_header; classtype:trojan-activity; sid:100001217; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.202.232.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001218; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.214.130.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100001219; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.214.251.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001220; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.116.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001221; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.172.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100001222; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.184.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001223; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.252.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001224; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.215.8.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001225; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.232.183.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001226; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.235.137.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001227; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.3.112.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001228; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.3.43.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100001229; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"221.3.68.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001230; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.108.17.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001231; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.118.248.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001232; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.119.65.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100001233; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.132.125.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001234; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.133.103.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100001235; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.135.9.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100001236; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.137.133.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001237; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.137.139.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100001238; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.137.73.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100001239; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.140.17.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100001240; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.142.210.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001241; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.185.116.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100001242; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.186.20.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100001243; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.187.9.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001244; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.211.72.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001245; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.236.85.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001246; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.238.230.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001247; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.239.83.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100001248; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.248.64.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100001249; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.92.9.126"; content:"Host"; http_header; classtype:trojan-activity; sid:100001250; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.95.190.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001251; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"222.99.171.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100001252; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.13.87.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001253; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.131.201.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001254; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.166.117.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100001255; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.167.118.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100001256; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.212.234.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001257; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.212.5.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001258; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"223.212.73.175"; content:"Host"; http_header; classtype:trojan-activity; sid:100001259; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.115.118.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100001260; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.125.186.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001261; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.126.120.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100001262; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.24.213.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001263; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.243.149.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001264; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.243.21.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001265; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.95.122.24"; content:"Host"; http_header; classtype:trojan-activity; sid:100001266; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.95.89.21"; content:"Host"; http_header; classtype:trojan-activity; sid:100001267; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.103.74.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001268; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.11.141.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001269; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.119.158.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001270; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.137.147.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100001271; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.137.233.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001272; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.158.25.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001273; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.176.206.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001274; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.184.1.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001275; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.192.191.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001276; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.225.114.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100001277; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.227.190.78"; content:"Host"; http_header; classtype:trojan-activity; sid:100001278; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.35.245.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001279; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.39.181.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001280; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.39.34.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001281; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.42.229.143"; content:"Host"; http_header; classtype:trojan-activity; sid:100001282; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.45.4.1"; content:"Host"; http_header; classtype:trojan-activity; sid:100001283; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.51.91.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100001284; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.53.163.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100001285; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.53.163.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100001286; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"24.89.140.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100001287; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.1.245.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001288; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.1.245.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001289; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.105.106.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001290; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.105.152.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001291; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.116.84.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001292; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.117.105.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001293; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.14.211.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100001294; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.14.81.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001295; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.141.218.17"; content:"Host"; http_header; classtype:trojan-activity; sid:100001296; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.147.29.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001297; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.147.40.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100001298; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.184.251.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001299; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.193.217.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100001300; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.194.192.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001301; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.197.23.215"; content:"Host"; http_header; classtype:trojan-activity; sid:100001302; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.199.232.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001303; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.199.34.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100001304; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.200.110.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100001305; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.200.32.146"; content:"Host"; http_header; classtype:trojan-activity; sid:100001306; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.201.183.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001307; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.202.182.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001308; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.102.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001309; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.116.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100001310; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.165.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001311; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.185.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001312; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.255.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001313; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.28.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001314; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.4.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001315; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.47.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100001316; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.68.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001317; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.87.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100001318; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.203.94.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001319; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.204.253.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001320; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.205.178.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100001321; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.206.136.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100001322; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.206.154.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001323; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.206.80.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001324; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.119.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100001325; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.237.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001326; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.247.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001327; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.25.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100001328; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.208.34.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100001329; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.209.231.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001330; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.21.151.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001331; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.107.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001332; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.234.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001333; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.236.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001334; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.32.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001335; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.210.63.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001336; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.104.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001337; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.109.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001338; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.110.189"; content:"Host"; http_header; classtype:trojan-activity; sid:100001339; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.175.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100001340; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.255.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100001341; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.66.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001342; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.213.84.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001343; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.214.37.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001344; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.139.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001345; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.190.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100001346; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.212.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001347; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.253.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001348; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.71.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001349; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.215.98.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001350; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.128.156"; content:"Host"; http_header; classtype:trojan-activity; sid:100001351; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.144.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001352; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.225.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001353; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.227.95"; content:"Host"; http_header; classtype:trojan-activity; sid:100001354; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.216.234.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001355; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.217.191.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001356; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.218.248.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001357; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.132.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100001358; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.151.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001359; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.160.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001360; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.176.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001361; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.219.83.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001362; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.220.20.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001363; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.220.249.0"; content:"Host"; http_header; classtype:trojan-activity; sid:100001364; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.220.85.168"; content:"Host"; http_header; classtype:trojan-activity; sid:100001365; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.221.239.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100001366; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.222.241.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100001367; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.222.76.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100001368; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.223.242.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001369; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.129.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100001370; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.154.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001371; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.171.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001372; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.212.124"; content:"Host"; http_header; classtype:trojan-activity; sid:100001373; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.35.58.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100001374; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"27.6.255.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100001375; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.0.98.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001376; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.11.51.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001377; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.13.23.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001378; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.124.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001379; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.146.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001380; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.179.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001381; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.184.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100001382; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.191.243"; content:"Host"; http_header; classtype:trojan-activity; sid:100001383; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.194.67"; content:"Host"; http_header; classtype:trojan-activity; sid:100001384; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.216.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001385; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.219.28"; content:"Host"; http_header; classtype:trojan-activity; sid:100001386; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.24.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001387; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.30.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001388; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.63.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001389; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.65.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100001390; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.79.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001391; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.168.94.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001392; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.179.201.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100001393; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.195.84.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100001394; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.210.20.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001395; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.210.20.177"; content:"Host"; http_header; classtype:trojan-activity; sid:100001396; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.210.20.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100001397; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.28.7.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001398; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.30.119.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100001399; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"31.32.120.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100001400; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"32.208.157.193"; content:"Host"; http_header; classtype:trojan-activity; sid:100001401; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"34.122.44.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001402; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"35.184.169.169"; content:"Host"; http_header; classtype:trojan-activity; sid:100001403; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.108.231.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001404; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.248.83.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001405; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.249.49.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100001406; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.250.203.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100001407; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.251.157.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100001408; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.251.18.18"; content:"Host"; http_header; classtype:trojan-activity; sid:100001409; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.251.51.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001410; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.255.90.219"; content:"Host"; http_header; classtype:trojan-activity; sid:100001411; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.33.160.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001412; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.34.150.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001413; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.66.105.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001414; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.66.133.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001415; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.66.139.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001416; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.67.152.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100001417; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.89.18.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001418; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"36.91.89.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100001419; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"360.lcy2zzx.pw"; content:"Host"; http_header; classtype:trojan-activity; sid:100001420; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"360down7.miiyun.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100001421; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.222.98.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001422; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.233.60.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100001423; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.34.179.221"; content:"Host"; http_header; classtype:trojan-activity; sid:100001424; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.34.180.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100001425; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.44.238.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001426; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.52.118.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001427; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"37.54.14.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001428; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.113.245.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001429; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.113.98.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100001430; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.117.31.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100001431; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.162.104.119"; content:"Host"; http_header; classtype:trojan-activity; sid:100001432; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.162.98.216"; content:"Host"; http_header; classtype:trojan-activity; sid:100001433; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.65.196.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001434; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.66.44.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001435; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.104.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001436; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.125.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100001437; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.146.60"; content:"Host"; http_header; classtype:trojan-activity; sid:100001438; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.206.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100001439; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.67.92.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001440; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.68.171.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001441; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.68.249.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001442; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.68.60.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100001443; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.72.167.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100001444; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.72.67.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001445; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.73.10.198"; content:"Host"; http_header; classtype:trojan-activity; sid:100001446; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.73.163.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001447; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.73.168.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100001448; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.73.203.225"; content:"Host"; http_header; classtype:trojan-activity; sid:100001449; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.76.194.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001450; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.76.78.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100001451; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.113.201"; content:"Host"; http_header; classtype:trojan-activity; sid:100001452; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.114.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100001453; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.150.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001454; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.209.209"; content:"Host"; http_header; classtype:trojan-activity; sid:100001455; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.48.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001456; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.77.63.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100001457; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.79.166.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001458; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.79.218.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100001459; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.79.91.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001460; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.79.93.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100001461; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.127.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100001462; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.18.140"; content:"Host"; http_header; classtype:trojan-activity; sid:100001463; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.191.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100001464; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.205.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001465; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.24.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100001466; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.36.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100001467; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.80.37.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001468; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.81.251.0"; content:"Host"; http_header; classtype:trojan-activity; sid:100001469; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.81.27.15"; content:"Host"; http_header; classtype:trojan-activity; sid:100001470; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.81.29.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001471; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.81.70.88"; content:"Host"; http_header; classtype:trojan-activity; sid:100001472; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.83.94.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100001473; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.84.115.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100001474; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.85.54.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001475; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.86.211.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001476; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.86.234.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100001477; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.86.78.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001478; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.87.63.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001479; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.87.93.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001480; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.143.176"; content:"Host"; http_header; classtype:trojan-activity; sid:100001481; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.155.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001482; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.233.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001483; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.67.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100001484; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.88.72.9"; content:"Host"; http_header; classtype:trojan-activity; sid:100001485; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.89.145.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100001486; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.89.146.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001487; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.89.63.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100001488; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.90.176.191"; content:"Host"; http_header; classtype:trojan-activity; sid:100001489; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"39.90.86.212"; content:"Host"; http_header; classtype:trojan-activity; sid:100001490; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"40.88.2.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100001491; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.139.209.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100001492; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.165.130.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100001493; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.193.192.100"; content:"Host"; http_header; classtype:trojan-activity; sid:100001494; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.219.185.171"; content:"Host"; http_header; classtype:trojan-activity; sid:100001495; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.226.60.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001496; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.72.203.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001497; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.76.157.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100001498; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.86.18.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001499; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.86.5.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001500; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"41.86.5.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100001501; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.202.101.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001502; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.202.101.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001503; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.224.51.229"; content:"Host"; http_header; classtype:trojan-activity; sid:100001504; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.228.60.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001505; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.229.173.80"; content:"Host"; http_header; classtype:trojan-activity; sid:100001506; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.230.91.1"; content:"Host"; http_header; classtype:trojan-activity; sid:100001507; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.231.208.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001508; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.236.212.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100001509; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.56.15.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001510; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"42.61.99.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100001511; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"43.230.207.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100001512; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"43.241.106.183"; content:"Host"; http_header; classtype:trojan-activity; sid:100001513; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.133.1.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001514; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.133.203.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100001515; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.135.134.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100001516; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.14.149.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001517; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.14.149.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001518; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.14.149.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100001519; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.141.84.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100001520; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001521; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.135"; content:"Host"; http_header; classtype:trojan-activity; sid:100001522; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001523; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001524; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001525; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.144.225.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100001526; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.148.10.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100001527; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.148.10.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001528; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.156.22.230"; content:"Host"; http_header; classtype:trojan-activity; sid:100001529; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.176.109.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001530; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.176.111.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001531; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.176.111.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001532; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.201.167.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001533; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.22.209.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001534; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.232.73.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100001535; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.248.194.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100001536; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.27.253.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100001537; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.51.104.59"; content:"Host"; http_header; classtype:trojan-activity; sid:100001538; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.6.24.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100001539; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.85.90.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001540; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.85.90.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001541; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.89.26.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100001542; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.9.148.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100001543; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.92.108.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001544; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.95.169.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001545; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.114.28.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001546; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.172.75.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001547; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.20.63.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001548; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.214.27.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001549; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.214.35.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001550; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.236.65.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001551; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.24.130.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001552; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.241.120.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001553; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.243.179.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001554; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.249.33.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100001555; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.25.242.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100001556; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.42.118.86"; content:"Host"; http_header; classtype:trojan-activity; sid:100001557; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.42.86.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100001558; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"46.97.76.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001559; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.103.219.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001560; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.145.152.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100001561; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.151.23.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100001562; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.157.97.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100001563; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.16.131.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001564; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.21.202.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001565; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.46.231.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100001566; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.142.162.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100001567; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.142.87.36"; content:"Host"; http_header; classtype:trojan-activity; sid:100001568; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.143.43.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100001569; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.156.35.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001570; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.158.201.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001571; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.159.20.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001572; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.159.21.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100001573; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.174.182.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001574; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.213.170.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100001575; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.213.178.183"; content:"Host"; http_header; classtype:trojan-activity; sid:100001576; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"49.213.179.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001577; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"4et3ja.am.files.1drv.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001578; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.14.122.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100001579; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.188.62.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100001580; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.2.70.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001581; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.53.146.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100001582; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"5.95.226.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100001583; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.115.174.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100001584; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.115.174.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100001585; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.115.174.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100001586; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.121.91.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001587; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.247.83.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001588; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"50.252.47.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001589; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"54.36.114.136"; content:"Host"; http_header; classtype:trojan-activity; sid:100001590; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"54.36.180.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001591; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.114.246.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100001592; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.115.162.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100001593; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.115.174.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001594; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.125.191.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001595; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.126.247.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001596; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.142.166.120"; content:"Host"; http_header; classtype:trojan-activity; sid:100001597; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.142.200.124"; content:"Host"; http_header; classtype:trojan-activity; sid:100001598; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.22.212.107"; content:"Host"; http_header; classtype:trojan-activity; sid:100001599; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.226.129.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001600; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.229.194.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001601; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.230.89.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001602; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.237.125.4"; content:"Host"; http_header; classtype:trojan-activity; sid:100001603; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.238.42.192"; content:"Host"; http_header; classtype:trojan-activity; sid:100001604; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.240.147.97"; content:"Host"; http_header; classtype:trojan-activity; sid:100001605; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.241.78.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100001606; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.243.126.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001607; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.72.165.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001608; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.76.151.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001609; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"58.97.206.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001610; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"59.0.211.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100001611; rev:1;) @@ -1622,30 +1622,30 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"59.151.246.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001616; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"59.173.193.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100001617; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"59.23.114.97"; content:"Host"; http_header; classtype:trojan-activity; sid:100001618; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"59.30.12.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001619; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.13.61.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001620; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.208.135.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001621; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.209.122.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001622; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.209.186.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100001623; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.209.216.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100001624; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.209.233.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001625; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.211.6.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001626; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.100.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001627; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.111.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100001628; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.206.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100001629; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.218.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001630; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.220.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001631; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.254.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001632; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.213.83.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100001633; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.215.195.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100001634; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.217.177.196"; content:"Host"; http_header; classtype:trojan-activity; sid:100001635; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.217.86.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100001636; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.15.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100001637; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.4.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001638; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.44.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001639; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.51.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100001640; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.60.174"; content:"Host"; http_header; classtype:trojan-activity; sid:100001641; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.8.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100001642; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"59.26.181.228"; content:"Host"; http_header; classtype:trojan-activity; sid:100001619; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"59.30.12.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001620; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.13.61.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001621; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.208.135.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001622; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.209.122.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001623; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.209.186.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100001624; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.209.216.23"; content:"Host"; http_header; classtype:trojan-activity; sid:100001625; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.209.233.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001626; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.211.6.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001627; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.100.83"; content:"Host"; http_header; classtype:trojan-activity; sid:100001628; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.111.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100001629; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.206.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100001630; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.218.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001631; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.220.167"; content:"Host"; http_header; classtype:trojan-activity; sid:100001632; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.212.254.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001633; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.213.83.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100001634; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.215.195.111"; content:"Host"; http_header; classtype:trojan-activity; sid:100001635; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.217.177.196"; content:"Host"; http_header; classtype:trojan-activity; sid:100001636; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.217.86.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100001637; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.15.104"; content:"Host"; http_header; classtype:trojan-activity; sid:100001638; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.4.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001639; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.44.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001640; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.51.127"; content:"Host"; http_header; classtype:trojan-activity; sid:100001641; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.253.60.174"; content:"Host"; http_header; classtype:trojan-activity; sid:100001642; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.7.10.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001643; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.7.8.43"; content:"Host"; http_header; classtype:trojan-activity; sid:100001644; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"61.164.96.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001645; rev:1;) @@ -1676,928 +1676,928 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.141.73.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001670; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.219.131.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001671; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.219.143.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100001672; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.219.227.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001673; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.31.126.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001674; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.38.149.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001675; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.38.222.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001676; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.43.207.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100001677; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.90.165.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001678; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"63.245.122.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100001679; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.125.128.196"; content:"Host"; http_header; classtype:trojan-activity; sid:100001680; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.21.58.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100001681; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.26.155.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001682; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.35.61.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001683; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.229.214.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001684; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.57.55.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100001685; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.74.7.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100001686; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.97.181.196"; content:"Host"; http_header; classtype:trojan-activity; sid:100001687; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.245.151.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001688; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.8.138.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100001689; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.83.49.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100001690; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.84.138.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001691; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.148.103.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100001692; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.174.182.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100001693; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.175.107.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001694; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.188.144.143"; content:"Host"; http_header; classtype:trojan-activity; sid:100001695; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.204.88.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001696; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.205.106.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001697; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.205.119.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100001698; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.78.33.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001699; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.115.37.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001700; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.120.237.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001701; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.123.245.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100001702; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.124.231.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100001703; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.127.214.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100001704; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.146.232.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001705; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.165.173.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100001706; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.196.158.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001707; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.222.157.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001708; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.229.0.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001709; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.63.73.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100001710; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.75.115.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001711; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.75.227.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100001712; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.76.240.206"; content:"Host"; http_header; classtype:trojan-activity; sid:100001713; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.115.31.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100001714; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.118.240.88"; content:"Host"; http_header; classtype:trojan-activity; sid:100001715; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.167.10.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001716; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.236.190.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100001717; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.25.5.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001718; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.93.129.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001719; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.127.148.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100001720; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.146.190.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100001721; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.204.63.239"; content:"Host"; http_header; classtype:trojan-activity; sid:100001722; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.29.48.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001723; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.34.191.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001724; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.40.234.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001725; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.43.106.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100001726; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.43.2.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001727; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.43.235.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100001728; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.47.133.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001729; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.71.60.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100001730; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.85.106.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100001731; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.17.22.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100001732; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.189.180.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001733; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.189.200.62"; content:"Host"; http_header; classtype:trojan-activity; sid:100001734; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.202.249.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001735; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.214.69.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100001736; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.229.230.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001737; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.31.40.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001738; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"73.112.123.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001739; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"73.204.216.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100001740; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"73.70.164.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001741; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.101.1.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001742; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.108.224.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001743; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.119.195.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100001744; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.194.117.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001745; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.195.115.176"; content:"Host"; http_header; classtype:trojan-activity; sid:100001746; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.199.84.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001747; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.64.139.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100001748; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.75.165.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100001749; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"75.127.141.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001750; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"75.83.102.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100001751; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"75.99.213.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100001752; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.170.11.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001753; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.178.22.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100001754; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.217.92.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001755; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.250.199.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001756; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.254.129.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001757; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.84.134.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001758; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.95.12.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100001759; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.111.182.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001760; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.237.25.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100001761; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.71.50.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001762; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.71.52.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001763; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.89.203.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100001764; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77st.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100001765; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.145.224.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100001766; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.187.141.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001767; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.187.240.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001768; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.187.41.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001769; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.188.106.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100001770; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.188.168.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001771; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.188.188.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100001772; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.189.104.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100001773; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.189.176.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001774; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.23.172.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100001775; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.8.225.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001776; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.11.195.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001777; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.130.253.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001778; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.147.123.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100001779; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.167.189.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001780; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.175.42.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001781; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.21.84.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001782; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.7.170.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001783; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.79.58.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001784; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.8.70.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100001785; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.9.88.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100001786; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.107.89.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100001787; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.19.101.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001788; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.211.181.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001789; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.217.12.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001790; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.99.128.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100001791; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.136.146.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001792; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.165.44.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001793; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.191.40.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001794; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.213.141.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100001795; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.215.199.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001796; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.218.187.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100001797; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.218.195.216"; content:"Host"; http_header; classtype:trojan-activity; sid:100001798; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.237.128.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001799; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.244.219.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001800; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.246.225.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001801; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.92.36.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001802; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.103.108.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001803; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.135.196.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001804; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.166.212.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001805; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.166.85.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001806; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.207.61.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001807; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.209.250.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100001808; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.211.156.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100001809; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.59.31.181"; content:"Host"; http_header; classtype:trojan-activity; sid:100001810; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.62.110.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100001811; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.62.53.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001812; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.80.138.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001813; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.80.139.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100001814; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.80.154.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100001815; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.80.187.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001816; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.100.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100001817; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.106.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001818; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.108.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100001819; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.131.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100001820; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.134.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001821; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.19.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001822; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.197.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001823; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.215.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001824; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.232.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100001825; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.234.195"; content:"Host"; http_header; classtype:trojan-activity; sid:100001826; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.246.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001827; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.28.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001828; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.4.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001829; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.55.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001830; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.73.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100001831; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.98.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001832; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.165.237.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001833; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.234.147.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001834; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.234.218.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001835; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.242.253.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100001836; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.252.9.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100001837; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.210.219.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001838; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.228.50.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001839; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.228.95.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100001840; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.238.24.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001841; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.247.83.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001842; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.254.39.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001843; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.33.111.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001844; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.40.127.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001845; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.42.20.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100001846; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001847; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.123.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100001848; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.135.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100001849; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.180.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001850; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.208.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100001851; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.224.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100001852; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.241.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100001853; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.214.149.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001854; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.241.39.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001855; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.64.181.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001856; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.74.215.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001857; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.97.130.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001858; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"86.35.43.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001859; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"87.110.105.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100001860; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"87.172.19.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001861; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"87.61.89.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100001862; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"87du.vip"; content:"Host"; http_header; classtype:trojan-activity; sid:100001863; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.119.171.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100001864; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.2.208.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100001865; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.2.219.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100001866; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.218.17.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001867; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.225.222.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100001868; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.247.96.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100001869; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.248.136.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001870; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.248.51.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001871; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.249.244.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001872; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.250.204.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001873; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.250.226.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100001874; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.250.254.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100001875; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.122.183.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001876; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.136.197.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100001877; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.22.152.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001878; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.29.213.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001879; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.40.85.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001880; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"8poieq.bn.files.1drv.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001881; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"90.152.144.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001882; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"90.63.176.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001883; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.124.126.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001884; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.132.197.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100001885; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.138.215.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100001886; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.177.139.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001887; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.187.103.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100001888; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.212.150.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100001889; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.214.124.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100001890; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.217.104.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100001891; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.233.112.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001892; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.234.60.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001893; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.244.169.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001894; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.92.16.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001895; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.114.191.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001896; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.241.78.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001897; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.27.246.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100001898; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.83.62.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001899; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.85.18.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001900; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.157.63.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001901; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.159.169.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100001902; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.21.224.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100001903; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.39.115.176"; content:"Host"; http_header; classtype:trojan-activity; sid:100001904; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.39.79.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001905; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.41.137.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001906; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.41.182.249"; content:"Host"; http_header; classtype:trojan-activity; sid:100001907; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.41.206.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100001908; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.57.43.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100001909; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.73.99.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100001910; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.136.69.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001911; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.143.53.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001912; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.154.17.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100001913; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.200.16.22"; content:"Host"; http_header; classtype:trojan-activity; sid:100001914; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.224.83.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100001915; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.53.120.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001916; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.85.0.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100001917; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.132.129.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100001918; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.133.158.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001919; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.154.20.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001920; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.158.19.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001921; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.170.113.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001922; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.170.113.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001923; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.170.201.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001924; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.60.146.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001925; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.66.196.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001926; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.9.120.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100001927; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"96.239.73.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100001928; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"96.47.147.169"; content:"Host"; http_header; classtype:trojan-activity; sid:100001929; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"97.68.140.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001930; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"97.96.199.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100001931; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.0.210.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001932; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.0.239.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100001933; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.113.239.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100001934; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.116.72.119"; content:"Host"; http_header; classtype:trojan-activity; sid:100001935; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.128.147.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001936; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.178.207.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001937; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.178.242.44"; content:"Host"; http_header; classtype:trojan-activity; sid:100001938; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.30.24.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100001939; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"99.150.245.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001940; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"99.33.195.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001941; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aatreefelling.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100001942; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"abcd.bg"; content:"Host"; http_header; classtype:trojan-activity; sid:100001943; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"abissnet.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100001944; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aboveandbelow.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100001945; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"absoftechworld.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001946; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"abyssos.eu"; content:"Host"; http_header; classtype:trojan-activity; sid:100001947; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"academyshademani.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001948; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"acbick.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001949; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesslinksgroup.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001950; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aceeprc.com.aceeprc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001951; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"acellr.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100001952; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"acteon.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100001953; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"activecost.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100001954; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"addahealingmusic.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001955; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"adithimedia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001956; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"adithimedia.memengers.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001957; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.erapor.smk-alasror.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100001958; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.gentbcn.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001959; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.grandoceanvilla.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001960; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"admission.kmctartskuttippuram.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001961; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"adventureexplorer.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100001962; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeropilates.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100001963; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"afnan-amc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001964; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"afrimedspecialist.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001965; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"agemn.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100001966; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"agenciadigitalwdys.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001967; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"agenda.gmelloinformatica.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100001968; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"agile8studio.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001969; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiecons.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001970; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aimnaukri.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001971; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiqtest.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001972; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajpharmaholding.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001973; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"akdvidyalaya.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001974; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"al-wahd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001975; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alasdemariposas.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001976; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alberts.diamondrelationscrm.us"; content:"Host"; http_header; classtype:trojan-activity; sid:100001977; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alemelektronik.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001978; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alena1971.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100001979; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alexdubai.com.aldiabsteel.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001980; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alka.institute"; content:"Host"; http_header; classtype:trojan-activity; sid:100001981; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"allforcreative.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100001982; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alltheway.travel"; content:"Host"; http_header; classtype:trojan-activity; sid:100001983; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alpaylar.com.tr"; content:"Host"; http_header; classtype:trojan-activity; sid:100001984; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alumni.hildred.ibbott@46.249.33.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100001985; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"am-concepts.ca"; content:"Host"; http_header; classtype:trojan-activity; sid:100001986; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"amamontajes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001987; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"amarresdeamorymaestroshechiceros.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001988; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"amarteargentina.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100001989; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"amos524.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001990; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ams.alvinasschools.org.ng"; content:"Host"; http_header; classtype:trojan-activity; sid:100001991; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anadelgbt.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001992; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anantam.net.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100001993; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"andreelapeyre.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001994; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"andremaraisbeleggings.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100001995; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"andreshconcejal.solucioneslink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001996; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"angelazgheibld.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001997; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"angelsdetour.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001998; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anhung1102.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100001999; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anurontv.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002000; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anysbergbiltong.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002001; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"apartamentoscitta.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002002; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"api-ms.cobainaja.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002003; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.cstdevs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002004; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"apoolcondo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002005; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.adsensearticle.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002006; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.explicitsurveys.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002007; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.prerana.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002008; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"apps.saintsoporte.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002009; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aps-scribe.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002010; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aps-sv.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002011; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"artedibujoyarquitectura.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002012; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"arwenyapi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002013; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ask-regard.call-save.biz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002014; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"atfile.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002015; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"athenacapsg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002016; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"attach.66rpg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002017; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"atteuqpotentialunlimited.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002018; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"augustair.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002019; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"automaticrefreshments.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002020; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"avadhanagames.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002021; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayahuascasp.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002022; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayamallah.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002023; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aycconsultoriaempresarial.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002024; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"azmeasurement.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002025; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"azraktours.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002026; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"b2b.toptanakaryakit.com.tr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002027; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"badeggdesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002028; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"balealgodon.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002029; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bangkok-orchids.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002030; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bangladeshunbound.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002031; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bary.sz4h.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002032; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bash.givemexyz.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002033; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bausch.kr-atlas.monaxikoslykos@zytrox.tk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002034; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbia.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002035; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcmt.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002036; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcrg.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002037; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdnextrend.xyz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002038; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beanx88.xyz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002039; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bearcatpumps.com.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002040; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautincollagen.rs"; content:"Host"; http_header; classtype:trojan-activity; sid:100002041; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautymomentsgt.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002042; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bekape.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002043; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beor360.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002044; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bespokeweddings.ie"; content:"Host"; http_header; classtype:trojan-activity; sid:100002045; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestcarenepal.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002046; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"betone.co.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002047; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"betycopaints.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002048; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beveragesmiami.solucioneslink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002049; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhavaniengineering.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002050; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigmikesupplies.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002051; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bilhen.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002052; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"billing.rahitechnosoft.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002053; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"binoy.stalphonsamissionva.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002054; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"biometrico.gpotecnosystems.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002055; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bioskey.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002056; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"birdi.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002057; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"birminghamlink.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002058; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bizztradingbot.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002059; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bl4n3.zadns.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002060; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.callensaxen.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002061; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.difusodesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002062; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.oyinblogs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002063; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.takbelit.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002064; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmlifestyle.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002065; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"boatpecas.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002066; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodenstein.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002067; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodylanguage.santulan.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002068; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"booksearch.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002069; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bophelocare.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002070; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bounces.mi-fs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002071; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"boutiqueofferte.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002072; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpo.correct.go.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100002073; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bradleyinstitute.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002074; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brandtrust.com.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002075; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"braunfinancial.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002076; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brendanquine.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002077; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brideofmessiah.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002078; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightaffiliatesales.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002079; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightmega.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002080; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightstarshop.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002081; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"browardinsurancemiami.solucioneslink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002082; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt2.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002083; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"btdapi.robotake.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002084; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"buigiaphat.com.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002085; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bulkyfoodja.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002086; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullseyemedia.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002087; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"busandvanrentalmalaysia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002088; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"buscascolegios.diit.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002089; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"business.softberg.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002090; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"business2.softberg.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002091; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bydspa.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002092; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.oooooooooo.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002093; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"c0140529.ferozo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002094; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"caballo.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002095; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cacaoprojects.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002096; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"calgaryautorepairservice.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002097; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"callbury.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002098; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"camminachetipassa.it"; content:"Host"; http_header; classtype:trojan-activity; sid:100002099; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"canadianwork.cc"; content:"Host"; http_header; classtype:trojan-activity; sid:100002100; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"capitalgroup-kw.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002101; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"capoeiraventrelivre.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002102; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"carlsbadre.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002103; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"carsidecor.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002104; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cashyinvestment.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002105; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"catchperch.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002106; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"catchpoolshetlands.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002107; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cazyacustomfurniture.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002108; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbn.hypervoizd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002109; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccauthority.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002110; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdaonline.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002111; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cec.asso.ac-amiens.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002112; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cecra.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002113; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cellas.sk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002114; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cendekiabinaaksara.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002115; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfs5.tistory.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002116; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch.rmu.ac.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100002117; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"changematterscounselling.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002118; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"chardhamdodham.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002119; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"chezalice.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002120; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"childselect.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002121; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"chinhdropfile.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002122; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"chinhdropfile80.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002123; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cible-energy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002124; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cifeer.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002125; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"citiconstructioncorp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002126; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"citihits.lk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002127; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"citssolutions.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002128; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"citycapproperty.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002129; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cityglobalgospel.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002130; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"civi.istmejia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002131; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cleanbydesignllc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002132; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud.fc.co.mz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002133; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cm-arquitetos.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002134; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnc.tacobelllover.tk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002135; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"codsambal.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002136; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"colinde.pricesne.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002137; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"colorpak.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002138; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"columbia.aula-web.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002139; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"community.reimclub.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002140; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"comosairdoburaco.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002141; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"competancy.indigoconsult.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002142; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"conceptimagine.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002143; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"config.cqhbkjzx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002144; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectcapital.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002145; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"constructoralyon.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002146; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"consulateins.solucioneslink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002147; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"contributeindustry.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002148; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"copelandscapes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002149; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"coulsongraphics.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002150; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"count.mail.163.com.impactmedfoundation.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002151; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"covid19.cyberschool.or.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002152; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpanel.shivay.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002153; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cr-sq.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002154; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"craftech.nxtnet.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002155; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"creationskateboards.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002156; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crecerco.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002157; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crittersbythebay.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002158; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm.notariavieitoyvelamazan.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002159; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crmfarko.manivelasst.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002160; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crmroche.manivelasst.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002161; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crscorretordeimoveis.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002162; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cse-engineer.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002163; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002164; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cubescargoexpress.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002165; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"curasoles.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002166; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"currantmedia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002167; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwa.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002168; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyclomove.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002169; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cynkon.kairoscs.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002170; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"czsl.91756.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002171; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.powerofwish.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002172; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"d9.99ddd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002173; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"da.alibuf.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002174; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"danaevara.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002175; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dartoonpictures.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002176; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"data.cdevelop.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002177; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"data.over-blog-kiwi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002178; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"datapolish.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002179; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dating.khokhas.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002180; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"datsom.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002181; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"davethompson.me.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002182; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"davidmcguinness.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002183; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dayspringdaisies.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002184; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd.qiyuea.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002185; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddns.cyberium.cc"; content:"Host"; http_header; classtype:trojan-activity; sid:100002186; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"de.gsearch.com.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002187; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"decifrar.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002188; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"deigratia2.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002189; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dekovizyon.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002190; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo-cliente.mindcreative.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002191; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.glassforcars.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002192; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo6.hiites.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002193; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dent-estet.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002194; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dental.xiaoxiao.media"; content:"Host"; http_header; classtype:trojan-activity; sid:100002195; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dentalalliance.se"; content:"Host"; http_header; classtype:trojan-activity; sid:100002196; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"desertlandtrd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002197; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"designerliving.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002198; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"despertaresi.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002199; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"destinymc.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002200; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"detorre.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100002201; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.sebpo.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002202; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.watch-store.eu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002203; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dezcom.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002204; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfcf.91756.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002205; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"diamantenegro.mi-fs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002206; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dienmayminhhung.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002207; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"digilib.dianhusada.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002208; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"digisails.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002209; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"disinfection-cleaning.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002210; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"djking.f3322.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002211; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.1003b.56a.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002212; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.198424.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002213; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.installcdn-aws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002214; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.packetstormsecurity.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002215; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.rina-roleplay.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002216; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnn.alibuf.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002217; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns.alibuf.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002218; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dockerupdate.anondns.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002219; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"docman.orientalservices.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002220; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dodsonimaging.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002221; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"doitunlimited.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002222; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dokan.blueberrytec.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002223; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dom-chel74.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002224; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dom.daf.free.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002225; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"doncedyhall.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002226; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"donghobinhminh.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002227; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dongphuctop.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002228; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"donwnloasecury.ath.cx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002229; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dosame.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002230; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dosman.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002231; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dovberger.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002232; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"down.pcclear.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002233; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"down.webbora.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002234; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"down1.arpun.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002235; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.caihong.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002236; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.doumaibiji.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002237; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.exrnybuf.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002238; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.kaobeitu.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002239; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.pdf00.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002240; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.rising.com.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002241; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.skycn.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002242; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.zjsyawqj.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002243; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragonsknot.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002244; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"drbaby.com.sa"; content:"Host"; http_header; classtype:trojan-activity; sid:100002245; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dream.pics"; content:"Host"; http_header; classtype:trojan-activity; sid:100002246; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"drgroup.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002247; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"drools-moved.46999.n3.nabble.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002248; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"drsha.innovativesolutions.mobi"; content:"Host"; http_header; classtype:trojan-activity; sid:100002249; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsenterprize.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002250; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsspainting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002251; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"du-wizards.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002252; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"duque.guantanameratravel.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002253; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dutapp.wisolve.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002254; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"duvalcharter.dekitout.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002255; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dw2.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002256; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dx.qqyewu.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002257; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzinestudio87.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002258; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-commerce.saleensuporte.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002259; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"e.sldov.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002260; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"eandgdesign.com.ng"; content:"Host"; http_header; classtype:trojan-activity; sid:100002261; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"eastsheen-glaziers.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002262; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebruyatkin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002263; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"eedo.ee"; content:"Host"; http_header; classtype:trojan-activity; sid:100002264; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"efficientegroup.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002265; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"elbauldenora.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002266; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"emaids.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002267; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"emaz.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002268; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.baoend.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002269; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"enc-tech.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002270; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"endurotanzania.co.tz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002271; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ennovate.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002272; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"equimination.ee"; content:"Host"; http_header; classtype:trojan-activity; sid:100002273; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"erp.nanotechproautocare.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002274; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"erp.zilymax.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002275; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"escola.probommar.org.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002276; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"esnconsultants.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002277; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"esrhf04.top"; content:"Host"; http_header; classtype:trojan-activity; sid:100002278; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"essentia.org.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002279; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereality.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002280; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"eubanks7.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002281; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"europeanzonexxi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002282; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"exilum.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002283; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoalfaomega.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002284; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrovertoffers.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002285; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"f1sol.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002286; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"familydentist.site"; content:"Host"; http_header; classtype:trojan-activity; sid:100002287; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"faveraprojects.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002288; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fc.co.mz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002289; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"felicienne.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002290; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"files.martellexpress.us"; content:"Host"; http_header; classtype:trojan-activity; sid:100002291; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"files6.uludagbilisim.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002292; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"final.makkahkmcc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002293; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fineartgallerym.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002294; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisconline.bar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002295; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisconline.casa"; content:"Host"; http_header; classtype:trojan-activity; sid:100002296; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fix-america-now.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002297; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixauto.illumetechnology.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002298; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixturegovernment.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002299; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkd.derpcity.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002300; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"flexypay.dsquaregroup.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002301; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"flintspin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002302; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyingbuddhadesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002303; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmjplastering.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002304; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"follower.instantcashback.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002305; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"foothills.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002306; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"footweardirect.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002307; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"forum.mdb.nu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002308; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fotoobjetivo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002309; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"foundationrepairhoustontx.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002310; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"foxeps.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002311; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"freecnetdownload.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002312; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"freisites.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002313; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftp.n3twork30cm.ml"; content:"Host"; http_header; classtype:trojan-activity; sid:100002314; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fullelectronica.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002315; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"funletters.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002316; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fusionfiresolutions.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002317; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"futbolpr.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002318; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"futuregraphics.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002319; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"g.pinmonkey.xyz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002320; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaditastour.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002321; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gametwogame.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002322; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"garciadogshow.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002323; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"garenanow.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002324; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"garenanow4.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002325; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gastoudergonny.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002326; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbbulls.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002327; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcpc.co.id.chronoscurtain.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002328; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"generaldeviales.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002329; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfmodd1.webselffiles01.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002330; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfold1.webselffiles01.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002331; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghettohub.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002332; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghislain.dartois.pagesperso-orange.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002333; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"giadungg7.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002334; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"giddos.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002335; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"giteletropical.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002336; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"glowinmedia.co.ke"; content:"Host"; http_header; classtype:trojan-activity; sid:100002337; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmtransformationacademy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002338; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmvadmission.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002339; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnimelf.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002340; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnscrew.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002341; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gold.investforex.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002342; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldcake.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002343; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldcoastoffice365.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002344; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldcoastoffice365.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002345; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"golden-memories-funerals.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002346; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldenasiacapital.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002347; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpotecnosystems.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002348; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gracejukes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002349; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoinmare.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002350; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gs.monerorx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002351; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"guide-to-cell-phones.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002352; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gulfac-house.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002353; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvpcdpgc.edu.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002354; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"habbotips.free.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002355; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hagebakken.no"; content:"Host"; http_header; classtype:trojan-activity; sid:100002356; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hamptonpartyoffive.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002357; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hashmati.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002358; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hassanproduct.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002359; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hchfug.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002360; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hd11315.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002361; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdkamera2003.hu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002362; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hds.sz4h.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002363; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"heavymaq.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002364; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellogorgeous.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002365; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"help.hizuko.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002366; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"herchinfitout.com.sg"; content:"Host"; http_header; classtype:trojan-activity; sid:100002367; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhaward.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002368; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"highlandroadcoc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002369; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"highlandslasvegas.atakdev.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002370; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hindi.factsriver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002371; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiptool.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002372; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitpe.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002373; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitstation.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002374; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmpmall.co.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002375; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoagietesting10.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002376; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoayeuthuong-my.sharepoint.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002377; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"homefindersolutions.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002378; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hongluosi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002379; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hookedupboatclub.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002380; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostingparacolombia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002381; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostzaa.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002382; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"houstonshutters.site"; content:"Host"; http_header; classtype:trojan-activity; sid:100002383; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hr2019.vrcom7.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002384; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hseda.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002385; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsmwebapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002386; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"htownbars.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002387; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hubtech.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002388; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"huellacero.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002389; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hunggiang.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002390; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"husamiyahschool.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002391; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iabmixx2020.rayadigital.online"; content:"Host"; http_header; classtype:trojan-activity; sid:100002392; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iam313.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002393; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"icon.shatangmu.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002394; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"idea-secure-login.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002395; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"idilsoft.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002396; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"idj.no"; content:"Host"; http_header; classtype:trojan-activity; sid:100002397; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"idvindia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002398; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieclb.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002399; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikexpert.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002400; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilrafrica.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002401; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"images.jermiau.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002402; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"imbueautoworx.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002403; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"in-tune2016.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002404; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"incrediblepixels.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002405; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"incredicole.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002406; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"indrasbikaner.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002407; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"infair.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002408; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"infovator.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002409; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"initialnetworks.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002410; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"inodesthetotaldesigners.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002411; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"inrajahmundry.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002412; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"instantindialoan.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002413; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"intellectsmart.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002414; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"intersel-idf.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002415; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"intuitiveideas.com.my"; content:"Host"; http_header; classtype:trojan-activity; sid:100002416; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"inversiones.arrayanfinanciero.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002417; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"invest.xpcorporative.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002418; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipmes.ma"; content:"Host"; http_header; classtype:trojan-activity; sid:100002419; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iremart.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100002420; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iris101.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002421; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"isaac.mikhailmotoringschool.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002422; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iscamenabe.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002423; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"isiphephelocon.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002424; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ismf.com.ng"; content:"Host"; http_header; classtype:trojan-activity; sid:100002425; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iso-dubai.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002426; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"israrulhaq.me"; content:"Host"; http_header; classtype:trojan-activity; sid:100002427; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"isrorg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002428; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"isso.ps"; content:"Host"; http_header; classtype:trojan-activity; sid:100002429; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ist-security.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002430; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"it123.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002431; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"italiandirezione.casa"; content:"Host"; http_header; classtype:trojan-activity; sid:100002432; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"itc-demo.softgig.co.ke"; content:"Host"; http_header; classtype:trojan-activity; sid:100002433; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"itmotasaciones.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002434; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jamiekaylive.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002435; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jansen-heesch.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002436; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jathra.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002437; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jay.diamondrelationscrm.us"; content:"Host"; http_header; classtype:trojan-activity; sid:100002438; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jebs.net.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002439; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jeffdahlke.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002440; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhayesconsulting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002441; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiaoyuzixun.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002442; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jing-da.com.tw"; content:"Host"; http_header; classtype:trojan-activity; sid:100002443; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmtc.91756.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002444; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnanbharati.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002445; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jobs.thebeessolution.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002446; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"joelbonissilver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002447; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"join.cl8movement.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002448; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"josegene.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002449; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpwoodfordco.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002450; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jumpmanualjacobhiller.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002451; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jupiter.toxsl.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002452; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"justinscott.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002453; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kadigital.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002454; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaizenjanitorial.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002455; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kalawatihomes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002456; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kalogirosfinance.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002457; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaptaanchapal.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002458; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"karer.by"; content:"Host"; http_header; classtype:trojan-activity; sid:100002459; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"katanvetov.co.il"; content:"Host"; http_header; classtype:trojan-activity; sid:100002460; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"katelynn9506a.ru.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002461; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kensingtondriving.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002462; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ketofitnessexpert.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002463; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kevinjewelry.com.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002464; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"keywatch.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002465; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"khmerosja.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002466; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kingssa.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002467; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kizitox.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002468; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjcpromo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002469; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kldatabase.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002470; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kleinendeli.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002471; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"korrectconceptservices.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002472; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"krisbadminton.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002473; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktb.sch.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002474; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubatoglubaklava.com.tr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002475; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kullumanalitours.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002476; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwanfromhongkong.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002477; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kz.sldov.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002478; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacasadelosalebrijes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002479; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ladylabonde.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002480; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lameguard.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002481; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"laodongnhat.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002482; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"laravel.pointersoftwares.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002483; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasermobilesounds.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002484; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"laura9630fr.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002485; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lauratomismith.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002486; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lautarosanmiguel.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002487; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lawforall.edu.lk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002488; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lawschoolideas.xyz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002489; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lceventos.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002490; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ld.mediaget.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002491; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldgcorp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002492; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"learning.real-academy.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002493; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"leasiacherise.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002494; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"leczkregoslup.acelero.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002495; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"legend.nu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002496; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"leluibuffet.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002497; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lestesteux.ca"; content:"Host"; http_header; classtype:trojan-activity; sid:100002498; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"library.arihantmbainstitute.ac.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002499; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"library.uib.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002500; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lidoraggiodisole.it"; content:"Host"; http_header; classtype:trojan-activity; sid:100002501; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifebeam.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002502; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lindnerelektroanlagen.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002503; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"linkintec.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002504; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"liquidaz.casa"; content:"Host"; http_header; classtype:trojan-activity; sid:100002505; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"livetrack.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002506; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lloydsindian.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002507; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lm.stagingarea.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002508; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmaancha.co.il"; content:"Host"; http_header; classtype:trojan-activity; sid:100002509; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lms.cstdevs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002510; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lms.login2.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002511; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"location-voitures.ma"; content:"Host"; http_header; classtype:trojan-activity; sid:100002512; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.trezor.com.stockfootagesindia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002513; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"logotypfabriken.se"; content:"Host"; http_header; classtype:trojan-activity; sid:100002514; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotix.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002515; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotusanddragonfly.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002516; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lp.definerisco.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002517; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lp.difusodesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002518; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltc.typoten.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002519; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckybrownie.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002520; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"luminouspneuma.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002521; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"luxomodels.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002522; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"m-technics.kz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002523; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.estudiomoros.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002524; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.softsharks.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002525; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"madicon.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002526; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"magianegramagiablancayamarres.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002527; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.bs-eiendomme.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002528; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.golimoapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002529; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.jeffsono.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002530; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"maksi.feb.unib.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002531; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"malaya.tv"; content:"Host"; http_header; classtype:trojan-activity; sid:100002532; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"malwarecoding.github.io"; content:"Host"; http_header; classtype:trojan-activity; sid:100002533; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"managed.oss-cn-beijing.aliyuncs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002534; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"managemysalon.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002535; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"manantialesdelnorte.uy"; content:"Host"; http_header; classtype:trojan-activity; sid:100002536; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"manhtien.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002537; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mario-sunjic.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002538; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mariobrown.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002539; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mariotessarollo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002540; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketinfosales.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002541; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketing.enexusgroup.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002542; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"marksidfgs.ug"; content:"Host"; http_header; classtype:trojan-activity; sid:100002543; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"masjidhabeebiyarazviya.mysunni.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002544; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mastersofclientretention.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002545; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"materialescantu.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002546; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"matruchhaya.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002547; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxiquim.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002548; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxtox.com.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002549; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbgrm.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002550; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbjtimes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002551; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbsolutions.ge"; content:"Host"; http_header; classtype:trojan-activity; sid:100002552; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbx.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002553; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdasa.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002554; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"medevlb.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002555; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"media-server.skyinternet.com.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002556; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"medianews.ge"; content:"Host"; http_header; classtype:trojan-activity; sid:100002557; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mediawaysnews.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002558; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"medistaffconsulting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002559; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeweb.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002560; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"megagynreformas.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002561; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"megamart.afnan-amc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002562; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mehainteriors.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002563; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercabits.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002564; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"merkathink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002565; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mertlog.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002566; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"metalin-cr.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002567; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mettaanand.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002568; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"meuoculosnanet.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002569; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfevr.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002570; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhkdhotbot.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002571; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhkdhotbot80.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002572; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"micalle.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002573; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"michaelphilip.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002574; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"michimal2.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002575; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"microblading.mirliandias.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002576; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"microcomm-group.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002577; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mikhailmotoringschool.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002578; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mills-skyla30ec.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002579; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mingguanwms.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002580; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"minuevavida.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002581; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mirror.mypage.sk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002582; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mis.nbcc.ac.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100002583; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"misterson.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002584; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkontakt.az"; content:"Host"; http_header; classtype:trojan-activity; sid:100002585; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mktf.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002586; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmdx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002587; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmogollon.com.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002588; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mncarteam.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002589; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"modelhouseturkey.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002590; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"modernmanna.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002591; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"monetization.business"; content:"Host"; http_header; classtype:trojan-activity; sid:100002592; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"moninediy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002593; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mopai.sg"; content:"Host"; http_header; classtype:trojan-activity; sid:100002594; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.31.126.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001673; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.38.149.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001674; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.38.222.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001675; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.43.207.148"; content:"Host"; http_header; classtype:trojan-activity; sid:100001676; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"62.90.165.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001677; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"63.245.122.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100001678; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"64.233.154.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001679; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.0.168.152"; content:"Host"; http_header; classtype:trojan-activity; sid:100001680; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.125.128.196"; content:"Host"; http_header; classtype:trojan-activity; sid:100001681; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.21.58.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100001682; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.26.155.131"; content:"Host"; http_header; classtype:trojan-activity; sid:100001683; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"65.35.61.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001684; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.108.199.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001685; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.229.214.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001686; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.57.55.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100001687; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.74.7.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100001688; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.97.181.196"; content:"Host"; http_header; classtype:trojan-activity; sid:100001689; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.245.151.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001690; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.8.138.101"; content:"Host"; http_header; classtype:trojan-activity; sid:100001691; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.83.49.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100001692; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.84.138.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001693; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.148.103.248"; content:"Host"; http_header; classtype:trojan-activity; sid:100001694; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.174.182.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100001695; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.175.107.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001696; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.188.144.143"; content:"Host"; http_header; classtype:trojan-activity; sid:100001697; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.204.88.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001698; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.205.106.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001699; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.205.119.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100001700; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.78.33.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001701; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.115.37.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001702; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.120.237.255"; content:"Host"; http_header; classtype:trojan-activity; sid:100001703; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.123.245.151"; content:"Host"; http_header; classtype:trojan-activity; sid:100001704; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.124.231.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100001705; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.127.214.47"; content:"Host"; http_header; classtype:trojan-activity; sid:100001706; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.146.232.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001707; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.165.173.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100001708; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.196.158.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001709; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.222.157.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001710; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.229.0.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001711; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.63.73.234"; content:"Host"; http_header; classtype:trojan-activity; sid:100001712; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.75.115.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001713; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.75.227.186"; content:"Host"; http_header; classtype:trojan-activity; sid:100001714; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"69.76.240.206"; content:"Host"; http_header; classtype:trojan-activity; sid:100001715; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.115.31.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100001716; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.118.240.88"; content:"Host"; http_header; classtype:trojan-activity; sid:100001717; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.167.10.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001718; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.236.190.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100001719; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.25.5.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100001720; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"70.93.129.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001721; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.127.148.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100001722; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.146.190.91"; content:"Host"; http_header; classtype:trojan-activity; sid:100001723; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.204.63.239"; content:"Host"; http_header; classtype:trojan-activity; sid:100001724; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.29.48.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001725; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.34.191.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001726; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.40.234.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001727; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.43.106.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100001728; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.43.2.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001729; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.43.235.106"; content:"Host"; http_header; classtype:trojan-activity; sid:100001730; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.47.133.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001731; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.71.60.69"; content:"Host"; http_header; classtype:trojan-activity; sid:100001732; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"71.85.106.211"; content:"Host"; http_header; classtype:trojan-activity; sid:100001733; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.17.22.30"; content:"Host"; http_header; classtype:trojan-activity; sid:100001734; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.189.180.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100001735; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.189.200.62"; content:"Host"; http_header; classtype:trojan-activity; sid:100001736; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.202.249.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001737; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.214.69.226"; content:"Host"; http_header; classtype:trojan-activity; sid:100001738; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.229.230.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001739; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"72.31.40.122"; content:"Host"; http_header; classtype:trojan-activity; sid:100001740; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"73.112.123.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001741; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"73.204.216.103"; content:"Host"; http_header; classtype:trojan-activity; sid:100001742; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"73.70.164.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001743; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.101.1.159"; content:"Host"; http_header; classtype:trojan-activity; sid:100001744; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.108.224.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001745; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.194.117.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100001746; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.195.115.176"; content:"Host"; http_header; classtype:trojan-activity; sid:100001747; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.199.84.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001748; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.64.139.223"; content:"Host"; http_header; classtype:trojan-activity; sid:100001749; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"74.75.165.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100001750; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"75.127.141.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001751; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"75.83.102.27"; content:"Host"; http_header; classtype:trojan-activity; sid:100001752; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"75.99.213.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100001753; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.170.11.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001754; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.178.22.145"; content:"Host"; http_header; classtype:trojan-activity; sid:100001755; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.217.92.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001756; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.250.199.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001757; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.254.129.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001758; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.84.134.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001759; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"76.95.12.137"; content:"Host"; http_header; classtype:trojan-activity; sid:100001760; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.111.182.31"; content:"Host"; http_header; classtype:trojan-activity; sid:100001761; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.237.25.210"; content:"Host"; http_header; classtype:trojan-activity; sid:100001762; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.71.50.153"; content:"Host"; http_header; classtype:trojan-activity; sid:100001763; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.71.52.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001764; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77.89.203.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100001765; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"77st.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100001766; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.145.224.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100001767; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.187.141.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001768; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.187.240.125"; content:"Host"; http_header; classtype:trojan-activity; sid:100001769; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.187.41.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001770; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.188.106.235"; content:"Host"; http_header; classtype:trojan-activity; sid:100001771; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.188.168.64"; content:"Host"; http_header; classtype:trojan-activity; sid:100001772; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.188.188.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100001773; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.189.104.157"; content:"Host"; http_header; classtype:trojan-activity; sid:100001774; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.189.176.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001775; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.23.172.81"; content:"Host"; http_header; classtype:trojan-activity; sid:100001776; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.8.225.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001777; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.11.195.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100001778; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.130.253.13"; content:"Host"; http_header; classtype:trojan-activity; sid:100001779; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.147.123.48"; content:"Host"; http_header; classtype:trojan-activity; sid:100001780; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.167.189.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001781; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.175.42.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001782; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.21.84.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001783; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.7.170.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001784; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.79.58.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001785; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.8.70.162"; content:"Host"; http_header; classtype:trojan-activity; sid:100001786; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"79.9.88.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100001787; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.107.89.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100001788; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.19.101.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001789; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.211.181.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001790; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.217.12.7"; content:"Host"; http_header; classtype:trojan-activity; sid:100001791; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"80.99.128.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100001792; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.136.146.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001793; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.165.44.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001794; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.191.40.58"; content:"Host"; http_header; classtype:trojan-activity; sid:100001795; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.213.141.184"; content:"Host"; http_header; classtype:trojan-activity; sid:100001796; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.215.199.29"; content:"Host"; http_header; classtype:trojan-activity; sid:100001797; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.218.187.113"; content:"Host"; http_header; classtype:trojan-activity; sid:100001798; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.218.195.216"; content:"Host"; http_header; classtype:trojan-activity; sid:100001799; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.237.128.200"; content:"Host"; http_header; classtype:trojan-activity; sid:100001800; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.244.219.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001801; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.246.225.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001802; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"81.92.36.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001803; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.103.108.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001804; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.135.196.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001805; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.166.212.178"; content:"Host"; http_header; classtype:trojan-activity; sid:100001806; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.166.85.112"; content:"Host"; http_header; classtype:trojan-activity; sid:100001807; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.207.61.194"; content:"Host"; http_header; classtype:trojan-activity; sid:100001808; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.209.250.155"; content:"Host"; http_header; classtype:trojan-activity; sid:100001809; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.211.156.38"; content:"Host"; http_header; classtype:trojan-activity; sid:100001810; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.59.31.181"; content:"Host"; http_header; classtype:trojan-activity; sid:100001811; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.62.110.252"; content:"Host"; http_header; classtype:trojan-activity; sid:100001812; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.62.53.77"; content:"Host"; http_header; classtype:trojan-activity; sid:100001813; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.80.138.72"; content:"Host"; http_header; classtype:trojan-activity; sid:100001814; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.80.139.92"; content:"Host"; http_header; classtype:trojan-activity; sid:100001815; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.80.154.214"; content:"Host"; http_header; classtype:trojan-activity; sid:100001816; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.80.187.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001817; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.100.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100001818; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.106.65"; content:"Host"; http_header; classtype:trojan-activity; sid:100001819; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.108.172"; content:"Host"; http_header; classtype:trojan-activity; sid:100001820; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.131.158"; content:"Host"; http_header; classtype:trojan-activity; sid:100001821; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.134.66"; content:"Host"; http_header; classtype:trojan-activity; sid:100001822; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.19.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001823; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.197.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001824; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.215.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001825; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.232.68"; content:"Host"; http_header; classtype:trojan-activity; sid:100001826; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.234.195"; content:"Host"; http_header; classtype:trojan-activity; sid:100001827; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.246.96"; content:"Host"; http_header; classtype:trojan-activity; sid:100001828; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.28.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001829; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.4.57"; content:"Host"; http_header; classtype:trojan-activity; sid:100001830; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.55.84"; content:"Host"; http_header; classtype:trojan-activity; sid:100001831; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.73.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100001832; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.81.98.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100001833; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.165.237.163"; content:"Host"; http_header; classtype:trojan-activity; sid:100001834; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.234.147.99"; content:"Host"; http_header; classtype:trojan-activity; sid:100001835; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.234.218.42"; content:"Host"; http_header; classtype:trojan-activity; sid:100001836; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.242.253.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100001837; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.252.9.37"; content:"Host"; http_header; classtype:trojan-activity; sid:100001838; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.210.219.213"; content:"Host"; http_header; classtype:trojan-activity; sid:100001839; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.228.50.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100001840; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.228.95.204"; content:"Host"; http_header; classtype:trojan-activity; sid:100001841; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.238.24.35"; content:"Host"; http_header; classtype:trojan-activity; sid:100001842; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.247.83.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100001843; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.254.39.129"; content:"Host"; http_header; classtype:trojan-activity; sid:100001844; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.33.111.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001845; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.40.127.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100001846; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"84.42.20.217"; content:"Host"; http_header; classtype:trojan-activity; sid:100001847; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001848; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.11.216"; content:"Host"; http_header; classtype:trojan-activity; sid:100001849; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.123.251"; content:"Host"; http_header; classtype:trojan-activity; sid:100001850; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.135.187"; content:"Host"; http_header; classtype:trojan-activity; sid:100001851; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.180.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001852; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.208.25"; content:"Host"; http_header; classtype:trojan-activity; sid:100001853; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.224.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100001854; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.105.241.2"; content:"Host"; http_header; classtype:trojan-activity; sid:100001855; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.214.149.236"; content:"Host"; http_header; classtype:trojan-activity; sid:100001856; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.241.39.182"; content:"Host"; http_header; classtype:trojan-activity; sid:100001857; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.64.181.50"; content:"Host"; http_header; classtype:trojan-activity; sid:100001858; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.74.215.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001859; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"85.97.130.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001860; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"86.35.43.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100001861; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"87.117.11.46"; content:"Host"; http_header; classtype:trojan-activity; sid:100001862; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"87.172.19.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001863; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"87.61.89.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100001864; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.119.171.253"; content:"Host"; http_header; classtype:trojan-activity; sid:100001865; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.2.208.71"; content:"Host"; http_header; classtype:trojan-activity; sid:100001866; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.2.219.179"; content:"Host"; http_header; classtype:trojan-activity; sid:100001867; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.218.17.110"; content:"Host"; http_header; classtype:trojan-activity; sid:100001868; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.218.17.149"; content:"Host"; http_header; classtype:trojan-activity; sid:100001869; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.225.222.128"; content:"Host"; http_header; classtype:trojan-activity; sid:100001870; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.247.96.19"; content:"Host"; http_header; classtype:trojan-activity; sid:100001871; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.248.136.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001872; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.248.51.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001873; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.249.244.180"; content:"Host"; http_header; classtype:trojan-activity; sid:100001874; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.250.204.12"; content:"Host"; http_header; classtype:trojan-activity; sid:100001875; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.250.226.26"; content:"Host"; http_header; classtype:trojan-activity; sid:100001876; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.250.240.245"; content:"Host"; http_header; classtype:trojan-activity; sid:100001877; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"88.250.254.90"; content:"Host"; http_header; classtype:trojan-activity; sid:100001878; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.122.183.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001879; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.136.197.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100001880; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.22.152.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001881; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.248.112.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100001882; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.29.213.33"; content:"Host"; http_header; classtype:trojan-activity; sid:100001883; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"89.40.85.166"; content:"Host"; http_header; classtype:trojan-activity; sid:100001884; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"8poieq.bn.files.1drv.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001885; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"90.152.144.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001886; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"90.63.176.144"; content:"Host"; http_header; classtype:trojan-activity; sid:100001887; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.124.126.133"; content:"Host"; http_header; classtype:trojan-activity; sid:100001888; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.132.197.39"; content:"Host"; http_header; classtype:trojan-activity; sid:100001889; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.138.215.5"; content:"Host"; http_header; classtype:trojan-activity; sid:100001890; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.177.139.132"; content:"Host"; http_header; classtype:trojan-activity; sid:100001891; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.187.103.32"; content:"Host"; http_header; classtype:trojan-activity; sid:100001892; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.212.150.241"; content:"Host"; http_header; classtype:trojan-activity; sid:100001893; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.214.124.141"; content:"Host"; http_header; classtype:trojan-activity; sid:100001894; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.217.104.185"; content:"Host"; http_header; classtype:trojan-activity; sid:100001895; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.233.112.188"; content:"Host"; http_header; classtype:trojan-activity; sid:100001896; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.234.60.94"; content:"Host"; http_header; classtype:trojan-activity; sid:100001897; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.244.169.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001898; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.92.16.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001899; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.114.191.82"; content:"Host"; http_header; classtype:trojan-activity; sid:100001900; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.241.78.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100001901; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.27.246.202"; content:"Host"; http_header; classtype:trojan-activity; sid:100001902; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.83.62.139"; content:"Host"; http_header; classtype:trojan-activity; sid:100001903; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.85.18.138"; content:"Host"; http_header; classtype:trojan-activity; sid:100001904; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.157.63.244"; content:"Host"; http_header; classtype:trojan-activity; sid:100001905; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.159.169.190"; content:"Host"; http_header; classtype:trojan-activity; sid:100001906; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.21.224.154"; content:"Host"; http_header; classtype:trojan-activity; sid:100001907; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.39.115.176"; content:"Host"; http_header; classtype:trojan-activity; sid:100001908; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.39.79.41"; content:"Host"; http_header; classtype:trojan-activity; sid:100001909; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.41.137.16"; content:"Host"; http_header; classtype:trojan-activity; sid:100001910; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.41.182.249"; content:"Host"; http_header; classtype:trojan-activity; sid:100001911; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.41.206.56"; content:"Host"; http_header; classtype:trojan-activity; sid:100001912; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.57.43.233"; content:"Host"; http_header; classtype:trojan-activity; sid:100001913; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"93.73.99.102"; content:"Host"; http_header; classtype:trojan-activity; sid:100001914; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.136.69.199"; content:"Host"; http_header; classtype:trojan-activity; sid:100001915; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.143.53.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001916; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.154.17.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100001917; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.200.16.22"; content:"Host"; http_header; classtype:trojan-activity; sid:100001918; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.224.83.208"; content:"Host"; http_header; classtype:trojan-activity; sid:100001919; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.53.120.109"; content:"Host"; http_header; classtype:trojan-activity; sid:100001920; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"94.85.0.3"; content:"Host"; http_header; classtype:trojan-activity; sid:100001921; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.132.129.250"; content:"Host"; http_header; classtype:trojan-activity; sid:100001922; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.133.158.20"; content:"Host"; http_header; classtype:trojan-activity; sid:100001923; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.154.20.231"; content:"Host"; http_header; classtype:trojan-activity; sid:100001924; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.158.19.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100001925; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.170.113.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100001926; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.170.113.52"; content:"Host"; http_header; classtype:trojan-activity; sid:100001927; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.170.201.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100001928; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.60.146.134"; content:"Host"; http_header; classtype:trojan-activity; sid:100001929; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.66.196.63"; content:"Host"; http_header; classtype:trojan-activity; sid:100001930; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"95.9.120.40"; content:"Host"; http_header; classtype:trojan-activity; sid:100001931; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"96.239.73.246"; content:"Host"; http_header; classtype:trojan-activity; sid:100001932; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"96.47.147.169"; content:"Host"; http_header; classtype:trojan-activity; sid:100001933; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"97.68.140.254"; content:"Host"; http_header; classtype:trojan-activity; sid:100001934; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"97.96.199.75"; content:"Host"; http_header; classtype:trojan-activity; sid:100001935; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.0.210.218"; content:"Host"; http_header; classtype:trojan-activity; sid:100001936; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.0.239.142"; content:"Host"; http_header; classtype:trojan-activity; sid:100001937; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.113.239.207"; content:"Host"; http_header; classtype:trojan-activity; sid:100001938; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.116.72.119"; content:"Host"; http_header; classtype:trojan-activity; sid:100001939; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.128.147.115"; content:"Host"; http_header; classtype:trojan-activity; sid:100001940; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.178.207.205"; content:"Host"; http_header; classtype:trojan-activity; sid:100001941; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.178.242.44"; content:"Host"; http_header; classtype:trojan-activity; sid:100001942; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"98.30.24.54"; content:"Host"; http_header; classtype:trojan-activity; sid:100001943; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"99.150.245.203"; content:"Host"; http_header; classtype:trojan-activity; sid:100001944; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"99.33.195.164"; content:"Host"; http_header; classtype:trojan-activity; sid:100001945; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aatreefelling.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100001946; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"abcd.bg"; content:"Host"; http_header; classtype:trojan-activity; sid:100001947; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"abissnet.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100001948; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aboveandbelow.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100001949; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"absoftechworld.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001950; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"abyssos.eu"; content:"Host"; http_header; classtype:trojan-activity; sid:100001951; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"academyshademani.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001952; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"acbick.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001953; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesslinksgroup.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001954; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aceeprc.com.aceeprc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001955; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"acellr.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100001956; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"acteon.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100001957; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"addahealingmusic.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001958; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"adithimedia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001959; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"adithimedia.memengers.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001960; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.erapor.smk-alasror.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100001961; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.gentbcn.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001962; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.grandoceanvilla.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001963; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"admission.kmctartskuttippuram.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001964; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"adventureexplorer.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100001965; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeropilates.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100001966; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"afnan-amc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001967; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"afrimedspecialist.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001968; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"agemn.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100001969; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"agenciadigitalwdys.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001970; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"agenda.gmelloinformatica.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100001971; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"agile8studio.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001972; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiecons.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001973; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aimnaukri.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001974; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiqtest.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001975; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajpharmaholding.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001976; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"akdvidyalaya.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001977; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"al-wahd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001978; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alasdemariposas.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001979; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alberts.diamondrelationscrm.us"; content:"Host"; http_header; classtype:trojan-activity; sid:100001980; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alemelektronik.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001981; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alena1971.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100001982; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alexdubai.com.aldiabsteel.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001983; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alka.institute"; content:"Host"; http_header; classtype:trojan-activity; sid:100001984; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"allforcreative.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100001985; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alltheway.travel"; content:"Host"; http_header; classtype:trojan-activity; sid:100001986; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alpaylar.com.tr"; content:"Host"; http_header; classtype:trojan-activity; sid:100001987; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"alumni.hildred.ibbott@46.249.33.79"; content:"Host"; http_header; classtype:trojan-activity; sid:100001988; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"am-concepts.ca"; content:"Host"; http_header; classtype:trojan-activity; sid:100001989; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"amamontajes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001990; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"amarresdeamorymaestroshechiceros.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001991; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"amarteargentina.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100001992; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"amos524.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001993; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ams.alvinasschools.org.ng"; content:"Host"; http_header; classtype:trojan-activity; sid:100001994; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anadelgbt.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100001995; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anantam.net.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100001996; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"andreelapeyre.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001997; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"andremaraisbeleggings.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100001998; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"andreshconcejal.solucioneslink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100001999; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"angelazgheibld.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002000; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"angelsdetour.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002001; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anhung1102.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002002; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anurontv.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002003; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"anysbergbiltong.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002004; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"apartamentoscitta.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002005; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"api-ms.cobainaja.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002006; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.cstdevs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002007; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"apoolcondo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002008; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.adsensearticle.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002009; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.explicitsurveys.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002010; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.prerana.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002011; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"apps.saintsoporte.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002012; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aps-scribe.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002013; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aps-sv.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002014; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"artedibujoyarquitectura.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002015; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"arwenyapi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002016; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ask-regard.call-save.biz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002017; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"asucssa.live"; content:"Host"; http_header; classtype:trojan-activity; sid:100002018; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"atfile.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002019; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"athenacapsg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002020; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"atlasconcreteworks.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002021; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"attach.66rpg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002022; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"atteuqpotentialunlimited.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002023; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"augustair.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002024; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aulist.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002025; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"automaticrefreshments.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002026; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"avadhanagames.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002027; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayahuascasp.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002028; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayamallah.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002029; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"aycconsultoriaempresarial.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002030; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"azmeasurement.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002031; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"azraktours.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002032; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"b2b.toptanakaryakit.com.tr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002033; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"badeggdesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002034; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"balealgodon.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002035; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bangkok-orchids.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002036; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bangladeshunbound.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002037; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bary.sz4h.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002038; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bash.givemexyz.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002039; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bausch.kr-atlas.monaxikoslykos@zytrox.tk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002040; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavhome.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002041; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbia.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002042; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcmt.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002043; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcrg.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002044; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdnextrend.xyz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002045; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beanx88.xyz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002046; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bearcatpumps.com.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002047; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautincollagen.rs"; content:"Host"; http_header; classtype:trojan-activity; sid:100002048; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautymomentsgt.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002049; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bekape.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002050; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beor360.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002051; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bespokeweddings.ie"; content:"Host"; http_header; classtype:trojan-activity; sid:100002052; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestcarenepal.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002053; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"betone.co.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002054; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"betycopaints.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002055; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"beveragesmiami.solucioneslink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002056; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhavaniengineering.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002057; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigmikesupplies.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002058; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bilhen.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002059; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"billing.rahitechnosoft.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002060; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"binoy.stalphonsamissionva.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002061; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"biometrico.gpotecnosystems.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002062; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bioskey.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002063; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"birdi.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002064; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"birminghamlink.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002065; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bizztradingbot.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002066; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bl4n3.zadns.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002067; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.callensaxen.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002068; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.difusodesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002069; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.oyinblogs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002070; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.takbelit.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002071; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmlifestyle.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002072; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"boatpecas.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002073; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodenstein.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002074; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodylanguage.santulan.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002075; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"booksearch.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002076; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bophelocare.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002077; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bounces.mi-fs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002078; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"boutiqueofferte.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002079; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpo.correct.go.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100002080; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bradleyinstitute.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002081; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brandtrust.com.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002082; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"braunfinancial.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002083; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brendanquine.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002084; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brideofmessiah.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002085; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightaffiliatesales.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002086; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightmega.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002087; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightstarshop.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002088; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"browardinsurancemiami.solucioneslink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002089; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt2.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002090; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"btdapi.robotake.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002091; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"buigiaphat.com.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002092; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullseyemedia.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002093; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"busandvanrentalmalaysia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002094; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"buscascolegios.diit.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002095; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"business.softberg.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002096; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"business2.softberg.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002097; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"bydspa.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002098; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.oooooooooo.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002099; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"c0140529.ferozo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002100; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"caballo.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002101; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cacaoprojects.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002102; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"calgaryautorepairservice.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002103; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"callbury.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002104; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"camminachetipassa.it"; content:"Host"; http_header; classtype:trojan-activity; sid:100002105; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"capitalgroup-kw.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002106; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"capoeiraventrelivre.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002107; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cashyinvestment.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002108; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"catchperch.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002109; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"catchpoolshetlands.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002110; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cazyacustomfurniture.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002111; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbn.hypervoizd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002112; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccauthority.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002113; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdaonline.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002114; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cec.asso.ac-amiens.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002115; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cecra.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002116; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cellas.sk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002117; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cendekiabinaaksara.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002118; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfs5.tistory.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002119; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch.rmu.ac.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100002120; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"changematterscounselling.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002121; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"chardhamdodham.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002122; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"chezalice.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002123; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"childselect.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002124; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"chinhdropfile.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002125; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"chinhdropfile80.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002126; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cible-energy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002127; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cifeer.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002128; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"citiconstructioncorp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002129; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"citihits.lk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002130; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"citssolutions.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002131; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"citycapproperty.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002132; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cityglobalgospel.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002133; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"civi.istmejia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002134; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cleanbydesignllc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002135; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud.fc.co.mz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002136; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cm-arquitetos.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002137; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnc.tacobelllover.tk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002138; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"codsambal.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002139; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"colinde.pricesne.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002140; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"colorpak.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002141; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"columbia.aula-web.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002142; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"community.reimclub.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002143; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"competancy.indigoconsult.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002144; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"conceptimagine.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002145; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"config.cqhbkjzx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002146; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectcapital.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002147; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"constructoralyon.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002148; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"consulateins.solucioneslink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002149; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"contributeindustry.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002150; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"copelandscapes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002151; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"corwin-tommie06f.ru.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002152; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"coulsongraphics.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002153; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"count.mail.163.com.impactmedfoundation.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002154; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"covid19.cyberschool.or.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002155; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpanel.shivay.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002156; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cr-sq.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002157; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"craftech.nxtnet.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002158; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crearechile.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002159; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"creationskateboards.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002160; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crecerco.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002161; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crittersbythebay.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002162; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm.notariavieitoyvelamazan.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002163; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crmfarko.manivelasst.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002164; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crmroche.manivelasst.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002165; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"crscorretordeimoveis.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002166; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cse-engineer.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002167; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002168; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctracknxt.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002169; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cubescargoexpress.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002170; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"curasoles.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002171; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"currantmedia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002172; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwa.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002173; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyclomove.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002174; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"cynkon.kairoscs.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002175; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"czsl.91756.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002176; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.powerofwish.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002177; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"d9.99ddd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002178; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"da.alibuf.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002179; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"danaevara.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002180; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dartoonpictures.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002181; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"data.cdevelop.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002182; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"data.over-blog-kiwi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002183; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"datapolish.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002184; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dating.khokhas.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002185; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"datsom.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002186; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"davethompson.me.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002187; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dayspringdaisies.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002188; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd.qiyuea.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002189; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddns.cyberium.cc"; content:"Host"; http_header; classtype:trojan-activity; sid:100002190; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"de.gsearch.com.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002191; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"decifrar.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002192; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"deigratia2.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002193; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dekovizyon.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002194; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo-cliente.mindcreative.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002195; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.glassforcars.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002196; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo6.hiites.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002197; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dent-estet.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002198; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dental.xiaoxiao.media"; content:"Host"; http_header; classtype:trojan-activity; sid:100002199; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dentalalliance.se"; content:"Host"; http_header; classtype:trojan-activity; sid:100002200; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"desertlandtrd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002201; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"designerliving.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002202; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"despertaresi.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002203; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"destinymc.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002204; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"detorre.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100002205; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.sebpo.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002206; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.watch-store.eu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002207; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dezcom.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002208; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfcf.91756.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002209; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"diamantenegro.mi-fs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002210; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dienmayminhhung.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002211; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"digilib.dianhusada.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002212; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"digisails.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002213; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"disinfection-cleaning.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002214; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"djking.f3322.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002215; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.1003b.56a.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002216; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.198424.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002217; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.installcdn-aws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002218; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.packetstormsecurity.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002219; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.rina-roleplay.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002220; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dockerupdate.anondns.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002221; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"docman.orientalservices.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002222; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dodsonimaging.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002223; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"doitunlimited.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002224; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dokan.blueberrytec.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002225; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dom.daf.free.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002226; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"doncedyhall.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002227; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"donghobinhminh.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002228; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dongphuctop.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002229; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"donwnloasecury.ath.cx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002230; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dosame.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002231; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dosman.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002232; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dovberger.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002233; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"down.pcclear.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002234; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"down.udashi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002235; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"down.webbora.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002236; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"down1.arpun.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002237; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.caihong.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002238; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.doumaibiji.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002239; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.exrnybuf.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002240; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.kaobeitu.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002241; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.pdf00.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002242; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.rising.com.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002243; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.skycn.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002244; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"download.zjsyawqj.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002245; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragonsknot.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002246; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"drbaby.com.sa"; content:"Host"; http_header; classtype:trojan-activity; sid:100002247; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dream.pics"; content:"Host"; http_header; classtype:trojan-activity; sid:100002248; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"drgroup.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002249; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"drools-moved.46999.n3.nabble.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002250; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"drsha.innovativesolutions.mobi"; content:"Host"; http_header; classtype:trojan-activity; sid:100002251; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsenterprize.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002252; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsspainting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002253; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"du-wizards.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002254; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"duque.guantanameratravel.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002255; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dutapp.wisolve.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002256; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"duvalcharter.dekitout.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002257; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dw2.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002258; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dx.qqyewu.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002259; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzinestudio87.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002260; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-commerce.saleensuporte.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002261; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"e.sldov.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002262; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"eandgdesign.com.ng"; content:"Host"; http_header; classtype:trojan-activity; sid:100002263; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"eastsheen-glaziers.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002264; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebruyatkin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002265; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"edu.saicraftsman.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002266; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"eedo.ee"; content:"Host"; http_header; classtype:trojan-activity; sid:100002267; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"efficientegroup.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002268; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"elbauldenora.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002269; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"emaids.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002270; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"emaz.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002271; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.baoend.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002272; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"enc-tech.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002273; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"endurotanzania.co.tz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002274; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ennovate.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002275; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"equimination.ee"; content:"Host"; http_header; classtype:trojan-activity; sid:100002276; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"erp.nanotechproautocare.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002277; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"erp.zilymax.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002278; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"escola.probommar.org.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002279; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"esnconsultants.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002280; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"essentia.org.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002281; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"estjh05.top"; content:"Host"; http_header; classtype:trojan-activity; sid:100002282; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereality.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002283; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"eubanks7.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002284; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"europeanzonexxi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002285; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"exilum.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002286; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoalfaomega.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002287; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrovertoffers.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002288; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"f1sol.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002289; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"familydentist.site"; content:"Host"; http_header; classtype:trojan-activity; sid:100002290; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"faveraprojects.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002291; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fc.co.mz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002292; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"felicienne.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002293; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"files.martellexpress.us"; content:"Host"; http_header; classtype:trojan-activity; sid:100002294; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"files6.uludagbilisim.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002295; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"final.makkahkmcc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002296; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fineartgallerym.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002297; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisconline.bar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002298; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fisconline.casa"; content:"Host"; http_header; classtype:trojan-activity; sid:100002299; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fix-america-now.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002300; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixauto.illumetechnology.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002301; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixturegovernment.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002302; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkd.derpcity.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002303; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"flexypay.dsquaregroup.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002304; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"flintspin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002305; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyingbuddhadesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002306; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmjplastering.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002307; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"follower.instantcashback.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002308; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"foothills.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002309; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"footweardirect.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002310; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"forum.mdb.nu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002311; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fotoobjetivo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002312; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"foundationrepairhoustontx.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002313; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"foxeps.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002314; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"freecnetdownload.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002315; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"freisites.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002316; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftp.n3twork30cm.ml"; content:"Host"; http_header; classtype:trojan-activity; sid:100002317; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fullelectronica.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002318; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"funletters.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002319; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"fusionfiresolutions.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002320; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"futbolpr.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002321; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"futuregraphics.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002322; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"g.pinmonkey.xyz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002323; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaditastour.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002324; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gametwogame.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002325; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"garciadogshow.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002326; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"garenanow.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002327; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"garenanow4.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002328; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gastoudergonny.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002329; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbbulls.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002330; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcpc.co.id.chronoscurtain.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002331; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"generaldeviales.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002332; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfmodd1.webselffiles01.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002333; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfold1.webselffiles01.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002334; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghettohub.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002335; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghislain.dartois.pagesperso-orange.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002336; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"giadungg7.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002337; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"giddos.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002338; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"giteletropical.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002339; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"glowinmedia.co.ke"; content:"Host"; http_header; classtype:trojan-activity; sid:100002340; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmtransformationacademy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002341; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmvadmission.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002342; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnimelf.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002343; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnscrew.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002344; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gold.investforex.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002345; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldcake.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002346; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldcoastoffice365.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002347; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldcoastoffice365.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002348; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"golden-memories-funerals.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002349; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldenasiacapital.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002350; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldmen.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002351; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpotecnosystems.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002352; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gracejukes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002353; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoinmare.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002354; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruposelt.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002355; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gs.monerorx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002356; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"guide-to-cell-phones.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002357; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gulfac-house.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002358; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvpcdpgc.edu.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002359; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"habbotips.free.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002360; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hagebakken.no"; content:"Host"; http_header; classtype:trojan-activity; sid:100002361; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hamptonpartyoffive.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002362; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hashmati.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002363; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hassanproduct.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002364; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hchfug.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002365; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hd11315.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002366; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdkamera2003.hu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002367; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hds.sz4h.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002368; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"heavymaq.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002369; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellogorgeous.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002370; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"help.hizuko.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002371; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"herchinfitout.com.sg"; content:"Host"; http_header; classtype:trojan-activity; sid:100002372; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhaward.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002373; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"highlandroadcoc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002374; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"highlandslasvegas.atakdev.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002375; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hindi.factsriver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002376; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiptool.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002377; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitpe.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002378; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitstation.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002379; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmpmall.co.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002380; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoagietesting10.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002381; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoayeuthuong-my.sharepoint.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002382; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"holmesservices.mobiledevsite.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002383; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"homefindersolutions.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002384; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hongluosi.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002385; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hookedupboatclub.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002386; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostingparacolombia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002387; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostzaa.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002388; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"houstonshutters.site"; content:"Host"; http_header; classtype:trojan-activity; sid:100002389; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hr2019.vrcom7.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002390; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hseda.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002391; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsmwebapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002392; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"htownbars.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002393; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hubtech.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002394; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"huellacero.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002395; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hunchomusichub.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002396; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"hunggiang.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002397; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"husamiyahschool.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002398; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iabmixx2020.rayadigital.online"; content:"Host"; http_header; classtype:trojan-activity; sid:100002399; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iam313.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002400; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"icon.shatangmu.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002401; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"idea-secure-login.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002402; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"idilsoft.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002403; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"idj.no"; content:"Host"; http_header; classtype:trojan-activity; sid:100002404; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"idvindia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002405; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieclb.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002406; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikexpert.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002407; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilrafrica.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002408; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"images.jermiau.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002409; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"imbueautoworx.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002410; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"in-tune2016.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002411; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"incrediblepixels.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002412; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"incredicole.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002413; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"indrasbikaner.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002414; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"infair.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002415; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"infovator.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002416; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"initialnetworks.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002417; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"inodesthetotaldesigners.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002418; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"inrajahmundry.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002419; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"instantindialoan.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002420; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"intellectsmart.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002421; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"intersel-idf.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002422; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"intuitiveideas.com.my"; content:"Host"; http_header; classtype:trojan-activity; sid:100002423; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"inversiones.arrayanfinanciero.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002424; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"invest.xpcorporative.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002425; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipmes.ma"; content:"Host"; http_header; classtype:trojan-activity; sid:100002426; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iremart.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100002427; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iris101.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002428; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"isaac.mikhailmotoringschool.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002429; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iscamenabe.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002430; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"isiphephelocon.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002431; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ismf.com.ng"; content:"Host"; http_header; classtype:trojan-activity; sid:100002432; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"iso-dubai.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002433; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"israrulhaq.me"; content:"Host"; http_header; classtype:trojan-activity; sid:100002434; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"isrorg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002435; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"isso.ps"; content:"Host"; http_header; classtype:trojan-activity; sid:100002436; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ist-security.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002437; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"it123.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002438; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"italiandirezione.casa"; content:"Host"; http_header; classtype:trojan-activity; sid:100002439; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"itc-demo.softgig.co.ke"; content:"Host"; http_header; classtype:trojan-activity; sid:100002440; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"itmotasaciones.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002441; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jamiekaylive.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002442; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jansen-heesch.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002443; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jathra.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002444; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jay.diamondrelationscrm.us"; content:"Host"; http_header; classtype:trojan-activity; sid:100002445; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jebs.net.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002446; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jeffdahlke.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002447; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiaoyuzixun.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002448; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jing-da.com.tw"; content:"Host"; http_header; classtype:trojan-activity; sid:100002449; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmtc.91756.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002450; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnanbharati.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002451; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jobs.thebeessolution.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002452; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"joelbonissilver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002453; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"join.cl8movement.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002454; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"josegene.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002455; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpwoodfordco.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002456; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jumpmanualjacobhiller.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002457; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"jupiter.toxsl.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002458; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"justinscott.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002459; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kadigital.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002460; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kalawatihomes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002461; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kalogirosfinance.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002462; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaptaanchapal.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002463; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"karer.by"; content:"Host"; http_header; classtype:trojan-activity; sid:100002464; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"katanvetov.co.il"; content:"Host"; http_header; classtype:trojan-activity; sid:100002465; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"katelynn9506a.ru.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002466; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kensingtondriving.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002467; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ketofitnessexpert.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002468; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kevinjewelry.com.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002469; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"keywatch.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002470; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kingssa.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002471; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kizitox.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002472; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjcpromo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002473; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kleinendeli.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002474; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"korrectconceptservices.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002475; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"krisbadminton.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002476; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktb.sch.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002477; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubatoglubaklava.com.tr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002478; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kumaralok.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002479; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwanfromhongkong.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002480; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"kz.sldov.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002481; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacasadelosalebrijes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002482; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ladylabonde.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002483; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lameguard.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002484; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"laodongnhat.vn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002485; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"laravel.pointersoftwares.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002486; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasermobilesounds.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002487; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lauratomismith.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002488; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lautarosanmiguel.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002489; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lawforall.edu.lk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002490; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lawschoolideas.xyz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002491; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lceventos.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002492; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ld.mediaget.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002493; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldgcorp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002494; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"learning.real-academy.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002495; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"leasiacherise.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002496; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"leczkregoslup.acelero.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002497; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"legend.nu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002498; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"leluibuffet.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002499; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lestesteux.ca"; content:"Host"; http_header; classtype:trojan-activity; sid:100002500; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"library.arihantmbainstitute.ac.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002501; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"library.uib.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002502; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lidoraggiodisole.it"; content:"Host"; http_header; classtype:trojan-activity; sid:100002503; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifebeam.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002504; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lindnerelektroanlagen.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002505; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"linkintec.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002506; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"liquidaz.casa"; content:"Host"; http_header; classtype:trojan-activity; sid:100002507; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"livetrack.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002508; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lloydsindian.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002509; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lm.stagingarea.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002510; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmaancha.co.il"; content:"Host"; http_header; classtype:trojan-activity; sid:100002511; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lms.cstdevs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002512; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lms.login2.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002513; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"location-voitures.ma"; content:"Host"; http_header; classtype:trojan-activity; sid:100002514; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.trezor.com.stockfootagesindia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002515; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"logotypfabriken.se"; content:"Host"; http_header; classtype:trojan-activity; sid:100002516; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotix.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002517; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotusanddragonfly.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002518; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lp.definerisco.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002519; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"lp.difusodesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002520; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltc.typoten.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002521; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"luckybrownie.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002522; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"luminouspneuma.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002523; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"luxomodels.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002524; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"m-technics.kz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002525; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.estudiomoros.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002526; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.softsharks.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002527; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"madicon.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002528; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"magianegramagiablancayamarres.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002529; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.bs-eiendomme.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002530; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.golimoapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002531; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.jeffsono.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002532; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"maksi.feb.unib.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002533; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"malaya.tv"; content:"Host"; http_header; classtype:trojan-activity; sid:100002534; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"malwarecoding.github.io"; content:"Host"; http_header; classtype:trojan-activity; sid:100002535; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"managed.oss-cn-beijing.aliyuncs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002536; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"managemysalon.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002537; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"manantialesdelnorte.uy"; content:"Host"; http_header; classtype:trojan-activity; sid:100002538; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"manhtien.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002539; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mario-sunjic.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002540; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mariobrown.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002541; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mariotessarollo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002542; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketinfosales.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002543; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketing.enexusgroup.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002544; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"marksidfgs.ug"; content:"Host"; http_header; classtype:trojan-activity; sid:100002545; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"masjidhabeebiyarazviya.mysunni.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002546; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mastersofclientretention.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002547; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"materialescantu.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002548; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"matruchhaya.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002549; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxiquim.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002550; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxtox.com.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002551; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbgrm.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002552; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbjtimes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002553; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbsolutions.ge"; content:"Host"; http_header; classtype:trojan-activity; sid:100002554; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbx.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002555; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdasa.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002556; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"medevlb.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002557; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"media-server.skyinternet.com.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002558; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"medianews.ge"; content:"Host"; http_header; classtype:trojan-activity; sid:100002559; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mediawaysnews.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002560; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"medistaffconsulting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002561; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeweb.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002562; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"megagynreformas.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002563; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"megamart.afnan-amc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002564; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mehainteriors.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002565; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercabits.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002566; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"merkathink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002567; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mertlog.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002568; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"metalin-cr.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002569; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mettaanand.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002570; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"meuoculosnanet.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002571; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfevr.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002572; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhkdhotbot.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002573; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhkdhotbot80.myvnc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002574; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"micalle.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002575; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"michaelphilip.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002576; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"michimal2.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002577; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"microblading.mirliandias.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002578; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"microcomm-group.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002579; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mikhailmotoringschool.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002580; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mills-skyla30ec.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002581; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mingguanwms.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002582; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"minuevavida.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002583; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mirror.mypage.sk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002584; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mis.nbcc.ac.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100002585; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"misterson.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002586; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkontakt.az"; content:"Host"; http_header; classtype:trojan-activity; sid:100002587; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mktf.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002588; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmogollon.com.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002589; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"mncarteam.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002590; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"modelhouseturkey.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002591; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"modernmanna.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002592; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"monetization.business"; content:"Host"; http_header; classtype:trojan-activity; sid:100002593; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"moninediy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002594; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"motorcomunicacion.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002595; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"moumitas.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002596; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"msacontabil.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002597; rev:1;) @@ -2616,7 +2616,7 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nap.mgsservers.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002610; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"navayurveda.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002611; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nec-i.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002612; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nellaimasthanbiryani.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002613; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nelitrianggraeni.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002613; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nerve.untergrund.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002614; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nettube.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002615; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkwheels.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002616; rev:1;) @@ -2635,134 +2635,134 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nilinkeji.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002629; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nimboohomes.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002630; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"njtiledesigncenter.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002631; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nobius.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002632; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nocalnoodle.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002633; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nomadicbees.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002634; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"northnodegroup.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002635; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"notamuzikaletleri.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002636; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ns1.the-widyantos.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002637; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsb.org.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002638; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nurmarkaz.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002639; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxtnet.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002640; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyasabigbullets.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002641; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyeh2o.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002642; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"obseques-conseils.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002643; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oecteam.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002644; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohsewgorgeous.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002645; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oknoplastik.sk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002646; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oleholeh.memangbeda.website"; content:"Host"; http_header; classtype:trojan-activity; sid:100002647; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"omaia.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002648; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"omaromatic.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002649; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"omega.az"; content:"Host"; http_header; classtype:trojan-activity; sid:100002650; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oms.pappai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002651; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"omscoc.pappai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002652; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedigitalcard.granvizionnecorp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002653; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.listifyapp.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002654; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.creedglobal.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002655; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinestatis.bar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002656; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"open.warehousesaas.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002657; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"opolis.io"; content:"Host"; http_header; classtype:trojan-activity; sid:100002658; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"opticaoptigral.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002659; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"optimus.com.sg"; content:"Host"; http_header; classtype:trojan-activity; sid:100002660; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"order.bizpeed.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002661; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"orientgatewayltd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002662; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"orion445.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002663; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oserve.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002664; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ot.weenets.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002665; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"outletdosaquecedores.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002666; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozemag.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002667; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"p1.lingpao8.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002668; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"p3.zbjimg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002669; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"p6.zbjimg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002670; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pablobrothel.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002671; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pacificgroup.ws"; content:"Host"; http_header; classtype:trojan-activity; sid:100002672; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pacwebdesigns.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002673; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagos.krayem.com.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002674; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"palbas.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002675; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"palochusvet.szm.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002676; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"parallel.rockvideos.at"; content:"Host"; http_header; classtype:trojan-activity; sid:100002677; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"parejasfelices.mi-fs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002678; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"parkhussion.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002679; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pastorpaulocosta.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002680; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"patch2.51lg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002681; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"patch2.99ddd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002682; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"patch3.99ddd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002683; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"paths.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002684; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"patriotsupremehemp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002685; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"paulmercier.biz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002686; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"payerrealty.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002687; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"payments.atifsiddiqui.me"; content:"Host"; http_header; classtype:trojan-activity; sid:100002688; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcsoori.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002689; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pd.oceaniarp.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002690; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemdodo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002691; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfumeriamontes.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100002692; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"periodiche.bar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002693; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"perpus.onlineman7-jombang.sch.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002694; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"perpustekim.untirta.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002695; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pestoclean.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002696; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"petercollie.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002697; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ph4s.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002698; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"phasdesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002699; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"phenhuong.sanpham.online"; content:"Host"; http_header; classtype:trojan-activity; sid:100002700; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"phittc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002701; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"photo360.kubooking.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002702; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pink99.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002703; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"plasfan.ind.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002704; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"playground2.grupoaliadasca.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002705; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmglance.startwriteup.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002706; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pokojewewladyslawowie.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002707; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pole.com.vc"; content:"Host"; http_header; classtype:trojan-activity; sid:100002708; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pool.phxdir.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002709; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooltablemoversdenver.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002710; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"posmicrosystems.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002711; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"poulman.panagiotopoulos-tours.gr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002712; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppdb.smk-ciptaskill.sch.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002713; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prestasicash.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002714; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prestigehomeautomation.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002715; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview2.behalen.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002716; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prishaartcreations.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002717; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"production.sparshims.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002718; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"programaoperadoronline.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002719; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"project.exquitec.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002720; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"promotoradescomplica.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002721; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"promoversdubai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002722; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"propertiq.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002723; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"propertiq2.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002724; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosoc.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002725; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosupport.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002726; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosyarmakassar.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002727; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"provence.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002728; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prox.realunix.cc"; content:"Host"; http_header; classtype:trojan-activity; sid:100002729; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prueba.danielluza.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002730; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pujashoppe.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002731; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"punchdialogues.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002732; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"punjabdevelopersassociation.com.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002733; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvcprinting.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002734; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"qadir.tickfa.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100002735; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"qatarglobalconsulting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002736; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmsled.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002737; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"quartier-midi.be"; content:"Host"; http_header; classtype:trojan-activity; sid:100002738; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"querocar.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002739; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rachmat-assuhaimi.my.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002740; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"radioafifense.deploys.live"; content:"Host"; http_header; classtype:trojan-activity; sid:100002741; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rainbowisp.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002742; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rajeshtailang.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002743; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakeshkhatri.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002744; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"raodigitalmedia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002745; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"raquelhelena.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002746; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rarlabarchiver.ac"; content:"Host"; http_header; classtype:trojan-activity; sid:100002747; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasadbar.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100002748; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rashika.ascarvalho.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002749; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ratemyfenancialadvisor.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002750; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ravenproductionsltd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002751; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rc.ixiaoyang.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002752; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcmesilva.charbelsales.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002753; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"reacredit.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002754; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"readwrite26.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002755; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"readymmade.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002756; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"recyclethesurplus.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002757; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"redbats.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002758; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"redboxmultimedia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002759; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmxwllwsdyminoragenw.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100002632; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nobius.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002633; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nocalnoodle.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002634; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nomadicbees.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002635; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"northnodegroup.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002636; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"notamuzikaletleri.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002637; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ns1.the-widyantos.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002638; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsb.org.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002639; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nurmarkaz.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002640; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxtnet.ga"; content:"Host"; http_header; classtype:trojan-activity; sid:100002641; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyasabigbullets.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002642; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyeh2o.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002643; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"obseques-conseils.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002644; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oecteam.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002645; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohe.ie"; content:"Host"; http_header; classtype:trojan-activity; sid:100002646; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohsewgorgeous.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002647; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oknoplastik.sk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002648; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oleholeh.memangbeda.website"; content:"Host"; http_header; classtype:trojan-activity; sid:100002649; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"omaia.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002650; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"omaromatic.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002651; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"omega.az"; content:"Host"; http_header; classtype:trojan-activity; sid:100002652; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oms.pappai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002653; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"omscoc.pappai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002654; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedigitalcard.granvizionnecorp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002655; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.listifyapp.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002656; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.creedglobal.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002657; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinestatis.bar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002658; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"open.warehousesaas.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002659; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"opolis.io"; content:"Host"; http_header; classtype:trojan-activity; sid:100002660; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"opticaoptigral.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002661; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"optimus.com.sg"; content:"Host"; http_header; classtype:trojan-activity; sid:100002662; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"order.bizpeed.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002663; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"orientgatewayltd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002664; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"orion445.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002665; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"oserve.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002666; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ot.weenets.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002667; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"outletdosaquecedores.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002668; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozemag.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002669; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"p1.lingpao8.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002670; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"p3.zbjimg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002671; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"p6.zbjimg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002672; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pablobrothel.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002673; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pacificgroup.ws"; content:"Host"; http_header; classtype:trojan-activity; sid:100002674; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pacwebdesigns.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002675; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagos.krayem.com.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002676; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"palbas.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002677; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"palochusvet.szm.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002678; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"panslimiterd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002679; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"parallel.rockvideos.at"; content:"Host"; http_header; classtype:trojan-activity; sid:100002680; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"parejasfelices.mi-fs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002681; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"parkhussion.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002682; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pastorpaulocosta.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002683; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"patch2.51lg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002684; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"patch2.99ddd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002685; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"patch3.99ddd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002686; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"paths.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002687; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"patriotsupremehemp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002688; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"paulmercier.biz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002689; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"payerrealty.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002690; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"payments.atifsiddiqui.me"; content:"Host"; http_header; classtype:trojan-activity; sid:100002691; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcsoori.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002692; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pd.oceaniarp.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002693; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemdodo.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002694; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfumeriamontes.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100002695; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"periodiche.bar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002696; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"perpus.onlineman7-jombang.sch.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002697; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"perpustekim.untirta.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002698; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pestoclean.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002699; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"petercollie.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002700; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ph4s.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002701; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"phasdesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002702; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"phenhuong.sanpham.online"; content:"Host"; http_header; classtype:trojan-activity; sid:100002703; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"phittc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002704; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"photo360.kubooking.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002705; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pink99.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002706; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"plasfan.ind.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002707; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"playground2.grupoaliadasca.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002708; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmglance.startwriteup.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002709; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmrimewsdylimtewsogh.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100002710; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pokojewewladyslawowie.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002711; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pole.com.vc"; content:"Host"; http_header; classtype:trojan-activity; sid:100002712; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pool.phxdir.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002713; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooltablemoversdenver.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002714; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"posmicrosystems.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002715; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"poulman.panagiotopoulos-tours.gr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002716; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppdb.smk-ciptaskill.sch.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002717; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prestasicash.com.ar"; content:"Host"; http_header; classtype:trojan-activity; sid:100002718; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prestigehomeautomation.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002719; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview2.behalen.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002720; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prishaartcreations.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002721; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"production.sparshims.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002722; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"programaoperadoronline.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002723; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"promotoradescomplica.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002724; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"promoversdubai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002725; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"propertiq.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002726; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"propertiq2.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002727; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosoc.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002728; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosupport.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002729; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosyarmakassar.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002730; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"provence.elin.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002731; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"prox.realunix.cc"; content:"Host"; http_header; classtype:trojan-activity; sid:100002732; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pujashoppe.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002733; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"punchdialogues.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002734; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"punjabdevelopersassociation.com.pk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002735; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvcprinting.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002736; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"qadir.tickfa.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100002737; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"qatarglobalconsulting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002738; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmsled.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002739; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"quartier-midi.be"; content:"Host"; http_header; classtype:trojan-activity; sid:100002740; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"querocar.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002741; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rachmat-assuhaimi.my.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002742; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"radioafifense.deploys.live"; content:"Host"; http_header; classtype:trojan-activity; sid:100002743; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rainbowisp.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002744; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rajeshtailang.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002745; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakeshkhatri.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002746; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"raquelhelena.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002747; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rarlabarchiver.ac"; content:"Host"; http_header; classtype:trojan-activity; sid:100002748; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasadbar.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100002749; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rashika.ascarvalho.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002750; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ratemyfenancialadvisor.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002751; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ravenproductionsltd.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002752; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rc.ixiaoyang.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100002753; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcmesilva.charbelsales.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002754; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"reacredit.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002755; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"readwrite26.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002756; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"readymmade.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002757; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"recyclethesurplus.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002758; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"redbats.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002759; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"redchillicrackers.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002760; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"reifenquick.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100002761; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"relaxindulge.co.nz"; content:"Host"; http_header; classtype:trojan-activity; sid:100002762; rev:1;) @@ -2846,145 +2846,145 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sibernetix.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002840; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sigapresschennai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002841; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sige.brisainformatica.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002842; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"signatureads.co.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002843; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"siili.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002844; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"simoneporzi.it"; content:"Host"; http_header; classtype:trojan-activity; sid:100002845; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"simorsint.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002846; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"simplithy.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002847; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sindicato1ucm.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002848; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sindpol.tiejuris.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002849; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sipahielektrik.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002850; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sistelligent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002851; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"skare.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002852; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyflyfares.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002853; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyscan.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002854; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"slot0.gamoruz.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002855; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"smarthouseforum.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002856; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartzedu.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002857; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"smokesolutionindia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002858; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"smritiphotography.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002859; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sobariko.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002860; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sobethuacademy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002861; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft.110route.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002862; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft.officelabo.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002863; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"softanis.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002864; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sogecoenergy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002865; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sohs.conceptechs.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002866; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"solar.amazingtribe.lk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002867; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"somcorbera.cat"; content:"Host"; http_header; classtype:trojan-activity; sid:100002868; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"somir.com.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002869; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"soralapps.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002870; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sota-france.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002871; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"space.proactint.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002872; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spaceframe.mobi.space-frame.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002873; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"special-key.cf"; content:"Host"; http_header; classtype:trojan-activity; sid:100002874; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spent.com.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002875; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spetsesyachtcharter.gr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002876; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spititourism.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002877; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spittinfire.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002878; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"springbedspetroleum.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002879; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"src1.minibai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002880; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sreenivasapaintingworks.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002881; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sriglobalit.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002882; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"srilankamovies.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002883; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"srvmanos.no-ip.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002884; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ss.monita.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002885; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"st.devcodin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002886; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.apparelpunch.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002887; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"starcountry.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002888; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"static.3001.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002889; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stiau.iuc.ac"; content:"Host"; http_header; classtype:trojan-activity; sid:100002890; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sticker.jewsjuice.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002891; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stiedemann-alvah30hq.ru.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002892; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stiepancasetia.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002893; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"store.ericalgarin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002894; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stott-thompson.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002895; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stratexec.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002896; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"streetdemo.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002897; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"suboldesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002898; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumerians.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002899; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunaryem.com.tr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002900; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunbrero.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002901; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunmarkholidays.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002902; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-4-free.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002903; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"support.clz.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002904; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"supportit.online"; content:"Host"; http_header; classtype:trojan-activity; sid:100002905; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sw.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002906; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweaty.dk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002907; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-diet.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002908; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiftlogisticseg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002909; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"swwbia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002910; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"syracusecoffee.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002911; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sytraders.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002912; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"t.honker.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002913; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"t.netcatkit.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002914; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tacticohosting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002915; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tadoo.ca"; content:"Host"; http_header; classtype:trojan-activity; sid:100002916; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tafsantoursandtravels.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002917; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tajushariya.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002918; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tallyinvoicecustomization.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002919; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"taltus.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002920; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tapalkoedacoffee.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002921; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tarravalleyfoods.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002922; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tavo.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002923; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tc.snpsresidential.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002924; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcy.198424.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002925; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsp.yngw518.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002926; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"techgms.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002927; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"teduae.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002928; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"teleargentina.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002929; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"telescopelms.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002930; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"temptmag.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002931; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tencoconsulting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002932; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"teneth.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002933; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tentandoserfitness.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002934; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tessrobins.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002935; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.adventser.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002936; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.letraele.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100002937; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.lubrico.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002938; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.typoten.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002939; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.wanepghana.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002940; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test1.asistencia247.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002941; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test1.milenial.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002942; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test1.tenplusone.my"; content:"Host"; http_header; classtype:trojan-activity; sid:100002943; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test2.basis-web.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002944; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test2.marrenconstruction.ie"; content:"Host"; http_header; classtype:trojan-activity; sid:100002945; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"testing.clickitsolutionsmw.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002946; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"testing.thinkingcorp.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002947; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"testnew.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002948; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"teteaffiche.stephanebillon.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002949; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tewoerd.eu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002950; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"textile.softberg.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002951; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tharringtonsponsorship.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002952; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecleaningladiespdx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002953; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecreativecafe.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002954; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedesertship.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002955; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thediasporianexperience.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002956; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefamouscurrybazaar.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002957; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefuturelife.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002958; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehighlightinterior.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002959; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thekassia.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002960; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"themansionkasauli.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002961; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"theprofinn.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002962; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesummitpc.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002963; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"theurbantutors.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002964; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thosewebbs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002965; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thriveink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002966; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tianangdep.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002967; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tickfoods.tickme.lk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002968; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tidymasters.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002969; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"timegonebuy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002970; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tksb.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002971; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlcc.com.gt"; content:"Host"; http_header; classtype:trojan-activity; sid:100002972; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"todoapp.cstdevs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002973; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tonydong.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002974; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tonyzone.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002975; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tooba.tenplusone.my"; content:"Host"; http_header; classtype:trojan-activity; sid:100002976; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tools.reimclub.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002977; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"topcell9.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002978; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"toplevel.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002979; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"topmask.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002980; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"torresquinterocorp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002981; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"siili.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002843; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"simoneporzi.it"; content:"Host"; http_header; classtype:trojan-activity; sid:100002844; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"simorsint.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002845; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"simplithy.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002846; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sindicato1ucm.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002847; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sindpol.tiejuris.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002848; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sipahielektrik.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002849; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sistelligent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002850; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"skare.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002851; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyflyfares.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002852; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyscan.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002853; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"slot0.gamoruz.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002854; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"smarthouseforum.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100002855; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartzedu.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002856; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"smokesolutionindia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002857; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"smritiphotography.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002858; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sobariko.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002859; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sobethuacademy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002860; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft.110route.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002861; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft.officelabo.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002862; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"softanis.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002863; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sogecoenergy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002864; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sohs.conceptechs.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002865; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"solar.amazingtribe.lk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002866; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"somcorbera.cat"; content:"Host"; http_header; classtype:trojan-activity; sid:100002867; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"somir.com.mx"; content:"Host"; http_header; classtype:trojan-activity; sid:100002868; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"soralapps.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002869; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sota-france.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002870; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"space.proactint.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002871; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spaceframe.mobi.space-frame.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002872; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"special-key.cf"; content:"Host"; http_header; classtype:trojan-activity; sid:100002873; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spent.com.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002874; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spetsesyachtcharter.gr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002875; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spititourism.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002876; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"spittinfire.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002877; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"src1.minibai.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002878; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sreenivasapaintingworks.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002879; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sriglobalit.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002880; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"srilankamovies.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002881; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"srvmanos.no-ip.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002882; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ss.monita.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002883; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"st.devcodin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002884; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.apparelpunch.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002885; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"starcountry.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002886; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"static.3001.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002887; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stiau.iuc.ac"; content:"Host"; http_header; classtype:trojan-activity; sid:100002888; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sticker.jewsjuice.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002889; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stiedemann-alvah30hq.ru.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002890; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stiepancasetia.ac.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002891; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"store.ericalgarin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002892; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stott-thompson.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002893; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"stratexec.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002894; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"streetdemo.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002895; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"suboldesign.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002896; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumerians.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002897; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunaryem.com.tr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002898; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunbrero.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002899; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunmarkholidays.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002900; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-4-free.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002901; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"support.clz.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100002902; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"supportit.online"; content:"Host"; http_header; classtype:trojan-activity; sid:100002903; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sw.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002904; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweaty.dk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002905; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-diet.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002906; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiftlogisticseg.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002907; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"swwbia.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002908; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"syracusecoffee.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002909; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"sytraders.co"; content:"Host"; http_header; classtype:trojan-activity; sid:100002910; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"t.honker.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100002911; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"t.netcatkit.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002912; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tacticohosting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002913; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tadoo.ca"; content:"Host"; http_header; classtype:trojan-activity; sid:100002914; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tafsantoursandtravels.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002915; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tajushariya.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002916; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tallyinvoicecustomization.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002917; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"taltus.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002918; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tarravalleyfoods.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002919; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tavo.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100002920; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tc.snpsresidential.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002921; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcy.198424.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002922; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsp.yngw518.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002923; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tech332.synology.me"; content:"Host"; http_header; classtype:trojan-activity; sid:100002924; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"techgms.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002925; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"teduae.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002926; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"teleargentina.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002927; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"telescopelms.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002928; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"temptmag.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002929; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tencoconsulting.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002930; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"teneth.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002931; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tentandoserfitness.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002932; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tessrobins.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002933; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.adventser.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002934; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.letraele.es"; content:"Host"; http_header; classtype:trojan-activity; sid:100002935; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.lubrico.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002936; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.typoten.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002937; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.wanepghana.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100002938; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test1.asistencia247.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002939; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test1.milenial.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100002940; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test1.tenplusone.my"; content:"Host"; http_header; classtype:trojan-activity; sid:100002941; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test2.basis-web.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002942; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"test2.marrenconstruction.ie"; content:"Host"; http_header; classtype:trojan-activity; sid:100002943; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"testing.clickitsolutionsmw.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002944; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"testing.thinkingcorp.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002945; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"testnew.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002946; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"teteaffiche.stephanebillon.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002947; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tewoerd.eu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002948; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"textile.softberg.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100002949; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tharringtonsponsorship.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002950; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecleaningladiespdx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002951; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecreativecafe.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002952; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedesertship.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002953; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thediasporianexperience.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002954; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefamouscurrybazaar.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002955; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefuturelife.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100002956; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehighlightinterior.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002957; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thekassia.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002958; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"themansionkasauli.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002959; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"theprofinn.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002960; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesummitpc.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002961; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"theurbantutors.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002962; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"theviewsdyjupcazfeqv.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100002963; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thosewebbs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002964; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"thriveink.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002965; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tianangdep.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002966; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tickfoods.tickme.lk"; content:"Host"; http_header; classtype:trojan-activity; sid:100002967; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tidymasters.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100002968; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"timegonebuy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002969; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tksb.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100002970; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlcc.com.gt"; content:"Host"; http_header; classtype:trojan-activity; sid:100002971; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"todoapp.cstdevs.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002972; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tonydong.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002973; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tonyzone.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002974; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tooba.tenplusone.my"; content:"Host"; http_header; classtype:trojan-activity; sid:100002975; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tools.reimclub.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002976; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"topcell9.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002977; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"toplevel.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100002978; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"topmask.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100002979; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"torresquinterocorp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002980; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"towme.services"; content:"Host"; http_header; classtype:trojan-activity; sid:100002981; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"toyotacollege.ac.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100002982; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpke.hu"; content:"Host"; http_header; classtype:trojan-activity; sid:100002983; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"translaterjemah.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100002984; rev:1;) @@ -3008,15 +3008,15 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"umwelt-kirchhof.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100003002; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"unicorpbrunei.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003003; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniengrisb.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003004; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"unisoftcc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003005; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"unityindiversity.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100003006; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"unyazitelecom.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003007; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"upcbpta.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003008; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"urbantrapfest.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100003009; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"used-jeans.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100003010; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"useformoney.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003011; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"uss.ac.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100003012; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzzepay.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100003013; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"unitedwsdykesokowskg.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100003005; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"unyazitelecom.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003006; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"upcbpta.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003007; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"urbantrapfest.cl"; content:"Host"; http_header; classtype:trojan-activity; sid:100003008; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"used-jeans.fr"; content:"Host"; http_header; classtype:trojan-activity; sid:100003009; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"useformoney.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003010; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"uss.ac.th"; content:"Host"; http_header; classtype:trojan-activity; sid:100003011; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzzepay.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100003012; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"v2consultores.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003013; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"vanzare.cabanabrazi2.ro"; content:"Host"; http_header; classtype:trojan-activity; sid:100003014; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbcargo.hu"; content:"Host"; http_header; classtype:trojan-activity; sid:100003015; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcah.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100003016; rev:1;) @@ -3076,841 +3076,864 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"woodsytech.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003070; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wordpress.saleensuporte.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100003071; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"workingsolutionsrome.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003072; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wozata.000webhostapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003073; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wp.readhere.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100003074; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpdemo.101clients.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100003075; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"writtendeer.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003076; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ws5588.f3322.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100003077; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsdysuresbonescagegp.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100003078; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyklej.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100003079; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"x2vn.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003080; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xia.beihaixue.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003081; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xixaoclothing.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003082; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xk.996is.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003083; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--80akinnkiib6h.xn--90ais"; content:"Host"; http_header; classtype:trojan-activity; sid:100003084; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--polimerbizmimarlk-rvc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003085; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybom.urbanolab.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003086; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeichner.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003087; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylfpremium.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003088; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoast.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003089; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"youtubetrainingacademy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003090; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yskadvisors.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003091; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yummyyogaudaipur.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003092; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzkzixun.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003093; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmedcoach.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003094; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"zytrox.tk"; content:"Host"; http_header; classtype:trojan-activity; sid:100003095; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"zz.690tx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003096; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/64.exe"; http_uri; nocase; content:"2.indexsinas.me:811"; content:"Host"; http_header; classtype:trojan-activity; sid:100003097; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/86.exe"; http_uri; nocase; content:"2.indexsinas.me:811"; content:"Host"; http_header; classtype:trojan-activity; sid:100003098; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c64.exe"; http_uri; nocase; content:"2.indexsinas.me:811"; content:"Host"; http_header; classtype:trojan-activity; sid:100003099; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/8/1/2/9/81294208/growtopiastaff_setup1.61.exe"; http_uri; nocase; content:"amumufree.weebly.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003100; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/files/proxyi.exe"; http_uri; nocase; content:"analogx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003101; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/abernathyjorge711/y6788/downloads/bubblebrowserext1.0.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003102; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dvdfv/anjj/downloads/jami.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003103; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/heyhoeee/heyhoename1/downloads/1234.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003104; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jpavelski/chpock/downloads/4.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003105; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jpavelski/chpock/downloads/6.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003106; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/labesoftware/update/downloads/boost-fps.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003107; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/labesoftware/update/downloads/install_plugin_x64_x86.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003108; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/labesoftware/update/downloads/vpn_free.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003109; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/1.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003110; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/clr.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003111; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/omar.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003112; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/updatev.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003113; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/work.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003114; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/ya.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003115; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/player2012/rumpa1/downloads/component.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003116; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/player2012/rumpa1/downloads/nordvpnsetup.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003117; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/player2012/rumpa1/downloads/regsvc.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003118; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/skygaming/updates/downloads/update.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003119; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/001.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003120; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/1488.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003121; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/1_cr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003122; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/1cr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003123; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/1fc2d.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003124; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/26a5.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003125; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/6e7_2021-01-19_18-04.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003126; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/abjects.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003127; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/attached.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003128; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/b7f2c.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003129; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/battletext.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003130; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/bkghj_nowin.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003131; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/bsdasdasd333.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003132; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/build.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003133; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/build_makros.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003134; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/build_silent.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003135; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/build_sup.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003136; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/buildcmobiler.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003137; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/buildcmobiler.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003138; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/buildcr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003139; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/buildss.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003140; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/clientnik.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003141; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/clientrevers.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003142; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/dcrat.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003143; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/dllservices.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003144; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/dllservices2.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003145; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/exe_morris.mcdermott.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003146; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/hans.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003147; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/hulu.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003148; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/intelfive.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003149; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/intelfour.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003150; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/intelone.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003151; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/intelthree.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003152; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/inteltwo.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003153; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/jjuufksfn.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003154; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/kleiman.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003155; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/lucky_fixed.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003156; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/notepadplus.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003157; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/osiris_qqkz_nauto.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003158; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/out.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003159; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/out.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003160; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/pacbe_bin.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003161; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/putty.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003162; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/rockethcd.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003163; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/scvhost900.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003164; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/sessionwin.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003165; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/siliculose.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003166; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/statemobi.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003167; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/stealers.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003168; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/stealers2.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003169; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/stgedo.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003170; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/svcperf.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003171; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/symptomaticshon5.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003172; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/taurjok.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003173; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/taurusbabac.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003174; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/telekiller.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003175; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/updateanddr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003176; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/updateandr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003177; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/vhajeja.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003178; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/word.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003179; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/www.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003180; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/xlsd.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003181; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/teaserex/tease/downloads/b_kfmhkk172.bin"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003182; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/teaserex/tease/downloads/macro_xmprohiq27.bin"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003183; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hmatrix/data/hack1226.exe"; http_uri; nocase; content:"cd.textfiles.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003184; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/775238059083038744/821062129347067924/wxhyhyciuesjdefkxcqddvfbjqrofjq"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003185; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/816070119281131570/816070273254162442/all.txt"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003186; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/825372018244583454/826848185246023750/loaddd.exe"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003187; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/825372018244583454/826848348342059008/zeppelin.exe"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003188; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/825372018244583454/826848405258633277/build.exe"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003189; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/826198252025675816/826537386485612574/china.png"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003190; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/826376903400751108/826431600383361065/remcmcmcm_mjvbsmlrc45.bin"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003191; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003192; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/razor/rzr-winner_intro.zip"; http_uri; nocase; content:"chiptune.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003193; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/ws2/:suengpen/:buyerlist.js/buyerlist.js.xz"; http_uri; nocase; content:"cloudme.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003194; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/ws2/:suengpen/:buyerlist1/buyerlist1.rar"; http_uri; nocase; content:"cloudme.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003195; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meteoradminz/hidden-tear/zip/master"; http_uri; nocase; content:"codeload.github.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003196; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tmp/protected-cek9qz4zvk2n65e-c5d84gi5/security-cloud/kypqw-52kkq0n9ywj9oa/"; http_uri; nocase; content:"colfincas.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003197; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003198; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/frm0reseen/prntscrnofamzorderid.jpg.exe"; http_uri; nocase; content:"drive.google.com.it-barcelona.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003199; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003200; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003201; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003202; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003203; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=152yoztzpbx_bbpxepfackfklg8c1eao6"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003204; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=15hcgek7odccdafzf-9gvibnlgkirj4uo"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003205; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003206; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003207; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=194lqzukzvt-jtdxmihcvhd0yk1sxoybk"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003208; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003209; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003210; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003211; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003212; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003213; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003214; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1cos43rmscrescxk3u40qjuqbwr-pydsn"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003215; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003216; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003217; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003218; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003219; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003220; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003221; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003222; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1jkov2g5s1xkcq4bfb3uvmd6inhadatrg"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003223; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003224; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1kjcylye1dbmhystyyotz-3pagktkhlhq"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003225; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003226; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003227; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003228; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1mwgdd3lxuuk-bnsrm1rpclom0cmx7wob"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003229; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003230; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003231; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1nmf6kty3xsoygjxjhb-bsafvlfy-0lt2"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003232; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003233; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003234; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1p5fvqkxzwoiu_uauzbmrxpklsetculad"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003235; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003236; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003237; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003238; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1q1dwckludrpqijtrpw14_60d5nu7n97t"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003239; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003240; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003241; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003242; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003243; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1sjvkrinuscxqmbkdeusxaezazbiagnv3"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003244; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1so1trfuzt5-giahetghfhmd-_ot3rq35"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003245; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003246; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003247; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003248; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003249; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003250; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003251; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003252; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003253; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003254; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003255; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1yhflwpk3yeyrdhlhanctlind-5j24iwv"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003256; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1yqpuxjbnjokc5fjgt-8xzuybr97rtvg2"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003257; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003258; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003259; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003260; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/1zilg/"; http_uri; nocase; content:"drpamelageorge.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003261; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/qcgfmfvh/"; http_uri; nocase; content:"drpamelageorge.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003262; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/emclick.zip"; http_uri; nocase; content:"e-mudhra.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003263; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/informatica/informatica-actief/hoofdstuk1/extrasoftware/getallen.exe"; http_uri; nocase; content:"evertkok.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100003264; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/informatica/informatica-actief/hoofdstuk2/software/hksetup.exe"; http_uri; nocase; content:"evertkok.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100003265; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/register/phpcaptcha/images/19dnqhg1p/sbhvtqlysxhxn/"; http_uri; nocase; content:"expeditionquest.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003266; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/register/phpcaptcha/images/35egphpl5uzpvdmz9bncmvon3p/"; http_uri; nocase; content:"expeditionquest.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003267; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/x/"; http_uri; nocase; content:"expeditionquest.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003268; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf/"; http_uri; nocase; content:"exxonabnie.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100003269; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf//"; http_uri; nocase; content:"exxonabnie.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100003270; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf///"; http_uri; nocase; content:"exxonabnie.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100003271; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf////"; http_uri; nocase; content:"exxonabnie.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100003272; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/web1/m00/8f/36/o4ybafy-2m2aarfzaahkaiik5pi122.exe"; http_uri; nocase; content:"file.elecfans.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003273; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4cb7cebd101/e5fb4174-ab23-48e8-bf05-e80ec5fa2169.xls"; http_uri; nocase; content:"files.constantcontact.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003274; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ee304de9001/7e533e73-e272-4a44-9d9e-138cab64bf19.docx"; http_uri; nocase; content:"files.constantcontact.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003275; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zibri/19f9838ffd12349bb2c6c3afddc9388f/raw/01977fd3c7e036c3a38f062f626fd189ba1e1aa3/uefivar.exe"; http_uri; nocase; content:"gist.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003276; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cgi-bin/sni8w3fssb44iavmzss2nv0od6eiixlq6/"; http_uri; nocase; content:"hqdecig.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003277; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/suy/"; http_uri; nocase; content:"hsecaravans.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100003278; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/19/items/startup_20210219/startup.txt"; http_uri; nocase; content:"ia801802.us.archive.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003279; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/online-timer-kvhxz/ilxl/"; http_uri; nocase; content:"ie-best.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100003280; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/64.exe"; http_uri; nocase; content:"indonesias.me:9998"; content:"Host"; http_header; classtype:trojan-activity; sid:100003281; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c64.exe"; http_uri; nocase; content:"indonesias.me:9998"; content:"Host"; http_header; classtype:trojan-activity; sid:100003282; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v/bnun9t30zqx9t6z944g7o9z9o2plcrswmwuv9/"; http_uri; nocase; content:"insupportofchildren.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100003283; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebook/cs17.exe"; http_uri; nocase; content:"jcedu.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003284; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eng/wp-content/plugins/featurific-for-wordpress/1"; http_uri; nocase; content:"jointings.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003285; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eng/wp-content/plugins/featurific-for-wordpress/2"; http_uri; nocase; content:"jointings.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003286; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eng/wp-content/plugins/featurific-for-wordpress/3"; http_uri; nocase; content:"jointings.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003287; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/3/2/8/8/3288864/karma_koin_codes.exe"; http_uri; nocase; content:"karmakoincodes.weebly.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003288; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dg/etrac/nf4emwz/"; http_uri; nocase; content:"kotakwarna.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100003289; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/docs/adatgyujtesek/elektra/csv_to_xml.exe"; http_uri; nocase; content:"ksh.hu"; content:"Host"; http_header; classtype:trojan-activity; sid:100003290; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/down/affiliate/kuaizip_setup_10029.exe"; http_uri; nocase; content:"kuaizip.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003291; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/linuxforensicscode.zip"; http_uri; nocase; content:"linuxforensicsbook.com.s3.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003292; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dl8.exe"; http_uri; nocase; content:"lojavirtual.top"; content:"Host"; http_header; classtype:trojan-activity; sid:100003293; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dl8v2.exe"; http_uri; nocase; content:"lojavirtual.top"; content:"Host"; http_header; classtype:trojan-activity; sid:100003294; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ds/1802.gif"; http_uri; nocase; content:"marcostrombetta.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100003295; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k/big5/1giof6/"; http_uri; nocase; content:"minpic.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100003296; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/order+00843112.ace"; http_uri; nocase; content:"miot2.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003297; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shipping+docs(ci%2ccoo%2cbl%2cpl).ace"; http_uri; nocase; content:"miot2.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003298; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-contentbak/t9m/"; http_uri; nocase; content:"morrobaydrugandgift.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003299; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/ws2/:gianni1962/:ie6setup/ie6setup.exe"; http_uri; nocase; content:"my.cloudme.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003300; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/components/aacenc.exe"; http_uri; nocase; content:"nch.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100003301; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/components/doxillionsetup.exe"; http_uri; nocase; content:"nch.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100003302; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/4/1/6/6/4166984/keygen.exe"; http_uri; nocase; content:"newyarlfm.weebly.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003303; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/efficiency-all-iuehb/bjug3jyhuyilwhcqs3ykssaqqw7tpyvmypb91wtzdbluio1ekope5vrbbcx8zhdar9yt/"; http_uri; nocase; content:"nhipcauytevietnhat.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003304; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yws/api/personal/file/web3a243b322cf83ca7cae587a92916bac7?method=download&inline=true&sharekey=649ac0bb5d5b13d15cbf50b2609e193a"; http_uri; nocase; content:"note.youdao.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003305; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/spreadsheets/osv_stock_valuation-sample-dummy.exe"; http_uri; nocase; content:"oldschoolvalue.s3.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003306; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003307; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003308; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003309; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=b4c15a27928f663b!230&authkey=ancu1eabetiubzg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003310; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=b4c15a27928f663b!231&authkey=ai9h3sk_luxran0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003311; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=c127f9e0fb7cbbea!214&authkey=aat73nvghhjdr9g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003312; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?authkey=!aase4ma0-vo_cls&cid=4df11eda676a355f&resid=4df11eda676a355f!140"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003313; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?authkey=!akd6uxvljtlvpxu&cid=4df11eda676a355f&resid=4df11eda676a355f!130"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003314; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?authkey=!aomvnemlpgwfuie&cid=4df11eda676a355f&resid=4df11eda676a355f!135"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003315; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?authkey=adf5p_kn8rjf29y&cid=34224e3e49966a27&resid=34224e3e49966a27%211732"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003316; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=013413cfbbbcfae4&resid=13413cfbbbcfae4%211656&authkey=ai9wpcp_k9okgk4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003317; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c!111&authkey=aemrwamaaaiyyjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003318; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c%21111&authkey=aemrwamaaaiyyjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003319; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0175cdbe2d2944c5&resid=175cdbe2d2944c5%21107&authkey=al6uptubjmmugo0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003320; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!157&authkey=aagcsm7chqez6uu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003321; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!158&authkey=amsoii5nr6pomhc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003322; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21157&authkey=aagcsm7chqez6uu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003323; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21158&authkey=amsoii5nr6pomhc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003324; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211177&authkey=am0i98nwgvzgqvq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003325; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211183&authkey=anv33trmzmi5cko"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003326; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0319bb40eba80dcc&resid=319bb40eba80dcc%21110&authkey=ag8bs48lq9n-piw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003327; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0412fba39d6c52de&resid=412fba39d6c52de%2122008&authkey=amn2bgbswxwgpma"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003328; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=045adcdfe91be4f5&resid=45adcdfe91be4f5%21318&authkey=aa6lutarluhyj48"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003329; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0489c74de4facb30&resid=489c74de4facb30!109&authkey=ajo32arrzl_vwdq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003330; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=062a585e433edce3&resid=62a585e433edce3%211618&authkey=ahzfppat_uettfg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003331; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=087f57dcf1bd61bc&resid=87f57dcf1bd61bc!113&authkey=ap0wsc-rsiegllw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003332; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=09eebe7829f6351d&resid=9eebe7829f6351d%21827&authkey=amysfuvfuc5jezq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003333; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d!184&authkey=ackbiiarirejcam"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003334; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d%21184&authkey=ackbiiarirejcam"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003335; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!273&authkey=ae2m69e5nu3rrea"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003336; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!274&authkey=acqg0akutoxdpgo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003337; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21273&authkey=ae2m69e5nu3rrea"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003338; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21274&authkey=acqg0akutoxdpgo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003339; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0!1667&authkey=an8otd7jzc7xgho"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003340; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0%211667&authkey=an8otd7jzc7xgho"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003341; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0e26b39babdbf63c&resid=e26b39babdbf63c%21137&authkey=anshbgxg1_qa2h4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003342; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242!309&authkey=alfe36drai1zmwc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003343; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242%21309&authkey=alfe36drai1zmwc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003344; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21123&authkey=aco5hiwppfq8vrw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003345; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21124&authkey=ai6sfa2z-kqf6x0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003346; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=125290ca4dc682c9&resid=125290ca4dc682c9%21452&authkey=afdp5rurqhdqa2a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003347; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=13b301f1cb48f8cd&resid=13b301f1cb48f8cd%21106&authkey=aiae3olcs4lulz4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003348; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=14f52af71b98dbc5&resid=14f52af71b98dbc5%212449&authkey=anfs_n5cs1noojo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003349; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003350; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003351; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003352; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003353; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003354; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003355; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!129&authkey=apqoonsrce0ari4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003356; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21126&authkey=ad4yflrisq6d82g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003357; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21129&authkey=apqoonsrce0ari4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003358; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=196e83840ef8c152&resid=196e83840ef8c152%21107&authkey=ah2lhjyd0ukjcve"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003359; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a162e8fcaaef5fa&resid=1a162e8fcaaef5fa%215495&authkey=aic7rmj1cm3rt2w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003360; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!106&authkey=aklmrzgetlbm5wc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003361; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!107&authkey=albnx4ylxil-nog"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003362; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21106&authkey=aklmrzgetlbm5wc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003363; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21107&authkey=albnx4ylxil-nog"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003364; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558!8182&authkey=aautw8tvzxr5v3a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003365; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558%218182&authkey=aautw8tvzxr5v3a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003366; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1cbd82dd55d70086&resid=1cbd82dd55d70086%212526&authkey=aogaboensav3jrg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003367; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1dbdf62bc3c2b05b&resid=1dbdf62bc3c2b05b!134&authkey=ape6bhxn7c89z60"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003368; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003369; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003370; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003371; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003372; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003373; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003374; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f!191&authkey=ajvumpkzpla_nca"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003375; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f%21191&authkey=ajvumpkzpla_nca"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003376; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=26bbd7d5ad88dd29&resid=26bbd7d5ad88dd29%21115&authkey=acipfa3gbiqqcvu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003377; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=26f87316a7e32bb5&resid=26f87316a7e32bb5%21106&authkey=aepqo5hlkxn1t1k"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003378; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2831401bbac0235e&resid=2831401bbac0235e%211037&authkey=aagnkp6l76yhrlo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003379; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003380; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003381; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003382; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003383; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003384; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003385; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21115&authkey=aglznnsx71tbe9e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003386; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37!183&authkey=akon9i9zzhusiuk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003387; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37%21183&authkey=akon9i9zzhusiuk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003388; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!116&authkey=!abwledjhfsqwap4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003389; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!121&authkey=!aa0qbuuss-wb13w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003390; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1!119&authkey=apmakx2cqb9rimu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003391; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21118&authkey=acrl2iiem-zjer8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003392; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21119&authkey=apmakx2cqb9rimu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003393; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2ffaa48ef4bec51a&resid=2ffaa48ef4bec51a%21107&authkey=aiohrvrc3uuo_cw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003394; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3004cdd743a543f5&resid=3004cdd743a543f5%21170&authkey=ao8vz-4rkwuiyn8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003395; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!320&authkey=aooujzuf408dclw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003396; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!321&authkey=almpxnbtsbzauna"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003397; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21320&authkey=aooujzuf408dclw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003398; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21321&authkey=almpxnbtsbzauna"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003399; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3164ddeba70d2263&resid=3164ddeba70d2263%21106&authkey=afkvqrm4zoor8qq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003400; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=31771958ea3373a1&resid=31771958ea3373a1%21108&authkey=aiofxduo9rdb_-o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003401; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1!223&authkey=aajr842bzum0yg8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003402; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1%21223&authkey=aajr842bzum0yg8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003403; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=34207675f7506d94&resid=34207675f7506d94%21137&authkey=angxnhqpe2x5koc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003404; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3447601ab357f8c1&resid=3447601ab357f8c1!114&authkey=aitwerxd-t2cxl0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003405; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003406; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8,standard,n/a,n/a,urlhaus"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003407; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866!107&authkey=af08d9zk1yestqa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003408; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866%21107&authkey=af08d9zk1yestqa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003409; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c!139&authkey=ap4bbakgkikau-a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003410; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c%21139&authkey=ap4bbakgkikau-a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003411; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!152&authkey=am09sv26njxzyn0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003412; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!153&authkey=ajs0jkoeqkqjrze"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003413; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21152&authkey=am09sv26njxzyn0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003414; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21153&authkey=ajs0jkoeqkqjrze"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003415; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3a1715e2cb964f25&resid=3a1715e2cb964f25%213713&authkey=aortxmfnibnoqkk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003416; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0!119&authkey=adkqcwv8_3k86z4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003417; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0%21119&authkey=adkqcwv8_3k86z4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003418; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21432&authkey=aa_npsupyqb2kge"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003419; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21435&authkey=admsjhgpkbtcqzs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003420; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3ee68228c34c236d&resid=3ee68228c34c236d%21129&authkey=apll6hu3-xetzxu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003421; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f!154&authkey=aasj15d0g_p2pog"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003422; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f%21154&authkey=aasj15d0g_p2pog"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003423; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f!134&authkey=aaipzy8nllirlky"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003424; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f%21134&authkey=aaipzy8nllirlky"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003425; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003426; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003427; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003428; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003429; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003430; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003431; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003432; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003433; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13805&authkey=ae-zbfo2uwln_gg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003434; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13806&authkey=aakiq-ymrjjodns"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003435; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113805&authkey=ae-zbfo2uwln_gg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003436; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113806&authkey=aakiq-ymrjjodns"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003437; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4b676ea3ff139b93&resid=4b676ea3ff139b93!133&authkey=amfix63glytflgo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003438; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21127&authkey=ablg20r-aat_ob4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003439; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21131&authkey=akbwlkrrtso_bqm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003440; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4df11eda676a355f&resid=4df11eda676a355f!130&authkey=!akd6uxvljtlvpxu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003441; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b!108&authkey=anbjpqxg-iwr4g8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003442; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003443; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003444; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003445; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003446; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003447; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003448; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21119&authkey=amrs3-3hsvcmtfs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003449; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21158&authkey=aodderdrnvhruts"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003450; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21161&authkey=agdsfxdnre82jjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003451; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21192&authkey=agn2xvrvup-xvtg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003452; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21206&authkey=ai1r52mhtbdnm2y"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003453; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21247&authkey=ae6weny1fa4pday"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003454; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21252&authkey=aphl0oi4r6lrty0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003455; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21257&authkey=afnyvqwcghnyoas"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003456; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21265&authkey=abxqdhlwiurjvve"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003457; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21271&authkey=ae5qwlr5ceeptmy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003458; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21272&authkey=ahrqeoaynibwt14"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003459; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21275&authkey=af_sgsaxsmaxg7i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003460; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21289&authkey=angyngbqixtrjaa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003461; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21293&authkey=acvh08asxosbwfu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003462; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21299&authkey=amicxuotubpok2c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003463; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21306&authkey=ahpivoukyerzcjy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003464; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21314&authkey=aex2uv2-eiofr8q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003465; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21332&authkey=ad0jmjxgbaebvbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003466; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21335&authkey=ah0vupcfbdfa6g4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003467; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21357&authkey=ap8sswuqjjjexho"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003468; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21366&authkey=aoblpmbmx7o_v18"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003469; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21379&authkey=air-bsjj46et47q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003470; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21389&authkey=aduenohuq_rbyhm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003471; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21391&authkey=aa15sw51njbn_na"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003472; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21392&authkey=abp0heeg6ybn0lk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003473; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21393&authkey=aa1pmur8sy8xtwe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003474; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212718&authkey=aie0v1d-cusuabi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003475; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212725&authkey=aanrz9et3bym3lc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003476; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212728&authkey=ahsmbkltfrwgqjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003477; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!395&authkey=alwvub_yhtogjxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003478; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!398&authkey=abaa_tjd7ohh4so"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003479; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!406&authkey=aarnp48wumgu6tq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003480; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!415&authkey=aglzsd6-g0nzj7s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003481; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!420&authkey=akk5droung_ecww"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003482; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!440&authkey=ai7-dpr11wnzyq8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003483; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21395&authkey=alwvub_yhtogjxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003484; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21398&authkey=abaa_tjd7ohh4so"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003485; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21406&authkey=aarnp48wumgu6tq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003486; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21415&authkey=aglzsd6-g0nzj7s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003487; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21420&authkey=akk5droung_ecww"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003488; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21440&authkey=ai7-dpr11wnzyq8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003489; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211121&authkey=al_fmezwfay4za4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003490; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211122&authkey=anz_q5njlanv2mu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003491; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21110&authkey=akars6koxqzdwgi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003492; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21112&authkey=aadare1gec7nzy8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003493; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003494; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8&em=2"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003495; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d%21109&authkey=adriswrtwdpbuc8&em=2"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003496; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=53c5e6b8f6893887&resid=53c5e6b8f6893887!802&authkey=aapuufivkn2zwu8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003497; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!106&authkey=anzlf1ksptbqok8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003498; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!107&authkey=ag4dr58jrjuxfyq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003499; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21106&authkey=anzlf1ksptbqok8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003500; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21107&authkey=ag4dr58jrjuxfyq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003501; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=547b1e4a6b15bf97&resid=547b1e4a6b15bf97%21106&authkey=akgsmzqhemioz8g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003502; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=54f92c3a2f5d8033&resid=54f92c3a2f5d8033%21200&authkey=aofadhhfwlm2gum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003503; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=55381ffd75ef8cda&resid=55381ffd75ef8cda!270&authkey=aev4isgyubiofdi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003504; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613!157&authkey=an55tjzt-9vbjfy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003505; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613%21156&authkey=agiuawekkbxb_4o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003506; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=55c9feaf3907aae5&resid=55c9feaf3907aae5%21208&authkey=adwuyrapfdzkyoa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003507; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950!280&authkey=advq4p3xhfhinq8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003508; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950%21280&authkey=advq4p3xhfhinq8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003509; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5629da828892367d&resid=5629da828892367d!803&authkey=aphjbq-bsg7ohpc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003510; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21383&authkey=adldpuaya7kj1dk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003511; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21384&authkey=alsuxvtsof32vea"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003512; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3599&authkey=am4yicme6lrjpki"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003513; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3604&authkey=al6pb71mtq4jr1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003514; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213599&authkey=am4yicme6lrjpki"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003515; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213604&authkey=al6pb71mtq4jr1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003516; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b!68197&authkey=aowpm7ocl_21-oc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003517; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b%2168197&authkey=aowpm7ocl_21-oc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003518; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=59389d626d829e8c&resid=59389d626d829e8c%212940&authkey=anx1ngd27vqeiwo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003519; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211568&authkey=aemrnwoi75oflva"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003520; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211572&authkey=aelz-gxlrxcwtnc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003521; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211573&authkey=ahksfdvda0doles"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003522; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5c5404bd403dbdc9&resid=5c5404bd403dbdc9!4464&authkey=ajskjf2hshbudeg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003523; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!406&authkey=aeyeq5j9zfepgai"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003524; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!407&authkey=adnh8af-rvoxlcc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003525; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21406&authkey=aeyeq5j9zfepgai"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003526; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21407&authkey=adnh8af-rvoxlcc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003527; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21892&authkey=apwphufzjdtsedw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003528; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21897&authkey=aomt6el1av5ruc8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003529; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21121&authkey=adjzlorvgx_ezhq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003530; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21123&authkey=ancfnepawtbmnug"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003531; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21124&authkey=ao7bknnuodxtfua"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003532; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003533; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003534; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003535; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003536; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003537; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003538; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003539; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003540; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003541; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003542; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2!517&authkey=akfewcyiwlwomyk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003543; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21505&authkey=ag7xi3lcnvi_hji"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003544; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21517&authkey=akfewcyiwlwomyk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003545; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad!1421&authkey=adixg2-asekemjw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003546; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad%211421&authkey=adixg2-asekemjw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003547; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213096&authkey=aob-cm9vv6erxqg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003548; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213097&authkey=abcuevfyu6pdw70"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003549; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=69b503a3f081a183&resid=69b503a3f081a183%21111&authkey=aazm9wlg1rvgzoc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003550; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!112&authkey=aasndgbcwol3mys"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003551; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!113&authkey=ak3tzu1lg4uuh5m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003552; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21112&authkey=aasndgbcwol3mys"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003553; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21113&authkey=ak3tzu1lg4uuh5m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003554; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21108&authkey=ameouv2jdxo5obw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003555; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21119&authkey=aazzzrl7mv2xbwq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003556; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a7b40a2bc530c6c&resid=6a7b40a2bc530c6c%21112&authkey=afuov36rbymlvxm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003557; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3!118&authkey=aepf8f3mfmlsng0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003558; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3%21118&authkey=aepf8f3mfmlsng0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003559; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b61e983f930f79f&resid=6b61e983f930f79f!540&authkey=ap2n5w41ifew0i8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003560; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7!1154&authkey=acnbdscb8-rbmcu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003561; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7%211154&authkey=acnbdscb8-rbmcu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003562; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21106&authkey=apvhok6edhtogfu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003563; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21115&authkey=amc_k1nnlywdc4i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003564; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=724b5c509337556e&resid=724b5c509337556e%21908&authkey=agcbb3nakpteyam"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003565; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7285f51e65036769&resid=7285f51e65036769%21264&authkey=akyjvrz006qlble"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003566; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21243&authkey=apivjmxivosek60"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003567; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21256&authkey=adljht0ogfq775k"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003568; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21260&authkey=aig6cydr4_e-qj8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003569; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21262&authkey=ak4fiz1-a1ks8rg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003570; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21264&authkey=aizkjymvlgqwpte"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003571; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!106&authkey=ahu5s4ttjvxbnxo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003572; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!107&authkey=abj3eccentbeaqa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003573; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!108&authkey=amvcygo4prlgt4i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003574; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!110&authkey=ahzuehvk5nvzo90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003575; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21106&authkey=ahu5s4ttjvxbnxo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003576; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21107&authkey=abj3eccentbeaqa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003577; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21108&authkey=amvcygo4prlgt4i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003578; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21110&authkey=ahzuehvk5nvzo90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003579; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=77518d098ad4dfb0&resid=77518d098ad4dfb0%21939&authkey=akzqobxxxn89z34"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003580; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21111&authkey=aggnhgqj6uhxm2w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003581; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21112&authkey=abser1xtkpb3-ta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003582; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21117&authkey=aivf1ddcvvu22em"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003583; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!119&authkey=aozjai26izprqto"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003584; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!120&authkey=ajj7ueqjvobgfum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003585; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21119&authkey=aozjai26izprqto"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003586; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21120&authkey=ajj7ueqjvobgfum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003587; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c1fc7da38ab958e&resid=7c1fc7da38ab958e!146&authkey=aktmjqz8n4s_sbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003588; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5295&authkey=aasceqj1mdodeuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003589; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5296&authkey=ank3vz5syaf6bny"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003590; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5298&authkey=albzyizuqczfv9s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003591; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215295&authkey=aasceqj1mdodeuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003592; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215296&authkey=ank3vz5syaf6bny"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003593; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215298&authkey=albzyizuqczfv9s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003594; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7d109f249b512466&resid=7d109f249b512466!543&authkey=acqc4xjghclmwbs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003595; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7e81645429ac5a22&resid=7e81645429ac5a22%21105&authkey=aa691jwf5wqi80c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003596; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7fed4fbea32e3c1e&resid=7fed4fbea32e3c1e%21107&authkey=aeoxfycpolifch0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003597; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=806bac90dc071edf&resid=806bac90dc071edf!105&authkey=!ao7jyz6-licb8hq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003598; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=81c2d8b116274e17&resid=81c2d8b116274e17%21107&authkey=aaqw-t4dx2sbvda"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003599; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=82977114b1af209d&resid=82977114b1af209d!220&authkey=abuin5vdedjughm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003600; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=855b20b0e8399717&resid=855b20b0e8399717%21110&authkey=afhxx21ztsd7hbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003601; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=860a0980486c93fa&resid=860a0980486c93fa!303&authkey=!agcmlab4r6syfvk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003602; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21164&authkey=agbeiinncf8ok_4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003603; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21165&authkey=aiof8rdvxglnm-c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003604; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4!2402&authkey=amigiam45mt6jia"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003605; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4%212402&authkey=amigiam45mt6jia"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003606; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003607; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003608; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003609; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003610; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003611; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003612; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25!130&authkey=ais_g9dqoddonsc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003613; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21106&authkey=ahfgxp0p6nk0eby"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003614; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21109&authkey=akr1n3qxtmnttuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003615; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21113&authkey=ajpvf1h89sqstti"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003616; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!112&authkey=af43qpcgl0t2f5o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003617; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!113&authkey=ag92_wxfvrsuix8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003618; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21112&authkey=af43qpcgl0t2f5o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003619; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21113&authkey=ag92_wxfvrsuix8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003620; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21105&authkey=ah9x7rn0p03kd_m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003621; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21110&authkey=ammswulpdsjeu4w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003622; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3!107&authkey=ac-m9dlvo5l7wfk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003623; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3%21107&authkey=ac-m9dlvo5l7wfk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003624; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=96a54b19ff5f6bab&resid=96a54b19ff5f6bab%21107&authkey=anxv07ez7s5sh_k"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003625; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003626; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003627; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003628; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935!778&authkey=aaezyk4ypt-elma"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003629; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21772&authkey=akeozmv0aafqlbg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003630; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21774&authkey=aly_m3fnrvh6dfq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003631; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21775&authkey=abblpjxi4mwomgs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003632; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21777&authkey=ahmuwqi4jg8rvho"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003633; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003634; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003635; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003636; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211953&authkey=abdfqiyruwplpo0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003637; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211954&authkey=aok-srkhxjazccy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003638; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21172&authkey=ahharhcv0fmn5fm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003639; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21173&authkey=aecb3qcquacvzhi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003640; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21174&authkey=afv7cprqwxezgsi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003641; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21177&authkey=als6_be40lt5jk8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003642; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2!113&authkey=akeqdnxllfzf8hq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003643; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2%21113&authkey=akeqdnxllfzf8hq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003644; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9fb622acb27482ef&resid=9fb622acb27482ef%211197&authkey=aeacibxy2zlyxro"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003645; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9fba865c1fdce17f&resid=9fba865c1fdce17f%211109&authkey=achpeiyvsphyn9o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003646; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a023fe2d1ac611f2&resid=a023fe2d1ac611f2!514&authkey=alaxh02uycquui4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003647; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a04a98741fafee2b&resid=a04a98741fafee2b%211857&authkey=af3qhnjtfnffevi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003648; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340!997&authkey=akw6btyej2zht08"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003649; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340%21997&authkey=akw6btyej2zht08"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003650; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a1c8c8055848b889&resid=a1c8c8055848b889!111&authkey=agzlftsgr4lspvo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003651; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a2cd2cdb93584d7e&resid=a2cd2cdb93584d7e%21106&authkey=aeifpqbwo1s3dyq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003652; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e!108&authkey=amcjnb2j1bd4tyu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003653; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21107&authkey=ab9lanzt1aj_0ws"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003654; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21108&authkey=amcjnb2j1bd4tyu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003655; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21109&authkey=afhg_ay2_zz0kkg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003656; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211064&authkey=apebndb6tstxywi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003657; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211065&authkey=aca4_dggi5gbbfs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003658; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211067&authkey=ae-3ej9zzj4ibhw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003659; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211069&authkey=agx6b8qjt_clm-o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003660; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a502994ea313f5c7&resid=a502994ea313f5c7%21215&authkey=aiydvejv0l8stbs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003661; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114!256&authkey=aapnly5qifymcvw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003662; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21251&authkey=ainluv1ppu-8ogu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003663; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21256&authkey=aapnly5qifymcvw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003664; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21!6053&authkey=agfh0ahstj7rrki"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003665; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21%216053&authkey=agfh0ahstj7rrki"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003666; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003667; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21414&authkey=akf9uwwkitvhrvc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003668; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21415&authkey=ag_5kthuezprnoy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003669; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21416&authkey=airlma-pycgfkyc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003670; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21419&authkey=ab1-sgyv2gibyey"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003671; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21422&authkey=acphsmdy415izjg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003672; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21424&authkey=afvfwz5uvde1pui"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003673; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818!129&authkey=aesewk3cf5vbrxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003674; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818%21129&authkey=aesewk3cf5vbrxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003675; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=aa4e252db942faec&resid=aa4e252db942faec%21168&authkey=anlnjo7xnwtswuk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003676; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003677; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992!113&authkey=agh9q_zzyjjcspc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003678; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992%21113&authkey=agh9q_zzyjjcspc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003679; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=af84ebf13dd5499c&resid=af84ebf13dd5499c!167&authkey=anqr_yvn_hdh2_e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003680; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308!2152&authkey=abutaac83l5utks"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003681; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308%212152&authkey=abutaac83l5utks"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003682; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21650&authkey=aht-wbxsofyx33u"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003683; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21651&authkey=aebbyk6sevdmzgm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003684; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21652&authkey=afsw5wahxo5kwjy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003685; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b1c3a5ef115e135c&resid=b1c3a5ef115e135c%216219&authkey=ahr7bklirbub0pc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003686; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21120&authkey=aozmspl2dqkgkgy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003687; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21123&authkey=aj18p0rtfbtwa84"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003688; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21139&authkey=ahwfjvw4zmjukeo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003689; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21140&authkey=aksvfpmrfqrrggw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003690; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21141&authkey=acznh6clby0qyww"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003691; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21142&authkey=ajf7j1rr3d7jcxy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003692; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21143&authkey=ahs21wnsqb_vu9w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003693; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b50c4248502103d0&resid=b50c4248502103d0%21107&authkey=alf1nley7ja4dbq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003694; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6!164&authkey=adfsfcdaw3biboy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003695; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6%21164&authkey=adfsfcdaw3biboy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003696; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b7cb31db66675eb4&resid=b7cb31db66675eb4%21922&authkey=aghayyucvwey7lg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003697; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b86046e8cbd4254b&resid=b86046e8cbd4254b%21115&authkey=agwstptwpaquleg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003698; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b!7521&authkey=ablt9zdyq2d4rb0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003699; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003700; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003701; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003702; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003703; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003704; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003705; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b%21246&authkey=afyrchdutalpu90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003706; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=bf83d9247c2329e0&resid=bf83d9247c2329e0%211108&authkey=absaw-bpqrc6mpq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003707; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003708; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003709; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003710; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003711; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003712; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003713; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1338&authkey=ajngambosws75_c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003714; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1340&authkey=al1ay3fbtude6d8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003715; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1342&authkey=acpr_htn2jtaxfu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003716; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1343&authkey=abodysrxu9l2xxu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003717; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1344&authkey=aozerppd6mnokwy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003718; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1345&authkey=aevvyhonxhtcdh0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003719; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1346&authkey=achrnf5vlov1gf4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003720; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1347&authkey=al-zge-ttvr921s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003721; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211337&authkey=afnvu1fsuczht5e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003722; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211338&authkey=ajngambosws75_c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003723; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211340&authkey=al1ay3fbtude6d8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003724; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211342&authkey=acpr_htn2jtaxfu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003725; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211343&authkey=abodysrxu9l2xxu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003726; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211344&authkey=aozerppd6mnokwy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003727; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211345&authkey=aevvyhonxhtcdh0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003728; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211346&authkey=achrnf5vlov1gf4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003729; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211347&authkey=al-zge-ttvr921s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003730; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c701663053a57d59&resid=c701663053a57d59%211009&authkey=ahowgkak7j0p2q8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003731; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21486&authkey=amy4euf_rrlcykc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003732; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21489&authkey=ako3anwfnqfohnc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003733; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c80630c4d385fb9d&resid=c80630c4d385fb9d%21286&authkey=amgaucv8bld_5qs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003734; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21546&authkey=aa6q-ryiifnet5m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003735; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21547&authkey=aipm8qnwbgo4yga"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003736; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!355&authkey=aajjwf_sm4xdqdk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003737; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!357&authkey=alw3vqqxz6myrle"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003738; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!362&authkey=alycl9izrvfl7oc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003739; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21354&authkey=aa_ukeour7rex1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003740; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21355&authkey=aajjwf_sm4xdqdk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003741; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21357&authkey=alw3vqqxz6myrle"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003742; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21362&authkey=alycl9izrvfl7oc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003743; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca897bdd16fc7940&resid=ca897bdd16fc7940%21106&authkey=aniklpt8vtlahbg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003744; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2!109&authkey=ac4gxwjoopafr9a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003745; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2%21109&authkey=ac4gxwjoopafr9a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003746; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cbb66cac420484bc&resid=cbb66cac420484bc!10968&authkey=aj9bjkobu-rlnaw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003747; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c!44331&authkey=afohia-wo-alwiy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003748; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c%2144331&authkey=afohia-wo-alwiy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003749; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!742&authkey=akbxju17f8g0r2s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003750; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!744&authkey=adak4zftd0yhhhs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003751; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21742&authkey=akbxju17f8g0r2s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003752; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21744&authkey=adak4zftd0yhhhs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003753; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!872&authkey=ap9hchztywo8zuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003754; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!874&authkey=alkzcbxz-dscgum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003755; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!875&authkey=aka55ybdhqnoc6c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003756; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21872&authkey=ap9hchztywo8zuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003757; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21874&authkey=alkzcbxz-dscgum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003758; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21875&authkey=aka55ybdhqnoc6c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003759; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!499&authkey=adegfbfx54fy3qu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003760; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!510&authkey=aamxlkp3spxmvxc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003761; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb%21510&authkey=aamxlkp3spxmvxc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003762; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d2f3748954f6f8a8&resid=d2f3748954f6f8a8%21119&authkey=aex5s9uoun2zps0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003763; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d4d413b6e7cf7088&resid=d4d413b6e7cf7088%211271&authkey=akz65bxpgvdxjb8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003764; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!191&authkey=ajl2uegqunsgc3q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003765; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!192&authkey=acd_hx4bka3z0nw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003766; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003767; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003768; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003769; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!141&authkey=alya4infudqs53o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003770; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!142&authkey=aiemnxi-s-5vrz0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003771; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21141&authkey=alya4infudqs53o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003772; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003773; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0&c=3ii9gcd&r=5onulz3wldybwlmup37su3&k=7s1&s=kzymn52eroemh1tamvmlsfsn9jtvwguukky5hlxcfgw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003774; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003775; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003776; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003777; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dcd65237fcd1a1a9&resid=dcd65237fcd1a1a9%21162&authkey=aprqs0hugnfo6uq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003778; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7527&authkey=aipybipwht56um8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003779; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7530&authkey=am9p2ic6zdkgfmy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003780; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7532&authkey=aonjnubquvon_uk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003781; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217527&authkey=aipybipwht56um8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003782; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217530&authkey=am9p2ic6zdkgfmy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003783; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217532&authkey=aonjnubquvon_uk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003784; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2!1818&authkey=anh2wga7qmhbmuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003785; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2%211818&authkey=anh2wga7qmhbmuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003786; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21107&authkey=akrabrcroiddkxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003787; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21115&authkey=ad1ncwtj_zcjsh0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003788; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21132&authkey=akpbxohbtjebyn4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003789; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21150&authkey=aevazjbqnu7cmjs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003790; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21160&authkey=aiendf-9lyln0x0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003791; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e1065ab3e86a5fc2&resid=e1065ab3e86a5fc2%211443&authkey=apybkcvf4iwxp_q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003792; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2!107&authkey=af-bicrg1c6vgck"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003793; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2%21107&authkey=af-bicrg1c6vgck"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003794; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2!129&authkey=afk5vdt49soo3co"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003795; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2%21129&authkey=afk5vdt49soo3co"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003796; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e3ddc3980f743711&resid=e3ddc3980f743711%21795&authkey=aptivsvyk2we5xc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003797; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21745&authkey=ah1i_jo73zgdxpc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003798; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21746&authkey=ag1mhwlznwdxpw0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003799; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e43694f4bd6f68d1&resid=e43694f4bd6f68d1!563&authkey=aj8ovsob9ll6r-c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003800; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!509&authkey=akmdyqkzcsuf_gg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003801; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!511&authkey=agfs0q7dz7os1lu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003802; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c%21511&authkey=agfs0q7dz7os1lu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003803; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e54ea4e0368d023b&resid=e54ea4e0368d023b%21106&authkey=aozas6g9pm0fzvq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003804; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003805; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003806; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003807; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003808; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003809; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003810; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!148&authkey=agjcwq650c8wdbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003811; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!150&authkey=ami5aqoinvosjle"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003812; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21148&authkey=agjcwq650c8wdbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003813; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21150&authkey=ami5aqoinvosjle"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003814; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e97110434470423e&resid=e97110434470423e%21113&authkey=afowclex54if0g0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003815; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33!1192&authkey=apnhep6fmmxxdkw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003816; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33%211192&authkey=apnhep6fmmxxdkw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003817; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211215&authkey=ac1jr_bieufz0ai"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003818; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211219&authkey=akgo75rmvr4khlc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003819; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ebacca5dec27fd20&resid=ebacca5dec27fd20%2118735&authkey=ajfyl1mzidnylc8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003820; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21113&authkey=aovavpmokd2jrns"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003821; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21116&authkey=aadnj5xyfasugu8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003822; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003823; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003824; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!204&authkey=ad0nbzlscbg-0sa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003825; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21202&authkey=ah1gjq8j29darw4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003826; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21203&authkey=af8xr99mrqp8um8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003827; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21204&authkey=ad0nbzlscbg-0sa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003828; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21489&authkey=ads_gff3tjkd0w0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003829; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21490&authkey=aj_rld7xooge6aw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003830; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21492&authkey=ahdb75ptd1_uc8e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003831; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f06038a5f7dbd6d6&resid=f06038a5f7dbd6d6%215498&authkey=aiozi3z5qzdysmu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003832; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f293cebb54e5ea71&resid=f293cebb54e5ea71%21293&authkey=aha74rsqiuewnpq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003833; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21566&authkey=aevafh7rydhi19k"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003834; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21581&authkey=agx0b8ho87w4uie"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003835; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21582&authkey=af-9_xwysl1o7-c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003836; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21598&authkey=ah-gkc-b7fa8h-g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003837; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21599&authkey=aajunhe1ex_-zta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003838; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f79e41c0e32d3314&resid=f79e41c0e32d3314%211182&authkey=aiqtptberyvlgqk&em=2%22"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003839; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806!1368&authkey=anphh1fijhvzv6c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003840; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806%211368&authkey=anphh1fijhvzv6c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003841; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382!159&authkey=ai4_8srrzf48hw0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003842; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382%21159&authkey=ai4_8srrzf48hw0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003843; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fb2177c192eed796&resid=fb2177c192eed796%21124&authkey=abotnmdhu_tg7bc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003844; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fd50774e5ce0e314&resid=fd50774e5ce0e314%21778&authkey=aoxb2vhhz3qodiu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003845; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fd67fafc46d3c687&resid=fd67fafc46d3c687%21473&authkey=aoid_cp-jgffqvm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003846; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!847&authkey=aemnhwbhlskovgm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003847; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!848&authkey=ag1_e421v-t5r9w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003848; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21847&authkey=aemnhwbhlskovgm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003849; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21848&authkey=ag1_e421v-t5r9w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003850; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fe85161c3947f2c1&resid=fe85161c3947f2c1%211441&authkey=agb6c1ecr91svrw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003851; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!693&authkey=agcpkhnewfte_yc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003852; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!694&authkey=aa5jqzjsp0esr1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003853; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21693&authkey=agcpkhnewfte_yc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003854; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21694&authkey=aa5jqzjsp0esr1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003855; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!330&authkey=adxnzkb0a09pizw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003856; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!334&authkey=agsvox_t7qim4ta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003857; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!335&authkey=ach14e6omcghwgg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003858; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21330&authkey=adxnzkb0a09pizw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003859; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21333&authkey=aielwtaiuvcttlm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003860; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21334&authkey=agsvox_t7qim4ta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003861; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/raw/77jhk0iw"; http_uri; nocase; content:"pastebin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003862; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/raw/89hkc7wb"; http_uri; nocase; content:"pastebin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003863; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/raw/yqvsvlvq"; http_uri; nocase; content:"pastebin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003864; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/llc/mwcacs65xienqdp/"; http_uri; nocase; content:"pierreconsulting.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100003865; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/uploads/2020/10/skoda22.jpg"; http_uri; nocase; content:"procrossover.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003866; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/uploads/2020/10/skodaqq.jpg"; http_uri; nocase; content:"procrossover.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003867; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/zzcoiatsr5wujrwagsgbnm2wkjxldvgu/"; http_uri; nocase; content:"qjbutterflyevents.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100003868; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhlshipmentawb80326979402.ace"; http_uri; nocase; content:"quen.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003869; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maersk-bl+draft-copy-shipping-documents.ace"; http_uri; nocase; content:"quen.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003870; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/po+for+april+shipment.ace"; http_uri; nocase; content:"quen.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003871; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/arntsonl/calc_security_poc/master/dll/calc.dll"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003872; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bero1985/berotinypascal/e34bd4164f4b7c27e7cf667dffd9274d33d6dfbe/bin/btpc.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003873; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evil-coder66/defendercontrol/main/defendercontrol.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003874; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuzzbunch/fuzzbunch/master/payloads/doublepulsar-1.3.1.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003875; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inquisb/shellcodeexec/master/windows/shellcodeexec.x32.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003876; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/malwares/webshell/master/ajax_php%20command%20shell.rar"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003877; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/myqseeaccount/one/main/one.htm"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003878; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/realtek25556/rhti2/gh-pages/90hfnvo69vk2ot.bmp"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003879; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secwiki/windows-kernel-exploits/master/ms15-076/binary/trebuchet.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003880; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secwiki/windows-kernel-exploits/master/ms16-098/bfill.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003881; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tennc/webshell/master/other/small_shell.txt"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003882; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/player/launch/2017/09/12/da5f9a1c23034353852750488feeaf36.exe"; http_uri; nocase; content:"res.yeshen.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003883; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pro/dl/q05z91"; http_uri; nocase; content:"sendspace.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003884; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ey4lpx8rx.zip"; http_uri; nocase; content:"shribharatvatika.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003885; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/stormqk/dn/stormagent.apk?attredirects=0"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003886; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6ca94027662tilxa4p/base.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003887; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6cbd811626fvoj29vw/base64.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003888; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6cd19c87f44r9fomit/base64jef.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003889; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6e2cbda22efxk3t7x2/base64.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003890; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6e2f6c8c5adup2yiwx/basejefin.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003891; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6eab37b8dadmy1gx7c/base3.5.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003892; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6eb2aa215a8cvwcf6s/fudjs.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003893; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6fd6b4eb1c08aamus8/go.jpeg"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003894; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c7921a2cf26cunjcgvm/nanocoregomes.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003895; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c9e24cc08a4dlmv7cjo/cdt.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003896; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a-nurse-ss8d9/z/"; http_uri; nocase; content:"technologydistilled.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003897; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/23.exe"; http_uri; nocase; content:"tsrv4.ws"; content:"Host"; http_header; classtype:trojan-activity; sid:100003898; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/crisanar/defis/jek_crackme1.7.zip"; http_uri; nocase; content:"users.skynet.be"; content:"Host"; http_header; classtype:trojan-activity; sid:100003899; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gnuboard/data/scan/amowvegfrt9ja/"; http_uri; nocase; content:"vniel.co.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100003900; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gnuboard/data/scan/fu6jvxzzs46uqlp7l/"; http_uri; nocase; content:"vniel.co.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100003901; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kolya/.f/root/net.mit.edu/net/user/chris/winnt/mit_agenda2a.doc"; http_uri; nocase; content:"web.mit.edu"; content:"Host"; http_header; classtype:trojan-activity; sid:100003902; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kolya/.f/root/net.mit.edu/sipb/user/kolya/afs/root.afs/net/user/chris/winnt/mit_agenda2a.doc"; http_uri; nocase; content:"web.mit.edu"; content:"Host"; http_header; classtype:trojan-activity; sid:100003903; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/136_140/flt_shovemydiscoupyourarse.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003904; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/136_140/kb%5efr_ouverture.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003905; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/136_140/kb^fr_ouverture.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003906; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/146_150/bc_memories_from_the_mcp.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003907; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/151_155/tidex_-_short_stuff.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003908; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/syria-files/attach/222/222051_instruction.zip"; http_uri; nocase; content:"wikileaks.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003909; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/common/yz.vbs"; http_uri; nocase; content:"yp.hnggzyjy.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100003910; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wp.readhere.in"; content:"Host"; http_header; classtype:trojan-activity; sid:100003073; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpdemo.101clients.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100003074; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"writtendeer.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003075; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ws5588.f3322.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100003076; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsdyalgreenkelveskxz.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100003077; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsdykungsb2talenwsjf.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100003078; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsdyrkkrgorgiousejhd.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100003079; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsdysara1investvwsfs.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100003080; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsdysuresbonescagegp.dns.army"; content:"Host"; http_header; classtype:trojan-activity; sid:100003081; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyklej.pl"; content:"Host"; http_header; classtype:trojan-activity; sid:100003082; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"x2vn.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003083; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xia.beihaixue.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003084; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xixaoclothing.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003085; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xk.996is.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003086; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--80akinnkiib6h.xn--90ais"; content:"Host"; http_header; classtype:trojan-activity; sid:100003087; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--polimerbizmimarlk-rvc.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003088; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybom.urbanolab.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003089; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeichner.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003090; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylfpremium.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003091; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoast.yourpageserver.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003092; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"youtubetrainingacademy.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003093; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yskadvisors.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003094; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yummyyogaudaipur.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003095; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzkzixun.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003096; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmedcoach.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003097; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"zytrox.tk"; content:"Host"; http_header; classtype:trojan-activity; sid:100003098; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"zz.690tx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003099; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/64.exe"; http_uri; nocase; content:"2.indexsinas.me:811"; content:"Host"; http_header; classtype:trojan-activity; sid:100003100; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/86.exe"; http_uri; nocase; content:"2.indexsinas.me:811"; content:"Host"; http_header; classtype:trojan-activity; sid:100003101; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c64.exe"; http_uri; nocase; content:"2.indexsinas.me:811"; content:"Host"; http_header; classtype:trojan-activity; sid:100003102; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/8/1/2/9/81294208/growtopiastaff_setup1.61.exe"; http_uri; nocase; content:"amumufree.weebly.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003103; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/files/proxyi.exe"; http_uri; nocase; content:"analogx.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003104; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/abernathyjorge711/y6788/downloads/bubblebrowserext1.0.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003105; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dvdfv/anjj/downloads/jami.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003106; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/heyhoeee/heyhoename1/downloads/1234.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003107; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jpavelski/chpock/downloads/4.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003108; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jpavelski/chpock/downloads/6.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003109; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/labesoftware/update/downloads/boost-fps.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003110; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/labesoftware/update/downloads/install_plugin_x64_x86.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003111; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/labesoftware/update/downloads/vpn_free.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003112; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/1.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003113; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/2.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003114; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/3.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003115; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/clr.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003116; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/dianthus.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003117; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/n.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003118; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/newred.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003119; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/omar.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003120; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/serv.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003121; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/test.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003122; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/updachrome.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003123; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/updatedata.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003124; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/updatev.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003125; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/work.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003126; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mminminminmin05/testtest/downloads/ya.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003127; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/player2012/rumpa1/downloads/component.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003128; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/player2012/rumpa1/downloads/nordvpnsetup.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003129; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/player2012/rumpa1/downloads/regsvc.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003130; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/skygaming/updates/downloads/update.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003131; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/001.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003132; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/1488.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003133; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/1_cr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003134; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/1cr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003135; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/1fc2d.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003136; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/26a5.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003137; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/6e7_2021-01-19_18-04.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003138; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/abjects.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003139; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/attached.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003140; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/b7f2c.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003141; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/battletext.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003142; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/bkghj_nowin.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003143; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/bsdasdasd333.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003144; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/build.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003145; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/build_makros.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003146; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/build_silent.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003147; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/build_sup.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003148; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/buildcmobiler.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003149; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/buildcmobiler.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003150; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/buildcr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003151; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/buildss.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003152; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/clientnik.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003153; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/clientrevers.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003154; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/dcrat.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003155; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/dllservices.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003156; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/dllservices2.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003157; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/exe_morris.mcdermott.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003158; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/hans.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003159; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/hulu.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003160; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/intelfive.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003161; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/intelfour.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003162; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/intelone.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003163; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/intelthree.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003164; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/inteltwo.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003165; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/jjuufksfn.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003166; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/kleiman.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003167; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/lucky_fixed.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003168; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/notepadplus.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003169; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/osiris_qqkz_nauto.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003170; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/out.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003171; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/out.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003172; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/pacbe_bin.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003173; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/putty.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003174; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/rockethcd.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003175; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/scvhost900.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003176; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/sessionwin.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003177; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/siliculose.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003178; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/statemobi.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003179; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/stealers.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003180; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/stealers2.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003181; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/stgedo.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003182; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/svcperf.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003183; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/symptomaticshon5.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003184; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/taurjok.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003185; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/taurusbabac.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003186; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/telekiller.exe"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003187; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/updateanddr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003188; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/updateandr.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003189; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/vhajeja.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003190; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/word.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003191; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/www.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003192; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tanake5518/fi/downloads/xlsd.txt"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003193; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/teaserex/tease/downloads/b_kfmhkk172.bin"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003194; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/teaserex/tease/downloads/macro_xmprohiq27.bin"; http_uri; nocase; content:"bitbucket.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003195; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hmatrix/data/hack1226.exe"; http_uri; nocase; content:"cd.textfiles.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003196; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/775238059083038744/821062129347067924/wxhyhyciuesjdefkxcqddvfbjqrofjq"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003197; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/816070119281131570/816070273254162442/all.txt"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003198; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/825372018244583454/826848185246023750/loaddd.exe"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003199; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/825372018244583454/826848348342059008/zeppelin.exe"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003200; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/825372018244583454/826848405258633277/build.exe"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003201; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/826198252025675816/826537386485612574/china.png"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003202; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/826376903400751108/826431600383361065/remcmcmcm_mjvbsmlrc45.bin"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003203; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe"; http_uri; nocase; content:"cdn.discordapp.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003204; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/razor/rzr-winner_intro.zip"; http_uri; nocase; content:"chiptune.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003205; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/ws2/:suengpen/:buyerlist.js/buyerlist.js.xz"; http_uri; nocase; content:"cloudme.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003206; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/ws2/:suengpen/:buyerlist1/buyerlist1.rar"; http_uri; nocase; content:"cloudme.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003207; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meteoradminz/hidden-tear/zip/master"; http_uri; nocase; content:"codeload.github.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003208; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tmp/protected-cek9qz4zvk2n65e-c5d84gi5/security-cloud/kypqw-52kkq0n9ywj9oa/"; http_uri; nocase; content:"colfincas.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003209; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003210; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003211; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/frm0reseen/prntscrnofamzorderid.jpg.exe"; http_uri; nocase; content:"drive.google.com.it-barcelona.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003212; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003213; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003214; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003215; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003216; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003217; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003218; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003219; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003220; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003221; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003222; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003223; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003224; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003225; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003226; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003227; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003228; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003229; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003230; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003231; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003232; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003233; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003234; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003235; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003236; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003237; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003238; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003239; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003240; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003241; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003242; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003243; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003244; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003245; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003246; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003247; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003248; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003249; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003250; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003251; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003252; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003253; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003254; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003255; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003256; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003257; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003258; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003259; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003260; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003261; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003262; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003263; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003264; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/1zilg/"; http_uri; nocase; content:"drpamelageorge.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003265; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/qcgfmfvh/"; http_uri; nocase; content:"drpamelageorge.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003266; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/emclick.zip"; http_uri; nocase; content:"e-mudhra.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003267; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/informatica/informatica-actief/hoofdstuk1/extrasoftware/getallen.exe"; http_uri; nocase; content:"evertkok.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100003268; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/informatica/informatica-actief/hoofdstuk2/software/hksetup.exe"; http_uri; nocase; content:"evertkok.nl"; content:"Host"; http_header; classtype:trojan-activity; sid:100003269; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/register/phpcaptcha/images/19dnqhg1p/sbhvtqlysxhxn/"; http_uri; nocase; content:"expeditionquest.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003270; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/register/phpcaptcha/images/35egphpl5uzpvdmz9bncmvon3p/"; http_uri; nocase; content:"expeditionquest.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003271; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/x/"; http_uri; nocase; content:"expeditionquest.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003272; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf/"; http_uri; nocase; content:"exxonabnie.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100003273; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf//"; http_uri; nocase; content:"exxonabnie.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100003274; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf///"; http_uri; nocase; content:"exxonabnie.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100003275; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf////"; http_uri; nocase; content:"exxonabnie.ir"; content:"Host"; http_header; classtype:trojan-activity; sid:100003276; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/web1/m00/8f/36/o4ybafy-2m2aarfzaahkaiik5pi122.exe"; http_uri; nocase; content:"file.elecfans.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003277; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4cb7cebd101/e5fb4174-ab23-48e8-bf05-e80ec5fa2169.xls"; http_uri; nocase; content:"files.constantcontact.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003278; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ee304de9001/7e533e73-e272-4a44-9d9e-138cab64bf19.docx"; http_uri; nocase; content:"files.constantcontact.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003279; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zibri/19f9838ffd12349bb2c6c3afddc9388f/raw/01977fd3c7e036c3a38f062f626fd189ba1e1aa3/uefivar.exe"; http_uri; nocase; content:"gist.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003280; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cgi-bin/sni8w3fssb44iavmzss2nv0od6eiixlq6/"; http_uri; nocase; content:"hqdecig.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003281; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/suy/"; http_uri; nocase; content:"hsecaravans.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100003282; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/19/items/startup_20210219/startup.txt"; http_uri; nocase; content:"ia801802.us.archive.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003283; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/online-timer-kvhxz/ilxl/"; http_uri; nocase; content:"ie-best.net"; content:"Host"; http_header; classtype:trojan-activity; sid:100003284; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/64.exe"; http_uri; nocase; content:"indonesias.me:9998"; content:"Host"; http_header; classtype:trojan-activity; sid:100003285; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c64.exe"; http_uri; nocase; content:"indonesias.me:9998"; content:"Host"; http_header; classtype:trojan-activity; sid:100003286; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v/bnun9t30zqx9t6z944g7o9z9o2plcrswmwuv9/"; http_uri; nocase; content:"insupportofchildren.co.uk"; content:"Host"; http_header; classtype:trojan-activity; sid:100003287; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebook/cs17.exe"; http_uri; nocase; content:"jcedu.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003288; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eng/wp-content/plugins/featurific-for-wordpress/1"; http_uri; nocase; content:"jointings.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003289; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eng/wp-content/plugins/featurific-for-wordpress/2"; http_uri; nocase; content:"jointings.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003290; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eng/wp-content/plugins/featurific-for-wordpress/3"; http_uri; nocase; content:"jointings.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003291; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/3/2/8/8/3288864/karma_koin_codes.exe"; http_uri; nocase; content:"karmakoincodes.weebly.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003292; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dg/etrac/nf4emwz/"; http_uri; nocase; content:"kotakwarna.co.id"; content:"Host"; http_header; classtype:trojan-activity; sid:100003293; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/docs/adatgyujtesek/elektra/csv_to_xml.exe"; http_uri; nocase; content:"ksh.hu"; content:"Host"; http_header; classtype:trojan-activity; sid:100003294; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/down/affiliate/kuaizip_setup_10029.exe"; http_uri; nocase; content:"kuaizip.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003295; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/linuxforensicscode.zip"; http_uri; nocase; content:"linuxforensicsbook.com.s3.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003296; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dl8.exe"; http_uri; nocase; content:"lojavirtual.top"; content:"Host"; http_header; classtype:trojan-activity; sid:100003297; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dl8v2.exe"; http_uri; nocase; content:"lojavirtual.top"; content:"Host"; http_header; classtype:trojan-activity; sid:100003298; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ds/1802.gif"; http_uri; nocase; content:"marcostrombetta.com.br"; content:"Host"; http_header; classtype:trojan-activity; sid:100003299; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k/big5/1giof6/"; http_uri; nocase; content:"minpic.de"; content:"Host"; http_header; classtype:trojan-activity; sid:100003300; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/order+00843112.ace"; http_uri; nocase; content:"miot2.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003301; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shipping+docs(ci%2ccoo%2cbl%2cpl).ace"; http_uri; nocase; content:"miot2.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003302; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-contentbak/t9m/"; http_uri; nocase; content:"morrobaydrugandgift.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003303; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/ws2/:gianni1962/:ie6setup/ie6setup.exe"; http_uri; nocase; content:"my.cloudme.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003304; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/components/aacenc.exe"; http_uri; nocase; content:"nch.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100003305; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/components/doxillionsetup.exe"; http_uri; nocase; content:"nch.com.au"; content:"Host"; http_header; classtype:trojan-activity; sid:100003306; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/4/1/6/6/4166984/keygen.exe"; http_uri; nocase; content:"newyarlfm.weebly.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003307; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/efficiency-all-iuehb/bjug3jyhuyilwhcqs3ykssaqqw7tpyvmypb91wtzdbluio1ekope5vrbbcx8zhdar9yt/"; http_uri; nocase; content:"nhipcauytevietnhat.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003308; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yws/api/personal/file/web3a243b322cf83ca7cae587a92916bac7?method=download&inline=true&sharekey=649ac0bb5d5b13d15cbf50b2609e193a"; http_uri; nocase; content:"note.youdao.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003309; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/spreadsheets/osv_stock_valuation-sample-dummy.exe"; http_uri; nocase; content:"oldschoolvalue.s3.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003310; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003311; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003312; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003313; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003314; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003315; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=b4c15a27928f663b!230&authkey=ancu1eabetiubzg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003316; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=b4c15a27928f663b!231&authkey=ai9h3sk_luxran0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003317; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?&resid=c127f9e0fb7cbbea!214&authkey=aat73nvghhjdr9g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003318; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?authkey=!aase4ma0-vo_cls&cid=4df11eda676a355f&resid=4df11eda676a355f!140"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003319; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?authkey=!akd6uxvljtlvpxu&cid=4df11eda676a355f&resid=4df11eda676a355f!130"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003320; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?authkey=!aomvnemlpgwfuie&cid=4df11eda676a355f&resid=4df11eda676a355f!135"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003321; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?authkey=adf5p_kn8rjf29y&cid=34224e3e49966a27&resid=34224e3e49966a27%211732"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003322; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=013413cfbbbcfae4&resid=13413cfbbbcfae4%211656&authkey=ai9wpcp_k9okgk4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003323; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c!111&authkey=aemrwamaaaiyyjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003324; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c%21111&authkey=aemrwamaaaiyyjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003325; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0175cdbe2d2944c5&resid=175cdbe2d2944c5%21107&authkey=al6uptubjmmugo0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003326; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!157&authkey=aagcsm7chqez6uu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003327; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!158&authkey=amsoii5nr6pomhc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003328; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21157&authkey=aagcsm7chqez6uu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003329; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21158&authkey=amsoii5nr6pomhc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003330; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211177&authkey=am0i98nwgvzgqvq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003331; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211183&authkey=anv33trmzmi5cko"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003332; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0319bb40eba80dcc&resid=319bb40eba80dcc%21110&authkey=ag8bs48lq9n-piw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003333; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0412fba39d6c52de&resid=412fba39d6c52de%2122008&authkey=amn2bgbswxwgpma"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003334; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=045adcdfe91be4f5&resid=45adcdfe91be4f5%21318&authkey=aa6lutarluhyj48"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003335; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0489c74de4facb30&resid=489c74de4facb30!109&authkey=ajo32arrzl_vwdq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003336; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=062a585e433edce3&resid=62a585e433edce3%211618&authkey=ahzfppat_uettfg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003337; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=087f57dcf1bd61bc&resid=87f57dcf1bd61bc!113&authkey=ap0wsc-rsiegllw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003338; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=09eebe7829f6351d&resid=9eebe7829f6351d%21827&authkey=amysfuvfuc5jezq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003339; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d!184&authkey=ackbiiarirejcam"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003340; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d%21184&authkey=ackbiiarirejcam"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003341; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!273&authkey=ae2m69e5nu3rrea"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003342; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!274&authkey=acqg0akutoxdpgo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003343; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21273&authkey=ae2m69e5nu3rrea"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003344; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21274&authkey=acqg0akutoxdpgo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003345; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0!1667&authkey=an8otd7jzc7xgho"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003346; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0%211667&authkey=an8otd7jzc7xgho"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003347; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0e26b39babdbf63c&resid=e26b39babdbf63c%21137&authkey=anshbgxg1_qa2h4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003348; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242!309&authkey=alfe36drai1zmwc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003349; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242%21309&authkey=alfe36drai1zmwc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003350; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21123&authkey=aco5hiwppfq8vrw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003351; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21124&authkey=ai6sfa2z-kqf6x0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003352; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=125290ca4dc682c9&resid=125290ca4dc682c9%21452&authkey=afdp5rurqhdqa2a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003353; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=13b301f1cb48f8cd&resid=13b301f1cb48f8cd%21106&authkey=aiae3olcs4lulz4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003354; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=14f52af71b98dbc5&resid=14f52af71b98dbc5%212449&authkey=anfs_n5cs1noojo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003355; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003356; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003357; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003358; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=16b1c02dce9ea41f&resid=16b1c02dce9ea41f!286&authkey=almwisomhv3c0zc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003359; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003360; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003361; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003362; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!129&authkey=apqoonsrce0ari4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003363; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21126&authkey=ad4yflrisq6d82g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003364; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21129&authkey=apqoonsrce0ari4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003365; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=196e83840ef8c152&resid=196e83840ef8c152%21107&authkey=ah2lhjyd0ukjcve"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003366; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a162e8fcaaef5fa&resid=1a162e8fcaaef5fa%215495&authkey=aic7rmj1cm3rt2w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003367; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!106&authkey=aklmrzgetlbm5wc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003368; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!107&authkey=albnx4ylxil-nog"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003369; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21106&authkey=aklmrzgetlbm5wc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003370; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21107&authkey=albnx4ylxil-nog"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003371; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558!8182&authkey=aautw8tvzxr5v3a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003372; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558%218182&authkey=aautw8tvzxr5v3a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003373; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1cbd82dd55d70086&resid=1cbd82dd55d70086%212526&authkey=aogaboensav3jrg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003374; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1dbdf62bc3c2b05b&resid=1dbdf62bc3c2b05b!134&authkey=ape6bhxn7c89z60"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003375; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003376; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003377; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003378; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003379; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003380; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003381; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003382; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003383; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003384; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003385; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003386; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003387; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003388; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003389; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f!191&authkey=ajvumpkzpla_nca"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003390; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f%21191&authkey=ajvumpkzpla_nca"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003391; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=26bbd7d5ad88dd29&resid=26bbd7d5ad88dd29%21115&authkey=acipfa3gbiqqcvu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003392; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=26f87316a7e32bb5&resid=26f87316a7e32bb5%21106&authkey=aepqo5hlkxn1t1k"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003393; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2831401bbac0235e&resid=2831401bbac0235e%211037&authkey=aagnkp6l76yhrlo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003394; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003395; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003396; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003397; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003398; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003399; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003400; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003401; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003402; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003403; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003404; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21115&authkey=aglznnsx71tbe9e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003405; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37!183&authkey=akon9i9zzhusiuk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003406; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37%21183&authkey=akon9i9zzhusiuk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003407; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!116&authkey=!abwledjhfsqwap4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003408; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!121&authkey=!aa0qbuuss-wb13w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003409; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1!119&authkey=apmakx2cqb9rimu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003410; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21118&authkey=acrl2iiem-zjer8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003411; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21119&authkey=apmakx2cqb9rimu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003412; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=2ffaa48ef4bec51a&resid=2ffaa48ef4bec51a%21107&authkey=aiohrvrc3uuo_cw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003413; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3004cdd743a543f5&resid=3004cdd743a543f5%21170&authkey=ao8vz-4rkwuiyn8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003414; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!320&authkey=aooujzuf408dclw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003415; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!321&authkey=almpxnbtsbzauna"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003416; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21320&authkey=aooujzuf408dclw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003417; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21321&authkey=almpxnbtsbzauna"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003418; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3164ddeba70d2263&resid=3164ddeba70d2263%21106&authkey=afkvqrm4zoor8qq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003419; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=31771958ea3373a1&resid=31771958ea3373a1%21108&authkey=aiofxduo9rdb_-o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003420; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1!223&authkey=aajr842bzum0yg8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003421; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1%21223&authkey=aajr842bzum0yg8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003422; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=34207675f7506d94&resid=34207675f7506d94%21137&authkey=angxnhqpe2x5koc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003423; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3447601ab357f8c1&resid=3447601ab357f8c1!114&authkey=aitwerxd-t2cxl0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003424; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003425; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8,standard,n/a,n/a,urlhaus"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003426; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866!107&authkey=af08d9zk1yestqa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003427; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866%21107&authkey=af08d9zk1yestqa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003428; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c!139&authkey=ap4bbakgkikau-a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003429; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c%21139&authkey=ap4bbakgkikau-a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003430; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!152&authkey=am09sv26njxzyn0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003431; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!153&authkey=ajs0jkoeqkqjrze"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003432; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21152&authkey=am09sv26njxzyn0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003433; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21153&authkey=ajs0jkoeqkqjrze"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003434; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3a1715e2cb964f25&resid=3a1715e2cb964f25%213713&authkey=aortxmfnibnoqkk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003435; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0!119&authkey=adkqcwv8_3k86z4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003436; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0%21119&authkey=adkqcwv8_3k86z4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003437; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21432&authkey=aa_npsupyqb2kge"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003438; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21435&authkey=admsjhgpkbtcqzs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003439; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3ee68228c34c236d&resid=3ee68228c34c236d%21129&authkey=apll6hu3-xetzxu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003440; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f!154&authkey=aasj15d0g_p2pog"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003441; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f%21154&authkey=aasj15d0g_p2pog"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003442; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f!134&authkey=aaipzy8nllirlky"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003443; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f%21134&authkey=aaipzy8nllirlky"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003444; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003445; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003446; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003447; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21109&authkey=adzxmpjk-etbkjq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003448; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003449; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003450; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003451; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003452; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003453; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003454; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13805&authkey=ae-zbfo2uwln_gg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003455; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13806&authkey=aakiq-ymrjjodns"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003456; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113805&authkey=ae-zbfo2uwln_gg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003457; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113806&authkey=aakiq-ymrjjodns"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003458; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4b676ea3ff139b93&resid=4b676ea3ff139b93!133&authkey=amfix63glytflgo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003459; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21127&authkey=ablg20r-aat_ob4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003460; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21131&authkey=akbwlkrrtso_bqm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003461; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4df11eda676a355f&resid=4df11eda676a355f!130&authkey=!akd6uxvljtlvpxu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003462; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b!108&authkey=anbjpqxg-iwr4g8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003463; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003464; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003465; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003466; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003467; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003468; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003469; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003470; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21119&authkey=amrs3-3hsvcmtfs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003471; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21158&authkey=aodderdrnvhruts"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003472; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21161&authkey=agdsfxdnre82jjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003473; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21192&authkey=agn2xvrvup-xvtg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003474; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21206&authkey=ai1r52mhtbdnm2y"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003475; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21247&authkey=ae6weny1fa4pday"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003476; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21252&authkey=aphl0oi4r6lrty0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003477; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21257&authkey=afnyvqwcghnyoas"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003478; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21265&authkey=abxqdhlwiurjvve"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003479; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21271&authkey=ae5qwlr5ceeptmy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003480; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21272&authkey=ahrqeoaynibwt14"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003481; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21275&authkey=af_sgsaxsmaxg7i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003482; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21289&authkey=angyngbqixtrjaa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003483; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21293&authkey=acvh08asxosbwfu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003484; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21299&authkey=amicxuotubpok2c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003485; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21306&authkey=ahpivoukyerzcjy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003486; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21314&authkey=aex2uv2-eiofr8q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003487; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21332&authkey=ad0jmjxgbaebvbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003488; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21335&authkey=ah0vupcfbdfa6g4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003489; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21357&authkey=ap8sswuqjjjexho"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003490; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21366&authkey=aoblpmbmx7o_v18"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003491; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21379&authkey=air-bsjj46et47q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003492; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21389&authkey=aduenohuq_rbyhm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003493; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21391&authkey=aa15sw51njbn_na"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003494; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21392&authkey=abp0heeg6ybn0lk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003495; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21393&authkey=aa1pmur8sy8xtwe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003496; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212718&authkey=aie0v1d-cusuabi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003497; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212725&authkey=aanrz9et3bym3lc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003498; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212728&authkey=ahsmbkltfrwgqjc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003499; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!395&authkey=alwvub_yhtogjxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003500; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!398&authkey=abaa_tjd7ohh4so"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003501; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!406&authkey=aarnp48wumgu6tq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003502; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!415&authkey=aglzsd6-g0nzj7s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003503; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!420&authkey=akk5droung_ecww"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003504; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!440&authkey=ai7-dpr11wnzyq8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003505; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21395&authkey=alwvub_yhtogjxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003506; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21398&authkey=abaa_tjd7ohh4so"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003507; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21406&authkey=aarnp48wumgu6tq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003508; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21415&authkey=aglzsd6-g0nzj7s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003509; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21420&authkey=akk5droung_ecww"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003510; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21440&authkey=ai7-dpr11wnzyq8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003511; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211121&authkey=al_fmezwfay4za4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003512; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211122&authkey=anz_q5njlanv2mu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003513; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21110&authkey=akars6koxqzdwgi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003514; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21112&authkey=aadare1gec7nzy8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003515; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003516; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8&em=2"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003517; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d%21109&authkey=adriswrtwdpbuc8&em=2"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003518; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=53c5e6b8f6893887&resid=53c5e6b8f6893887!802&authkey=aapuufivkn2zwu8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003519; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!106&authkey=anzlf1ksptbqok8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003520; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!107&authkey=ag4dr58jrjuxfyq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003521; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21106&authkey=anzlf1ksptbqok8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003522; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21107&authkey=ag4dr58jrjuxfyq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003523; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=547b1e4a6b15bf97&resid=547b1e4a6b15bf97%21106&authkey=akgsmzqhemioz8g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003524; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=54f92c3a2f5d8033&resid=54f92c3a2f5d8033%21200&authkey=aofadhhfwlm2gum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003525; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=55381ffd75ef8cda&resid=55381ffd75ef8cda!270&authkey=aev4isgyubiofdi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003526; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613!157&authkey=an55tjzt-9vbjfy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003527; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613%21156&authkey=agiuawekkbxb_4o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003528; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=55c9feaf3907aae5&resid=55c9feaf3907aae5%21208&authkey=adwuyrapfdzkyoa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003529; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950!280&authkey=advq4p3xhfhinq8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003530; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950%21280&authkey=advq4p3xhfhinq8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003531; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5629da828892367d&resid=5629da828892367d!803&authkey=aphjbq-bsg7ohpc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003532; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21383&authkey=adldpuaya7kj1dk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003533; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21384&authkey=alsuxvtsof32vea"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003534; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3599&authkey=am4yicme6lrjpki"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003535; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3604&authkey=al6pb71mtq4jr1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003536; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213599&authkey=am4yicme6lrjpki"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003537; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213604&authkey=al6pb71mtq4jr1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003538; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b!68197&authkey=aowpm7ocl_21-oc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003539; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b%2168197&authkey=aowpm7ocl_21-oc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003540; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=59389d626d829e8c&resid=59389d626d829e8c%212940&authkey=anx1ngd27vqeiwo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003541; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211568&authkey=aemrnwoi75oflva"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003542; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211572&authkey=aelz-gxlrxcwtnc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003543; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211573&authkey=ahksfdvda0doles"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003544; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5c5404bd403dbdc9&resid=5c5404bd403dbdc9!4464&authkey=ajskjf2hshbudeg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003545; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!406&authkey=aeyeq5j9zfepgai"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003546; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!407&authkey=adnh8af-rvoxlcc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003547; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21406&authkey=aeyeq5j9zfepgai"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003548; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21407&authkey=adnh8af-rvoxlcc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003549; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21892&authkey=apwphufzjdtsedw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003550; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21897&authkey=aomt6el1av5ruc8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003551; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21121&authkey=adjzlorvgx_ezhq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003552; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21123&authkey=ancfnepawtbmnug"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003553; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21124&authkey=ao7bknnuodxtfua"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003554; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003555; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003556; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003557; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003558; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003559; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003560; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003561; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003562; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003563; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e!1094&authkey=anqjzd7pr18fu90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003564; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211094&authkey=anqjzd7pr18fu90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003565; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211099&authkey=alxq-bvz7nqbv4c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003566; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003567; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003568; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003569; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2!517&authkey=akfewcyiwlwomyk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003570; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21505&authkey=ag7xi3lcnvi_hji"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003571; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21517&authkey=akfewcyiwlwomyk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003572; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad!1421&authkey=adixg2-asekemjw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003573; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad%211421&authkey=adixg2-asekemjw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003574; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213096&authkey=aob-cm9vv6erxqg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003575; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213097&authkey=abcuevfyu6pdw70"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003576; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=69b503a3f081a183&resid=69b503a3f081a183%21111&authkey=aazm9wlg1rvgzoc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003577; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!112&authkey=aasndgbcwol3mys"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003578; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!113&authkey=ak3tzu1lg4uuh5m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003579; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21112&authkey=aasndgbcwol3mys"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003580; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21113&authkey=ak3tzu1lg4uuh5m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003581; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21108&authkey=ameouv2jdxo5obw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003582; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21119&authkey=aazzzrl7mv2xbwq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003583; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6a7b40a2bc530c6c&resid=6a7b40a2bc530c6c%21112&authkey=afuov36rbymlvxm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003584; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3!118&authkey=aepf8f3mfmlsng0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003585; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3%21118&authkey=aepf8f3mfmlsng0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003586; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b61e983f930f79f&resid=6b61e983f930f79f!540&authkey=ap2n5w41ifew0i8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003587; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7!1154&authkey=acnbdscb8-rbmcu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003588; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7%211154&authkey=acnbdscb8-rbmcu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003589; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21106&authkey=apvhok6edhtogfu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003590; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21115&authkey=amc_k1nnlywdc4i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003591; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=724b5c509337556e&resid=724b5c509337556e%21908&authkey=agcbb3nakpteyam"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003592; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7285f51e65036769&resid=7285f51e65036769%21264&authkey=akyjvrz006qlble"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003593; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21243&authkey=apivjmxivosek60"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003594; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21256&authkey=adljht0ogfq775k"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003595; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21260&authkey=aig6cydr4_e-qj8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003596; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21262&authkey=ak4fiz1-a1ks8rg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003597; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21264&authkey=aizkjymvlgqwpte"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003598; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!106&authkey=ahu5s4ttjvxbnxo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003599; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!107&authkey=abj3eccentbeaqa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003600; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!108&authkey=amvcygo4prlgt4i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003601; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!110&authkey=ahzuehvk5nvzo90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003602; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21106&authkey=ahu5s4ttjvxbnxo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003603; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21107&authkey=abj3eccentbeaqa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003604; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21108&authkey=amvcygo4prlgt4i"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003605; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21110&authkey=ahzuehvk5nvzo90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003606; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=77518d098ad4dfb0&resid=77518d098ad4dfb0%21939&authkey=akzqobxxxn89z34"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003607; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21111&authkey=aggnhgqj6uhxm2w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003608; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21112&authkey=abser1xtkpb3-ta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003609; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21117&authkey=aivf1ddcvvu22em"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003610; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!119&authkey=aozjai26izprqto"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003611; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!120&authkey=ajj7ueqjvobgfum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003612; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21119&authkey=aozjai26izprqto"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003613; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21120&authkey=ajj7ueqjvobgfum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003614; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c1fc7da38ab958e&resid=7c1fc7da38ab958e!146&authkey=aktmjqz8n4s_sbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003615; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5295&authkey=aasceqj1mdodeuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003616; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5296&authkey=ank3vz5syaf6bny"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003617; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5298&authkey=albzyizuqczfv9s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003618; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215295&authkey=aasceqj1mdodeuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003619; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215296&authkey=ank3vz5syaf6bny"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003620; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215298&authkey=albzyizuqczfv9s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003621; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7d109f249b512466&resid=7d109f249b512466!543&authkey=acqc4xjghclmwbs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003622; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7e81645429ac5a22&resid=7e81645429ac5a22%21105&authkey=aa691jwf5wqi80c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003623; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=7fed4fbea32e3c1e&resid=7fed4fbea32e3c1e%21107&authkey=aeoxfycpolifch0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003624; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=806bac90dc071edf&resid=806bac90dc071edf!105&authkey=!ao7jyz6-licb8hq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003625; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=81c2d8b116274e17&resid=81c2d8b116274e17%21107&authkey=aaqw-t4dx2sbvda"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003626; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=82977114b1af209d&resid=82977114b1af209d!220&authkey=abuin5vdedjughm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003627; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=855b20b0e8399717&resid=855b20b0e8399717%21110&authkey=afhxx21ztsd7hbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003628; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=860a0980486c93fa&resid=860a0980486c93fa!303&authkey=!agcmlab4r6syfvk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003629; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21164&authkey=agbeiinncf8ok_4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003630; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21165&authkey=aiof8rdvxglnm-c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003631; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4!2402&authkey=amigiam45mt6jia"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003632; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4%212402&authkey=amigiam45mt6jia"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003633; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003634; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003635; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003636; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003637; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003638; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003639; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003640; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003641; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25!130&authkey=ais_g9dqoddonsc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003642; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21106&authkey=ahfgxp0p6nk0eby"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003643; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21109&authkey=akr1n3qxtmnttuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003644; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21113&authkey=ajpvf1h89sqstti"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003645; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!112&authkey=af43qpcgl0t2f5o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003646; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!113&authkey=ag92_wxfvrsuix8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003647; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21112&authkey=af43qpcgl0t2f5o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003648; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21113&authkey=ag92_wxfvrsuix8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003649; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21105&authkey=ah9x7rn0p03kd_m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003650; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21110&authkey=ammswulpdsjeu4w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003651; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3!107&authkey=ac-m9dlvo5l7wfk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003652; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3%21107&authkey=ac-m9dlvo5l7wfk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003653; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=96a54b19ff5f6bab&resid=96a54b19ff5f6bab%21107&authkey=anxv07ez7s5sh_k"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003654; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003655; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003656; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003657; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003658; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003659; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003660; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211953&authkey=abdfqiyruwplpo0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003661; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211954&authkey=aok-srkhxjazccy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003662; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21172&authkey=ahharhcv0fmn5fm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003663; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21173&authkey=aecb3qcquacvzhi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003664; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21174&authkey=afv7cprqwxezgsi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003665; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21177&authkey=als6_be40lt5jk8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003666; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2!113&authkey=akeqdnxllfzf8hq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003667; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2%21113&authkey=akeqdnxllfzf8hq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003668; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9fb622acb27482ef&resid=9fb622acb27482ef%211197&authkey=aeacibxy2zlyxro"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003669; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=9fba865c1fdce17f&resid=9fba865c1fdce17f%211109&authkey=achpeiyvsphyn9o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003670; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a023fe2d1ac611f2&resid=a023fe2d1ac611f2!514&authkey=alaxh02uycquui4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003671; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a04a98741fafee2b&resid=a04a98741fafee2b%211857&authkey=af3qhnjtfnffevi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003672; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340!997&authkey=akw6btyej2zht08"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003673; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340%21997&authkey=akw6btyej2zht08"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003674; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a1c8c8055848b889&resid=a1c8c8055848b889!111&authkey=agzlftsgr4lspvo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003675; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a2cd2cdb93584d7e&resid=a2cd2cdb93584d7e%21106&authkey=aeifpqbwo1s3dyq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003676; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e!108&authkey=amcjnb2j1bd4tyu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003677; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21107&authkey=ab9lanzt1aj_0ws"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003678; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21108&authkey=amcjnb2j1bd4tyu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003679; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21109&authkey=afhg_ay2_zz0kkg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003680; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211064&authkey=apebndb6tstxywi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003681; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211065&authkey=aca4_dggi5gbbfs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003682; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211067&authkey=ae-3ej9zzj4ibhw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003683; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211069&authkey=agx6b8qjt_clm-o"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003684; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a502994ea313f5c7&resid=a502994ea313f5c7%21215&authkey=aiydvejv0l8stbs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003685; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114!256&authkey=aapnly5qifymcvw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003686; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21251&authkey=ainluv1ppu-8ogu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003687; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21256&authkey=aapnly5qifymcvw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003688; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21!6053&authkey=agfh0ahstj7rrki"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003689; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21%216053&authkey=agfh0ahstj7rrki"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003690; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003691; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21414&authkey=akf9uwwkitvhrvc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003692; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21415&authkey=ag_5kthuezprnoy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003693; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21416&authkey=airlma-pycgfkyc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003694; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21419&authkey=ab1-sgyv2gibyey"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003695; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21422&authkey=acphsmdy415izjg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003696; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21424&authkey=afvfwz5uvde1pui"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003697; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818!129&authkey=aesewk3cf5vbrxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003698; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818%21129&authkey=aesewk3cf5vbrxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003699; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=aa4e252db942faec&resid=aa4e252db942faec%21168&authkey=anlnjo7xnwtswuk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003700; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003701; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992!113&authkey=agh9q_zzyjjcspc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003702; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992%21113&authkey=agh9q_zzyjjcspc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003703; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=af84ebf13dd5499c&resid=af84ebf13dd5499c!167&authkey=anqr_yvn_hdh2_e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003704; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308!2152&authkey=abutaac83l5utks"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003705; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308%212152&authkey=abutaac83l5utks"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003706; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21650&authkey=aht-wbxsofyx33u"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003707; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21651&authkey=aebbyk6sevdmzgm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003708; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21652&authkey=afsw5wahxo5kwjy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003709; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b1c3a5ef115e135c&resid=b1c3a5ef115e135c%216219&authkey=ahr7bklirbub0pc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003710; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21120&authkey=aozmspl2dqkgkgy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003711; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21123&authkey=aj18p0rtfbtwa84"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003712; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21139&authkey=ahwfjvw4zmjukeo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003713; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21140&authkey=aksvfpmrfqrrggw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003714; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21141&authkey=acznh6clby0qyww"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003715; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21142&authkey=ajf7j1rr3d7jcxy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003716; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21143&authkey=ahs21wnsqb_vu9w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003717; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b50c4248502103d0&resid=b50c4248502103d0%21107&authkey=alf1nley7ja4dbq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003718; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6!164&authkey=adfsfcdaw3biboy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003719; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6%21164&authkey=adfsfcdaw3biboy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003720; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b7cb31db66675eb4&resid=b7cb31db66675eb4%21922&authkey=aghayyucvwey7lg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003721; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b86046e8cbd4254b&resid=b86046e8cbd4254b%21115&authkey=agwstptwpaquleg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003722; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b!7521&authkey=ablt9zdyq2d4rb0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003723; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003724; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003725; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003726; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003727; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003728; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003729; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003730; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b%21246&authkey=afyrchdutalpu90"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003731; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=bf83d9247c2329e0&resid=bf83d9247c2329e0%211108&authkey=absaw-bpqrc6mpq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003732; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003733; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003734; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003735; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003736; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003737; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003738; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003739; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1338&authkey=ajngambosws75_c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003740; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1340&authkey=al1ay3fbtude6d8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003741; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1342&authkey=acpr_htn2jtaxfu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003742; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1343&authkey=abodysrxu9l2xxu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003743; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1344&authkey=aozerppd6mnokwy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003744; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1345&authkey=aevvyhonxhtcdh0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003745; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1346&authkey=achrnf5vlov1gf4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003746; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1347&authkey=al-zge-ttvr921s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003747; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211337&authkey=afnvu1fsuczht5e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003748; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211338&authkey=ajngambosws75_c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003749; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211340&authkey=al1ay3fbtude6d8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003750; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211342&authkey=acpr_htn2jtaxfu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003751; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211343&authkey=abodysrxu9l2xxu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003752; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211344&authkey=aozerppd6mnokwy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003753; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211345&authkey=aevvyhonxhtcdh0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003754; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211346&authkey=achrnf5vlov1gf4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003755; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211347&authkey=al-zge-ttvr921s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003756; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c701663053a57d59&resid=c701663053a57d59%211009&authkey=ahowgkak7j0p2q8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003757; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21486&authkey=amy4euf_rrlcykc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003758; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21489&authkey=ako3anwfnqfohnc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003759; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=c80630c4d385fb9d&resid=c80630c4d385fb9d%21286&authkey=amgaucv8bld_5qs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003760; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21546&authkey=aa6q-ryiifnet5m"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003761; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21547&authkey=aipm8qnwbgo4yga"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003762; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!355&authkey=aajjwf_sm4xdqdk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003763; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!357&authkey=alw3vqqxz6myrle"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003764; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!362&authkey=alycl9izrvfl7oc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003765; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21354&authkey=aa_ukeour7rex1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003766; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21355&authkey=aajjwf_sm4xdqdk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003767; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21357&authkey=alw3vqqxz6myrle"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003768; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21362&authkey=alycl9izrvfl7oc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003769; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ca897bdd16fc7940&resid=ca897bdd16fc7940%21106&authkey=aniklpt8vtlahbg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003770; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2!109&authkey=ac4gxwjoopafr9a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003771; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2%21109&authkey=ac4gxwjoopafr9a"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003772; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cbb66cac420484bc&resid=cbb66cac420484bc!10968&authkey=aj9bjkobu-rlnaw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003773; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c!44331&authkey=afohia-wo-alwiy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003774; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c%2144331&authkey=afohia-wo-alwiy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003775; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!742&authkey=akbxju17f8g0r2s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003776; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!744&authkey=adak4zftd0yhhhs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003777; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21742&authkey=akbxju17f8g0r2s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003778; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21744&authkey=adak4zftd0yhhhs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003779; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!872&authkey=ap9hchztywo8zuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003780; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!874&authkey=alkzcbxz-dscgum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003781; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!875&authkey=aka55ybdhqnoc6c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003782; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21872&authkey=ap9hchztywo8zuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003783; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21874&authkey=alkzcbxz-dscgum"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003784; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21875&authkey=aka55ybdhqnoc6c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003785; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!499&authkey=adegfbfx54fy3qu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003786; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!510&authkey=aamxlkp3spxmvxc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003787; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb%21510&authkey=aamxlkp3spxmvxc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003788; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d2f3748954f6f8a8&resid=d2f3748954f6f8a8%21119&authkey=aex5s9uoun2zps0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003789; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d4d413b6e7cf7088&resid=d4d413b6e7cf7088%211271&authkey=akz65bxpgvdxjb8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003790; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!191&authkey=ajl2uegqunsgc3q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003791; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!192&authkey=acd_hx4bka3z0nw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003792; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003793; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003794; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003795; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003796; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003797; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003798; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dcd65237fcd1a1a9&resid=dcd65237fcd1a1a9%21162&authkey=aprqs0hugnfo6uq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003799; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7527&authkey=aipybipwht56um8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003800; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7530&authkey=am9p2ic6zdkgfmy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003801; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7532&authkey=aonjnubquvon_uk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003802; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217527&authkey=aipybipwht56um8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003803; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217530&authkey=am9p2ic6zdkgfmy"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003804; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217532&authkey=aonjnubquvon_uk"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003805; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2!1818&authkey=anh2wga7qmhbmuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003806; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2%211818&authkey=anh2wga7qmhbmuo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003807; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21107&authkey=akrabrcroiddkxw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003808; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21115&authkey=ad1ncwtj_zcjsh0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003809; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21132&authkey=akpbxohbtjebyn4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003810; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21150&authkey=aevazjbqnu7cmjs"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003811; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21160&authkey=aiendf-9lyln0x0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003812; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e1065ab3e86a5fc2&resid=e1065ab3e86a5fc2%211443&authkey=apybkcvf4iwxp_q"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003813; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2!107&authkey=af-bicrg1c6vgck"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003814; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2%21107&authkey=af-bicrg1c6vgck"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003815; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2!129&authkey=afk5vdt49soo3co"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003816; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2%21129&authkey=afk5vdt49soo3co"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003817; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e3ddc3980f743711&resid=e3ddc3980f743711%21795&authkey=aptivsvyk2we5xc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003818; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21745&authkey=ah1i_jo73zgdxpc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003819; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21746&authkey=ag1mhwlznwdxpw0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003820; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e43694f4bd6f68d1&resid=e43694f4bd6f68d1!563&authkey=aj8ovsob9ll6r-c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003821; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!509&authkey=akmdyqkzcsuf_gg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003822; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!511&authkey=agfs0q7dz7os1lu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003823; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c%21511&authkey=agfs0q7dz7os1lu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003824; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e54ea4e0368d023b&resid=e54ea4e0368d023b%21106&authkey=aozas6g9pm0fzvq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003825; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003826; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003827; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003828; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21349&authkey=ae9ea8jdsa7vmom"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003829; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003830; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003831; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003832; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!148&authkey=agjcwq650c8wdbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003833; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!150&authkey=ami5aqoinvosjle"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003834; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21148&authkey=agjcwq650c8wdbm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003835; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21150&authkey=ami5aqoinvosjle"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003836; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e97110434470423e&resid=e97110434470423e%21113&authkey=afowclex54if0g0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003837; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33!1192&authkey=apnhep6fmmxxdkw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003838; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33%211192&authkey=apnhep6fmmxxdkw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003839; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211215&authkey=ac1jr_bieufz0ai"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003840; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211219&authkey=akgo75rmvr4khlc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003841; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ebacca5dec27fd20&resid=ebacca5dec27fd20%2118735&authkey=ajfyl1mzidnylc8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003842; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21113&authkey=aovavpmokd2jrns"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003843; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21116&authkey=aadnj5xyfasugu8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003844; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003845; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003846; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!204&authkey=ad0nbzlscbg-0sa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003847; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21202&authkey=ah1gjq8j29darw4"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003848; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21203&authkey=af8xr99mrqp8um8"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003849; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21204&authkey=ad0nbzlscbg-0sa"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003850; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21489&authkey=ads_gff3tjkd0w0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003851; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21490&authkey=aj_rld7xooge6aw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003852; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21492&authkey=ahdb75ptd1_uc8e"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003853; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f06038a5f7dbd6d6&resid=f06038a5f7dbd6d6%215498&authkey=aiozi3z5qzdysmu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003854; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f293cebb54e5ea71&resid=f293cebb54e5ea71%21293&authkey=aha74rsqiuewnpq"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003855; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21566&authkey=aevafh7rydhi19k"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003856; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21581&authkey=agx0b8ho87w4uie"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003857; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21582&authkey=af-9_xwysl1o7-c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003858; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21598&authkey=ah-gkc-b7fa8h-g"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003859; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21599&authkey=aajunhe1ex_-zta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003860; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f79e41c0e32d3314&resid=f79e41c0e32d3314%211182&authkey=aiqtptberyvlgqk&em=2%22"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003861; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806!1368&authkey=anphh1fijhvzv6c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003862; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806%211368&authkey=anphh1fijhvzv6c"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003863; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382!159&authkey=ai4_8srrzf48hw0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003864; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382%21159&authkey=ai4_8srrzf48hw0"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003865; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fb2177c192eed796&resid=fb2177c192eed796%21124&authkey=abotnmdhu_tg7bc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003866; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fd50774e5ce0e314&resid=fd50774e5ce0e314%21778&authkey=aoxb2vhhz3qodiu"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003867; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fd67fafc46d3c687&resid=fd67fafc46d3c687%21473&authkey=aoid_cp-jgffqvm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003868; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!847&authkey=aemnhwbhlskovgm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003869; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!848&authkey=ag1_e421v-t5r9w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003870; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21847&authkey=aemnhwbhlskovgm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003871; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21848&authkey=ag1_e421v-t5r9w"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003872; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=fe85161c3947f2c1&resid=fe85161c3947f2c1%211441&authkey=agb6c1ecr91svrw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003873; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!693&authkey=agcpkhnewfte_yc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003874; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!694&authkey=aa5jqzjsp0esr1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003875; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21693&authkey=agcpkhnewfte_yc"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003876; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21694&authkey=aa5jqzjsp0esr1s"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003877; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!330&authkey=adxnzkb0a09pizw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003878; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!334&authkey=agsvox_t7qim4ta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003879; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!335&authkey=ach14e6omcghwgg"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003880; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21330&authkey=adxnzkb0a09pizw"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003881; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21333&authkey=aielwtaiuvcttlm"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003882; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21334&authkey=agsvox_t7qim4ta"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003883; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r/a39ev"; http_uri; nocase; content:"paste.ee"; content:"Host"; http_header; classtype:trojan-activity; sid:100003884; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/raw/77jhk0iw"; http_uri; nocase; content:"pastebin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003885; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/raw/89hkc7wb"; http_uri; nocase; content:"pastebin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003886; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/raw/yqvsvlvq"; http_uri; nocase; content:"pastebin.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003887; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/llc/mwcacs65xienqdp/"; http_uri; nocase; content:"pierreconsulting.info"; content:"Host"; http_header; classtype:trojan-activity; sid:100003888; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/uploads/2020/10/skoda22.jpg"; http_uri; nocase; content:"procrossover.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003889; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/uploads/2020/10/skodaqq.jpg"; http_uri; nocase; content:"procrossover.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003890; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/zzcoiatsr5wujrwagsgbnm2wkjxldvgu/"; http_uri; nocase; content:"qjbutterflyevents.co.za"; content:"Host"; http_header; classtype:trojan-activity; sid:100003891; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhlshipmentawb80326979402.ace"; http_uri; nocase; content:"quen.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003892; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maersk-bl+draft-copy-shipping-documents.ace"; http_uri; nocase; content:"quen.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003893; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/po+for+april+shipment.ace"; http_uri; nocase; content:"quen.s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003894; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/arntsonl/calc_security_poc/master/dll/calc.dll"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003895; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bero1985/berotinypascal/e34bd4164f4b7c27e7cf667dffd9274d33d6dfbe/bin/btpc.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003896; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evil-coder66/defendercontrol/main/defendercontrol.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003897; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuzzbunch/fuzzbunch/master/payloads/doublepulsar-1.3.1.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003898; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inquisb/shellcodeexec/master/windows/shellcodeexec.x32.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003899; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/malwares/webshell/master/ajax_php%20command%20shell.rar"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003900; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/myqseeaccount/one/main/one.htm"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003901; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/realtek25556/rhti2/gh-pages/90hfnvo69vk2ot.bmp"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003902; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secwiki/windows-kernel-exploits/master/ms15-076/binary/trebuchet.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003903; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secwiki/windows-kernel-exploits/master/ms16-098/bfill.exe"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003904; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tennc/webshell/master/other/small_shell.txt"; http_uri; nocase; content:"raw.githubusercontent.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003905; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/player/launch/2017/09/12/da5f9a1c23034353852750488feeaf36.exe"; http_uri; nocase; content:"res.yeshen.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003906; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pro/dl/q05z91"; http_uri; nocase; content:"sendspace.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003907; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ey4lpx8rx.zip"; http_uri; nocase; content:"shribharatvatika.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003908; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/stormqk/dn/stormagent.apk?attredirects=0"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003909; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6ca94027662tilxa4p/base.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003910; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6cbd811626fvoj29vw/base64.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003911; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6cd19c87f44r9fomit/base64jef.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003912; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6e2cbda22efxk3t7x2/base64.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003913; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6e2f6c8c5adup2yiwx/basejefin.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003914; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6eab37b8dadmy1gx7c/base3.5.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003915; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6eb2aa215a8cvwcf6s/fudjs.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003916; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c6fd6b4eb1c08aamus8/go.jpeg"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003917; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c7921a2cf26cunjcgvm/nanocoregomes.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003918; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wzukusers/user-34654398/documents/5c9e24cc08a4dlmv7cjo/cdt.txt"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003919; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a-nurse-ss8d9/z/"; http_uri; nocase; content:"technologydistilled.com"; content:"Host"; http_header; classtype:trojan-activity; sid:100003920; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/23.exe"; http_uri; nocase; content:"tsrv4.ws"; content:"Host"; http_header; classtype:trojan-activity; sid:100003921; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/crisanar/defis/jek_crackme1.7.zip"; http_uri; nocase; content:"users.skynet.be"; content:"Host"; http_header; classtype:trojan-activity; sid:100003922; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gnuboard/data/scan/amowvegfrt9ja/"; http_uri; nocase; content:"vniel.co.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100003923; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gnuboard/data/scan/fu6jvxzzs46uqlp7l/"; http_uri; nocase; content:"vniel.co.kr"; content:"Host"; http_header; classtype:trojan-activity; sid:100003924; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kolya/.f/root/net.mit.edu/net/user/chris/winnt/mit_agenda2a.doc"; http_uri; nocase; content:"web.mit.edu"; content:"Host"; http_header; classtype:trojan-activity; sid:100003925; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kolya/.f/root/net.mit.edu/sipb/user/kolya/afs/root.afs/net/user/chris/winnt/mit_agenda2a.doc"; http_uri; nocase; content:"web.mit.edu"; content:"Host"; http_header; classtype:trojan-activity; sid:100003926; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/136_140/flt_shovemydiscoupyourarse.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003927; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/136_140/kb%5efr_ouverture.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003928; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/136_140/kb^fr_ouverture.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003929; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/146_150/bc_memories_from_the_mcp.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003930; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues/151_155/tidex_-_short_stuff.exe"; http_uri; nocase; content:"websound.ru"; content:"Host"; http_header; classtype:trojan-activity; sid:100003931; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/syria-files/attach/222/222051_instruction.zip"; http_uri; nocase; content:"wikileaks.org"; content:"Host"; http_header; classtype:trojan-activity; sid:100003932; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"/common/yz.vbs"; http_uri; nocase; content:"yp.hnggzyjy.cn"; content:"Host"; http_header; classtype:trojan-activity; sid:100003933; rev:1;) diff --git a/urlhaus-filter-snort3-online.rules b/urlhaus-filter-snort3-online.rules index e1ffc0e3..34132c27 100644 --- a/urlhaus-filter-snort3-online.rules +++ b/urlhaus-filter-snort3-online.rules @@ -1,5 +1,5 @@ # Title: Online Malicious URL Snort3 Ruleset -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -7,778 +7,778 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"0-24bpautomentes.hu",nocase; classtype:trojan-activity; sid:100000001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"0cl.sldov.ru",nocase; classtype:trojan-activity; sid:100000002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.10.147.48",nocase; classtype:trojan-activity; sid:100000003; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.207.196.135",nocase; classtype:trojan-activity; sid:100000004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.222.196.60",nocase; classtype:trojan-activity; sid:100000005; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.245.4.163",nocase; classtype:trojan-activity; sid:100000006; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.107",nocase; classtype:trojan-activity; sid:100000007; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.109",nocase; classtype:trojan-activity; sid:100000008; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.113",nocase; classtype:trojan-activity; sid:100000009; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.127",nocase; classtype:trojan-activity; sid:100000010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.134",nocase; classtype:trojan-activity; sid:100000011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.138",nocase; classtype:trojan-activity; sid:100000012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.14",nocase; classtype:trojan-activity; sid:100000013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.222.196.60",nocase; classtype:trojan-activity; sid:100000004; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.245.4.163",nocase; classtype:trojan-activity; sid:100000005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.107",nocase; classtype:trojan-activity; sid:100000006; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.109",nocase; classtype:trojan-activity; sid:100000007; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.113",nocase; classtype:trojan-activity; sid:100000008; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.127",nocase; classtype:trojan-activity; sid:100000009; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.134",nocase; classtype:trojan-activity; sid:100000010; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.138",nocase; classtype:trojan-activity; sid:100000011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.14",nocase; classtype:trojan-activity; sid:100000012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.153",nocase; classtype:trojan-activity; sid:100000013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.16",nocase; classtype:trojan-activity; sid:100000014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.165",nocase; classtype:trojan-activity; sid:100000015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.20",nocase; classtype:trojan-activity; sid:100000016; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.228",nocase; classtype:trojan-activity; sid:100000017; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.234",nocase; classtype:trojan-activity; sid:100000018; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.237",nocase; classtype:trojan-activity; sid:100000019; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.245",nocase; classtype:trojan-activity; sid:100000020; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.249",nocase; classtype:trojan-activity; sid:100000021; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.25",nocase; classtype:trojan-activity; sid:100000022; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.38",nocase; classtype:trojan-activity; sid:100000023; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.41",nocase; classtype:trojan-activity; sid:100000024; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.43",nocase; classtype:trojan-activity; sid:100000025; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.45",nocase; classtype:trojan-activity; sid:100000026; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.56",nocase; classtype:trojan-activity; sid:100000027; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.63",nocase; classtype:trojan-activity; sid:100000028; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.69",nocase; classtype:trojan-activity; sid:100000029; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.8",nocase; classtype:trojan-activity; sid:100000030; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.80",nocase; classtype:trojan-activity; sid:100000031; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.94",nocase; classtype:trojan-activity; sid:100000032; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.98",nocase; classtype:trojan-activity; sid:100000033; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.10",nocase; classtype:trojan-activity; sid:100000034; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.105",nocase; classtype:trojan-activity; sid:100000035; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.109",nocase; classtype:trojan-activity; sid:100000036; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.126",nocase; classtype:trojan-activity; sid:100000037; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.127",nocase; classtype:trojan-activity; sid:100000038; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.130",nocase; classtype:trojan-activity; sid:100000039; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.146",nocase; classtype:trojan-activity; sid:100000040; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.148",nocase; classtype:trojan-activity; sid:100000041; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.15",nocase; classtype:trojan-activity; sid:100000042; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.151",nocase; classtype:trojan-activity; sid:100000043; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.22",nocase; classtype:trojan-activity; sid:100000044; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.223",nocase; classtype:trojan-activity; sid:100000045; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.4",nocase; classtype:trojan-activity; sid:100000046; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.48",nocase; classtype:trojan-activity; sid:100000047; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.54",nocase; classtype:trojan-activity; sid:100000048; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.58",nocase; classtype:trojan-activity; sid:100000049; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.59",nocase; classtype:trojan-activity; sid:100000050; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.6",nocase; classtype:trojan-activity; sid:100000051; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.71",nocase; classtype:trojan-activity; sid:100000052; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.83",nocase; classtype:trojan-activity; sid:100000053; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.94",nocase; classtype:trojan-activity; sid:100000054; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.247.221.141",nocase; classtype:trojan-activity; sid:100000055; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.247.221.142",nocase; classtype:trojan-activity; sid:100000056; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.250.159.41",nocase; classtype:trojan-activity; sid:100000057; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.65.166.225",nocase; classtype:trojan-activity; sid:100000058; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.82.104.89",nocase; classtype:trojan-activity; sid:100000059; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"100.12.184.63",nocase; classtype:trojan-activity; sid:100000060; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"100.12.51.122",nocase; classtype:trojan-activity; sid:100000061; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"100.8.77.4",nocase; classtype:trojan-activity; sid:100000062; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1008691.com",nocase; classtype:trojan-activity; sid:100000063; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.108.130.121",nocase; classtype:trojan-activity; sid:100000064; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.16.183.179",nocase; classtype:trojan-activity; sid:100000065; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.229.85.127",nocase; classtype:trojan-activity; sid:100000066; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.255.36.154",nocase; classtype:trojan-activity; sid:100000067; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.28.105.132",nocase; classtype:trojan-activity; sid:100000068; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.28.218.245",nocase; classtype:trojan-activity; sid:100000069; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.28.76.34",nocase; classtype:trojan-activity; sid:100000070; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.66.81.70",nocase; classtype:trojan-activity; sid:100000071; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.75.157.99",nocase; classtype:trojan-activity; sid:100000072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.130.115.14",nocase; classtype:trojan-activity; sid:100000073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.141.240.139",nocase; classtype:trojan-activity; sid:100000074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.113.99.79",nocase; classtype:trojan-activity; sid:100000075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.125.218.107",nocase; classtype:trojan-activity; sid:100000076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.141.138.118",nocase; classtype:trojan-activity; sid:100000077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.16.145.25",nocase; classtype:trojan-activity; sid:100000078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.204.168.34",nocase; classtype:trojan-activity; sid:100000079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.217.215.21",nocase; classtype:trojan-activity; sid:100000080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.219.152.228",nocase; classtype:trojan-activity; sid:100000081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.224.200.146",nocase; classtype:trojan-activity; sid:100000082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.224.200.40",nocase; classtype:trojan-activity; sid:100000083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.237.21.36",nocase; classtype:trojan-activity; sid:100000084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.238.228.3",nocase; classtype:trojan-activity; sid:100000085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.240.249.121",nocase; classtype:trojan-activity; sid:100000086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.4.117.26",nocase; classtype:trojan-activity; sid:100000087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.79.112.254",nocase; classtype:trojan-activity; sid:100000088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.82.98.170",nocase; classtype:trojan-activity; sid:100000089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.123.92",nocase; classtype:trojan-activity; sid:100000090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.12",nocase; classtype:trojan-activity; sid:100000091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.14",nocase; classtype:trojan-activity; sid:100000092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.16",nocase; classtype:trojan-activity; sid:100000093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.17",nocase; classtype:trojan-activity; sid:100000094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.23",nocase; classtype:trojan-activity; sid:100000095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.25",nocase; classtype:trojan-activity; sid:100000096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.28",nocase; classtype:trojan-activity; sid:100000097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.36",nocase; classtype:trojan-activity; sid:100000098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.46",nocase; classtype:trojan-activity; sid:100000099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.47",nocase; classtype:trojan-activity; sid:100000100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.92.25.90",nocase; classtype:trojan-activity; sid:100000101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.92.25.95",nocase; classtype:trojan-activity; sid:100000102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.97.184.180",nocase; classtype:trojan-activity; sid:100000103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.168.98.159",nocase; classtype:trojan-activity; sid:100000104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.184.75.123",nocase; classtype:trojan-activity; sid:100000105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.206.93.94",nocase; classtype:trojan-activity; sid:100000106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.33.52.85",nocase; classtype:trojan-activity; sid:100000107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.61.86.37",nocase; classtype:trojan-activity; sid:100000108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.7.141.172",nocase; classtype:trojan-activity; sid:100000109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"106.1.111.91",nocase; classtype:trojan-activity; sid:100000110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"106.104.172.178",nocase; classtype:trojan-activity; sid:100000111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"106.104.193.155",nocase; classtype:trojan-activity; sid:100000112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"106.105.33.43",nocase; classtype:trojan-activity; sid:100000113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.172.104.105",nocase; classtype:trojan-activity; sid:100000114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.172.193.132",nocase; classtype:trojan-activity; sid:100000115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.172.249.148",nocase; classtype:trojan-activity; sid:100000116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.173.219.80",nocase; classtype:trojan-activity; sid:100000117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.174.250.107",nocase; classtype:trojan-activity; sid:100000118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.174.61.139",nocase; classtype:trojan-activity; sid:100000119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.175.197.135",nocase; classtype:trojan-activity; sid:100000120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.175.31.130",nocase; classtype:trojan-activity; sid:100000121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.175.33.48",nocase; classtype:trojan-activity; sid:100000122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.181.136.96",nocase; classtype:trojan-activity; sid:100000123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.194.242.170",nocase; classtype:trojan-activity; sid:100000124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.219.185.75",nocase; classtype:trojan-activity; sid:100000125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.220.119.25",nocase; classtype:trojan-activity; sid:100000126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.221.96.202",nocase; classtype:trojan-activity; sid:100000127; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"108.190.201.37",nocase; classtype:trojan-activity; sid:100000128; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"108.190.250.48",nocase; classtype:trojan-activity; sid:100000129; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"108.249.194.121",nocase; classtype:trojan-activity; sid:100000130; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.104.151.108",nocase; classtype:trojan-activity; sid:100000131; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.124.90.229",nocase; classtype:trojan-activity; sid:100000132; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.233.196.232",nocase; classtype:trojan-activity; sid:100000133; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.235.7.228",nocase; classtype:trojan-activity; sid:100000134; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.86.85.253",nocase; classtype:trojan-activity; sid:100000135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.88.185.119",nocase; classtype:trojan-activity; sid:100000136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.95.200.102",nocase; classtype:trojan-activity; sid:100000137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.95.200.230",nocase; classtype:trojan-activity; sid:100000138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.96.127.90",nocase; classtype:trojan-activity; sid:100000139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.96.57.246",nocase; classtype:trojan-activity; sid:100000140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.99.37.97",nocase; classtype:trojan-activity; sid:100000141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.14.58.190",nocase; classtype:trojan-activity; sid:100000142; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.187.229.182",nocase; classtype:trojan-activity; sid:100000143; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.228.195.46",nocase; classtype:trojan-activity; sid:100000144; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.248.124.254",nocase; classtype:trojan-activity; sid:100000145; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.248.175.141",nocase; classtype:trojan-activity; sid:100000146; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.248.251.194",nocase; classtype:trojan-activity; sid:100000147; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.251.10.18",nocase; classtype:trojan-activity; sid:100000148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.253.150.248",nocase; classtype:trojan-activity; sid:100000149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.253.213.198",nocase; classtype:trojan-activity; sid:100000150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.255.101.184",nocase; classtype:trojan-activity; sid:100000151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.145.127",nocase; classtype:trojan-activity; sid:100000152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.208.21",nocase; classtype:trojan-activity; sid:100000153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.221.77",nocase; classtype:trojan-activity; sid:100000154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.223.92",nocase; classtype:trojan-activity; sid:100000155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.225.24",nocase; classtype:trojan-activity; sid:100000156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.235.57",nocase; classtype:trojan-activity; sid:100000157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.4.2",nocase; classtype:trojan-activity; sid:100000158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.89.10.147",nocase; classtype:trojan-activity; sid:100000159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.89.222.213",nocase; classtype:trojan-activity; sid:100000160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.118.111.207",nocase; classtype:trojan-activity; sid:100000161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.118.88.61",nocase; classtype:trojan-activity; sid:100000162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.119.245.114",nocase; classtype:trojan-activity; sid:100000163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.125.67.125",nocase; classtype:trojan-activity; sid:100000164; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.163.50.120",nocase; classtype:trojan-activity; sid:100000165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.170.86.31",nocase; classtype:trojan-activity; sid:100000166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.172.57.20",nocase; classtype:trojan-activity; sid:100000167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.182.235.252",nocase; classtype:trojan-activity; sid:100000168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.171.111",nocase; classtype:trojan-activity; sid:100000169; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.177.85",nocase; classtype:trojan-activity; sid:100000170; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.23.84",nocase; classtype:trojan-activity; sid:100000171; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.230.136",nocase; classtype:trojan-activity; sid:100000172; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.27.9",nocase; classtype:trojan-activity; sid:100000173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.49.223",nocase; classtype:trojan-activity; sid:100000174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.103.122",nocase; classtype:trojan-activity; sid:100000175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.103.66",nocase; classtype:trojan-activity; sid:100000176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.104.141",nocase; classtype:trojan-activity; sid:100000177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.106.19",nocase; classtype:trojan-activity; sid:100000178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.121.222",nocase; classtype:trojan-activity; sid:100000179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.121.223",nocase; classtype:trojan-activity; sid:100000180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.121.226",nocase; classtype:trojan-activity; sid:100000181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.121.228",nocase; classtype:trojan-activity; sid:100000182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.123.136",nocase; classtype:trojan-activity; sid:100000183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.26.243",nocase; classtype:trojan-activity; sid:100000184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.8.81",nocase; classtype:trojan-activity; sid:100000185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.111.108.184",nocase; classtype:trojan-activity; sid:100000186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.133.222.151",nocase; classtype:trojan-activity; sid:100000187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.170.124.75",nocase; classtype:trojan-activity; sid:100000188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.170.233.9",nocase; classtype:trojan-activity; sid:100000189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.186.210.211",nocase; classtype:trojan-activity; sid:100000190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.186.96.252",nocase; classtype:trojan-activity; sid:100000191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.187.91.117",nocase; classtype:trojan-activity; sid:100000192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.214.127.42",nocase; classtype:trojan-activity; sid:100000193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.225.187.19",nocase; classtype:trojan-activity; sid:100000194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.225.236.77",nocase; classtype:trojan-activity; sid:100000195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.225.239.126",nocase; classtype:trojan-activity; sid:100000196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.225.43.27",nocase; classtype:trojan-activity; sid:100000197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.226.162.148",nocase; classtype:trojan-activity; sid:100000198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.226.67.193",nocase; classtype:trojan-activity; sid:100000199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.228.180.95",nocase; classtype:trojan-activity; sid:100000200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.229.178.109",nocase; classtype:trojan-activity; sid:100000201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.230.168.103",nocase; classtype:trojan-activity; sid:100000202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.234.218.202",nocase; classtype:trojan-activity; sid:100000203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.235.188.86",nocase; classtype:trojan-activity; sid:100000204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.236.171.69",nocase; classtype:trojan-activity; sid:100000205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.141.241",nocase; classtype:trojan-activity; sid:100000206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.144.226",nocase; classtype:trojan-activity; sid:100000207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.209.30",nocase; classtype:trojan-activity; sid:100000208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.75.157",nocase; classtype:trojan-activity; sid:100000209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.99.207",nocase; classtype:trojan-activity; sid:100000210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.238.143.135",nocase; classtype:trojan-activity; sid:100000211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.238.190.207",nocase; classtype:trojan-activity; sid:100000212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.238.227.228",nocase; classtype:trojan-activity; sid:100000213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.238.39.2",nocase; classtype:trojan-activity; sid:100000214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.240.216.17",nocase; classtype:trojan-activity; sid:100000215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.245.12.89",nocase; classtype:trojan-activity; sid:100000216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.245.8.24",nocase; classtype:trojan-activity; sid:100000217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.246.126.58",nocase; classtype:trojan-activity; sid:100000218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.246.162.50",nocase; classtype:trojan-activity; sid:100000219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.246.180.49",nocase; classtype:trojan-activity; sid:100000220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.100.14",nocase; classtype:trojan-activity; sid:100000221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.16.222",nocase; classtype:trojan-activity; sid:100000222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.191.118",nocase; classtype:trojan-activity; sid:100000223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.214.146",nocase; classtype:trojan-activity; sid:100000224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.240.226",nocase; classtype:trojan-activity; sid:100000225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.82.122",nocase; classtype:trojan-activity; sid:100000226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.248.148.90",nocase; classtype:trojan-activity; sid:100000227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.248.197.164",nocase; classtype:trojan-activity; sid:100000228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.249.109.217",nocase; classtype:trojan-activity; sid:100000229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.249.118.157",nocase; classtype:trojan-activity; sid:100000230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.250.102.173",nocase; classtype:trojan-activity; sid:100000231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.251.218.210",nocase; classtype:trojan-activity; sid:100000232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.252.196.17",nocase; classtype:trojan-activity; sid:100000233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.252.221.244",nocase; classtype:trojan-activity; sid:100000234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.254.208.123",nocase; classtype:trojan-activity; sid:100000235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.255.6.129",nocase; classtype:trojan-activity; sid:100000236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.255.8.235",nocase; classtype:trojan-activity; sid:100000237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.111",nocase; classtype:trojan-activity; sid:100000238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.117",nocase; classtype:trojan-activity; sid:100000239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.131",nocase; classtype:trojan-activity; sid:100000240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.132",nocase; classtype:trojan-activity; sid:100000241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.133",nocase; classtype:trojan-activity; sid:100000242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.138",nocase; classtype:trojan-activity; sid:100000243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.139",nocase; classtype:trojan-activity; sid:100000244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.143",nocase; classtype:trojan-activity; sid:100000245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.146",nocase; classtype:trojan-activity; sid:100000246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.147",nocase; classtype:trojan-activity; sid:100000247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.149",nocase; classtype:trojan-activity; sid:100000248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.151",nocase; classtype:trojan-activity; sid:100000249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.158",nocase; classtype:trojan-activity; sid:100000250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.162",nocase; classtype:trojan-activity; sid:100000251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.165",nocase; classtype:trojan-activity; sid:100000252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.175",nocase; classtype:trojan-activity; sid:100000253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.177",nocase; classtype:trojan-activity; sid:100000254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.179",nocase; classtype:trojan-activity; sid:100000255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.180",nocase; classtype:trojan-activity; sid:100000256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.127.155",nocase; classtype:trojan-activity; sid:100000257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.80.120",nocase; classtype:trojan-activity; sid:100000258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.82.29",nocase; classtype:trojan-activity; sid:100000259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.83.23",nocase; classtype:trojan-activity; sid:100000260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.85.113",nocase; classtype:trojan-activity; sid:100000261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.87.130",nocase; classtype:trojan-activity; sid:100000262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.88.116",nocase; classtype:trojan-activity; sid:100000263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.91.212",nocase; classtype:trojan-activity; sid:100000264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.158",nocase; classtype:trojan-activity; sid:100000265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.159",nocase; classtype:trojan-activity; sid:100000266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.168",nocase; classtype:trojan-activity; sid:100000267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.177",nocase; classtype:trojan-activity; sid:100000268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.188",nocase; classtype:trojan-activity; sid:100000269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.200",nocase; classtype:trojan-activity; sid:100000270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.219",nocase; classtype:trojan-activity; sid:100000271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.229",nocase; classtype:trojan-activity; sid:100000272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.230",nocase; classtype:trojan-activity; sid:100000273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.247",nocase; classtype:trojan-activity; sid:100000274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.90",nocase; classtype:trojan-activity; sid:100000275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.91",nocase; classtype:trojan-activity; sid:100000276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.33",nocase; classtype:trojan-activity; sid:100000277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.38",nocase; classtype:trojan-activity; sid:100000278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.43",nocase; classtype:trojan-activity; sid:100000279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.48",nocase; classtype:trojan-activity; sid:100000280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.38.19",nocase; classtype:trojan-activity; sid:100000281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.103",nocase; classtype:trojan-activity; sid:100000282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.124",nocase; classtype:trojan-activity; sid:100000283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.136",nocase; classtype:trojan-activity; sid:100000284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.57",nocase; classtype:trojan-activity; sid:100000285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.68",nocase; classtype:trojan-activity; sid:100000286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.97.184",nocase; classtype:trojan-activity; sid:100000287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.0.113",nocase; classtype:trojan-activity; sid:100000288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.176.16",nocase; classtype:trojan-activity; sid:100000289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.240.239",nocase; classtype:trojan-activity; sid:100000290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.87.98",nocase; classtype:trojan-activity; sid:100000291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.53.224.79",nocase; classtype:trojan-activity; sid:100000292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.65.53.175",nocase; classtype:trojan-activity; sid:100000293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.153.37",nocase; classtype:trojan-activity; sid:100000294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.162.49",nocase; classtype:trojan-activity; sid:100000295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.175.147",nocase; classtype:trojan-activity; sid:100000296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.176.112",nocase; classtype:trojan-activity; sid:100000297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.176.84",nocase; classtype:trojan-activity; sid:100000298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.226.202",nocase; classtype:trojan-activity; sid:100000299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.78.45.158",nocase; classtype:trojan-activity; sid:100000300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.80.127.91",nocase; classtype:trojan-activity; sid:100000301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.80.215.101",nocase; classtype:trojan-activity; sid:100000302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.82.146.253",nocase; classtype:trojan-activity; sid:100000303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.82.18.255",nocase; classtype:trojan-activity; sid:100000304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.82.224.139",nocase; classtype:trojan-activity; sid:100000305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.93.29.211",nocase; classtype:trojan-activity; sid:100000306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.11.95.254",nocase; classtype:trojan-activity; sid:100000307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.122.238.68",nocase; classtype:trojan-activity; sid:100000308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.161.58.249",nocase; classtype:trojan-activity; sid:100000309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.161.78.185",nocase; classtype:trojan-activity; sid:100000310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.226.42.250",nocase; classtype:trojan-activity; sid:100000311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.227.194.172",nocase; classtype:trojan-activity; sid:100000312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.227.35.229",nocase; classtype:trojan-activity; sid:100000313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.231.211.131",nocase; classtype:trojan-activity; sid:100000314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.254.169.251",nocase; classtype:trojan-activity; sid:100000315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.128.133",nocase; classtype:trojan-activity; sid:100000316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.133.16",nocase; classtype:trojan-activity; sid:100000317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.144.42",nocase; classtype:trojan-activity; sid:100000318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.154.21",nocase; classtype:trojan-activity; sid:100000319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.61.204.205",nocase; classtype:trojan-activity; sid:100000320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.87.226.255",nocase; classtype:trojan-activity; sid:100000321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.87.32.93",nocase; classtype:trojan-activity; sid:100000322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.89.43.185",nocase; classtype:trojan-activity; sid:100000323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.111.242.3",nocase; classtype:trojan-activity; sid:100000324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.224.203.128",nocase; classtype:trojan-activity; sid:100000325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.226.100.56",nocase; classtype:trojan-activity; sid:100000326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.228.205.101",nocase; classtype:trojan-activity; sid:100000327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.229.165.194",nocase; classtype:trojan-activity; sid:100000328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.30.54.64",nocase; classtype:trojan-activity; sid:100000329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.79.172.42",nocase; classtype:trojan-activity; sid:100000330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.165.216.112",nocase; classtype:trojan-activity; sid:100000331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.201.38.185",nocase; classtype:trojan-activity; sid:100000332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.42.47.36",nocase; classtype:trojan-activity; sid:100000333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.50.227.209",nocase; classtype:trojan-activity; sid:100000334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.50.92.195",nocase; classtype:trojan-activity; sid:100000335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.55.158.93",nocase; classtype:trojan-activity; sid:100000336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.56.131.242",nocase; classtype:trojan-activity; sid:100000337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.56.133.96",nocase; classtype:trojan-activity; sid:100000338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.56.135.210",nocase; classtype:trojan-activity; sid:100000339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.56.152.194",nocase; classtype:trojan-activity; sid:100000340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.58.132.140",nocase; classtype:trojan-activity; sid:100000341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.59.233.160",nocase; classtype:trojan-activity; sid:100000342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.61.112.199",nocase; classtype:trojan-activity; sid:100000343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.73.3.11",nocase; classtype:trojan-activity; sid:100000344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.92.174.231",nocase; classtype:trojan-activity; sid:100000345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.124.219.2",nocase; classtype:trojan-activity; sid:100000346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.132.151.60",nocase; classtype:trojan-activity; sid:100000347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.206.164.46",nocase; classtype:trojan-activity; sid:100000348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.211.100.26",nocase; classtype:trojan-activity; sid:100000349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.196.50.5",nocase; classtype:trojan-activity; sid:100000350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.204.138",nocase; classtype:trojan-activity; sid:100000351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.204.5",nocase; classtype:trojan-activity; sid:100000352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.210.52",nocase; classtype:trojan-activity; sid:100000353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.220.126",nocase; classtype:trojan-activity; sid:100000354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.243.40",nocase; classtype:trojan-activity; sid:100000355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.200.76.54",nocase; classtype:trojan-activity; sid:100000356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.26.104.74",nocase; classtype:trojan-activity; sid:100000357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.63.113.146",nocase; classtype:trojan-activity; sid:100000358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.63.195.140",nocase; classtype:trojan-activity; sid:100000359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.63.53.15",nocase; classtype:trojan-activity; sid:100000360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.86.105.110",nocase; classtype:trojan-activity; sid:100000361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.176.104.35",nocase; classtype:trojan-activity; sid:100000362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.176.157.64",nocase; classtype:trojan-activity; sid:100000363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.176.7.132",nocase; classtype:trojan-activity; sid:100000364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.223.32.74",nocase; classtype:trojan-activity; sid:100000365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.223.5.149",nocase; classtype:trojan-activity; sid:100000366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.223.72.141",nocase; classtype:trojan-activity; sid:100000367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.12.130",nocase; classtype:trojan-activity; sid:100000368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.128.147",nocase; classtype:trojan-activity; sid:100000369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.208.215",nocase; classtype:trojan-activity; sid:100000370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.209.108",nocase; classtype:trojan-activity; sid:100000371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.214.72",nocase; classtype:trojan-activity; sid:100000372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.88.146",nocase; classtype:trojan-activity; sid:100000373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.96.150",nocase; classtype:trojan-activity; sid:100000374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.96.6",nocase; classtype:trojan-activity; sid:100000375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.233.221.162",nocase; classtype:trojan-activity; sid:100000376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.233.63.194",nocase; classtype:trojan-activity; sid:100000377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.233.65.93",nocase; classtype:trojan-activity; sid:100000378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.42.125.246",nocase; classtype:trojan-activity; sid:100000379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.43.180.33",nocase; classtype:trojan-activity; sid:100000380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.79.125.92",nocase; classtype:trojan-activity; sid:100000381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.79.50.203",nocase; classtype:trojan-activity; sid:100000382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.79.58.82",nocase; classtype:trojan-activity; sid:100000383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.99.179.164",nocase; classtype:trojan-activity; sid:100000384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.99.183.235",nocase; classtype:trojan-activity; sid:100000385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.99.239.217",nocase; classtype:trojan-activity; sid:100000386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.102.179.235",nocase; classtype:trojan-activity; sid:100000387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.108.161.25",nocase; classtype:trojan-activity; sid:100000388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.112.185.232",nocase; classtype:trojan-activity; sid:100000389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.123.238.52",nocase; classtype:trojan-activity; sid:100000390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.14.143.145",nocase; classtype:trojan-activity; sid:100000391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.147.213.57",nocase; classtype:trojan-activity; sid:100000392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.163.93.191",nocase; classtype:trojan-activity; sid:100000393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.164.18.235",nocase; classtype:trojan-activity; sid:100000394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.164.218.229",nocase; classtype:trojan-activity; sid:100000395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.165.107.93",nocase; classtype:trojan-activity; sid:100000396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.165.241.222",nocase; classtype:trojan-activity; sid:100000397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.165.27.77",nocase; classtype:trojan-activity; sid:100000398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.165.68.145",nocase; classtype:trojan-activity; sid:100000399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.166.170.241",nocase; classtype:trojan-activity; sid:100000400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.166.97.6",nocase; classtype:trojan-activity; sid:100000401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.167.26.33",nocase; classtype:trojan-activity; sid:100000402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.177.147.38",nocase; classtype:trojan-activity; sid:100000403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.178.248.123",nocase; classtype:trojan-activity; sid:100000404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.179.43.1",nocase; classtype:trojan-activity; sid:100000405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.18.38.144",nocase; classtype:trojan-activity; sid:100000406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.180.106.217",nocase; classtype:trojan-activity; sid:100000407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.180.33.161",nocase; classtype:trojan-activity; sid:100000408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.181.119.21",nocase; classtype:trojan-activity; sid:100000409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.181.124.203",nocase; classtype:trojan-activity; sid:100000410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.182.97.232",nocase; classtype:trojan-activity; sid:100000411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.183.115.103",nocase; classtype:trojan-activity; sid:100000412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.184.172.199",nocase; classtype:trojan-activity; sid:100000413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.187.195.161",nocase; classtype:trojan-activity; sid:100000414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.187.245.61",nocase; classtype:trojan-activity; sid:100000415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.189.137.195",nocase; classtype:trojan-activity; sid:100000416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.189.227.244",nocase; classtype:trojan-activity; sid:100000417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.150.85",nocase; classtype:trojan-activity; sid:100000418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.187.206",nocase; classtype:trojan-activity; sid:100000419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.215.221",nocase; classtype:trojan-activity; sid:100000420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.240.20",nocase; classtype:trojan-activity; sid:100000421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.255.236",nocase; classtype:trojan-activity; sid:100000422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.204.30.144",nocase; classtype:trojan-activity; sid:100000423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.250.129.231",nocase; classtype:trojan-activity; sid:100000424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.251.105.221",nocase; classtype:trojan-activity; sid:100000425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.131.155",nocase; classtype:trojan-activity; sid:100000426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.143.46",nocase; classtype:trojan-activity; sid:100000427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.143.71",nocase; classtype:trojan-activity; sid:100000428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.144.75",nocase; classtype:trojan-activity; sid:100000429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.148.115",nocase; classtype:trojan-activity; sid:100000430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.155.57",nocase; classtype:trojan-activity; sid:100000431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.173.24",nocase; classtype:trojan-activity; sid:100000432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.195.90",nocase; classtype:trojan-activity; sid:100000433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.132.113.2",nocase; classtype:trojan-activity; sid:100000434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.15.69.83",nocase; classtype:trojan-activity; sid:100000435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.178.187.6",nocase; classtype:trojan-activity; sid:100000436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.178.187.7",nocase; classtype:trojan-activity; sid:100000437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.178.187.8",nocase; classtype:trojan-activity; sid:100000438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.178.187.9",nocase; classtype:trojan-activity; sid:100000439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.207.39.227",nocase; classtype:trojan-activity; sid:100000440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.25.204.189",nocase; classtype:trojan-activity; sid:100000441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.0.255.173",nocase; classtype:trojan-activity; sid:100000442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.142.222.22",nocase; classtype:trojan-activity; sid:100000443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.150.213.110",nocase; classtype:trojan-activity; sid:100000444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.151.248.134",nocase; classtype:trojan-activity; sid:100000445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.180",nocase; classtype:trojan-activity; sid:100000446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.183",nocase; classtype:trojan-activity; sid:100000447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.185",nocase; classtype:trojan-activity; sid:100000448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.186",nocase; classtype:trojan-activity; sid:100000449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.193",nocase; classtype:trojan-activity; sid:100000450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.201",nocase; classtype:trojan-activity; sid:100000451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.202",nocase; classtype:trojan-activity; sid:100000452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.204",nocase; classtype:trojan-activity; sid:100000453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.208",nocase; classtype:trojan-activity; sid:100000454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.212",nocase; classtype:trojan-activity; sid:100000455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.233",nocase; classtype:trojan-activity; sid:100000456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.126.235",nocase; classtype:trojan-activity; sid:100000457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.126.239",nocase; classtype:trojan-activity; sid:100000458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.126.60",nocase; classtype:trojan-activity; sid:100000459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.127.187",nocase; classtype:trojan-activity; sid:100000460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.99.127",nocase; classtype:trojan-activity; sid:100000461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.210.89.79",nocase; classtype:trojan-activity; sid:100000462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.50.66.60",nocase; classtype:trojan-activity; sid:100000463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.50.93.115",nocase; classtype:trojan-activity; sid:100000464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.6.8.11",nocase; classtype:trojan-activity; sid:100000465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.7.75.99",nocase; classtype:trojan-activity; sid:100000466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.100.114.164",nocase; classtype:trojan-activity; sid:100000467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.100.96.8",nocase; classtype:trojan-activity; sid:100000468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.121.44.222",nocase; classtype:trojan-activity; sid:100000469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.123.53.25",nocase; classtype:trojan-activity; sid:100000470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.127.155.220",nocase; classtype:trojan-activity; sid:100000471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.141.11.56",nocase; classtype:trojan-activity; sid:100000472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.15.142.137",nocase; classtype:trojan-activity; sid:100000473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.159.22.144",nocase; classtype:trojan-activity; sid:100000474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.170.234.142",nocase; classtype:trojan-activity; sid:100000475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.170.8.146",nocase; classtype:trojan-activity; sid:100000476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.185.31.2",nocase; classtype:trojan-activity; sid:100000477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.190.36.8",nocase; classtype:trojan-activity; sid:100000478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.20.104.26",nocase; classtype:trojan-activity; sid:100000479; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.225.11.163",nocase; classtype:trojan-activity; sid:100000480; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.237.226.202",nocase; classtype:trojan-activity; sid:100000481; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.24.116.173",nocase; classtype:trojan-activity; sid:100000482; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.25.54.241",nocase; classtype:trojan-activity; sid:100000483; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.254.76.17",nocase; classtype:trojan-activity; sid:100000484; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.88.99.236",nocase; classtype:trojan-activity; sid:100000485; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.100.150.204",nocase; classtype:trojan-activity; sid:100000486; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.160.147.53",nocase; classtype:trojan-activity; sid:100000487; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.188.86.225",nocase; classtype:trojan-activity; sid:100000488; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.199.72.23",nocase; classtype:trojan-activity; sid:100000489; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.199.79.27",nocase; classtype:trojan-activity; sid:100000490; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.202.37.85",nocase; classtype:trojan-activity; sid:100000491; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.254.33.214",nocase; classtype:trojan-activity; sid:100000492; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.0.240.58",nocase; classtype:trojan-activity; sid:100000493; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.10.15.35",nocase; classtype:trojan-activity; sid:100000494; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.124.244",nocase; classtype:trojan-activity; sid:100000495; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.170.237",nocase; classtype:trojan-activity; sid:100000496; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.182.187",nocase; classtype:trojan-activity; sid:100000497; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.19.248",nocase; classtype:trojan-activity; sid:100000498; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.238.188",nocase; classtype:trojan-activity; sid:100000499; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.129.2.28",nocase; classtype:trojan-activity; sid:100000500; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.129.84.36",nocase; classtype:trojan-activity; sid:100000501; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.130.208.52",nocase; classtype:trojan-activity; sid:100000502; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.130.27.19",nocase; classtype:trojan-activity; sid:100000503; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.130.37.182",nocase; classtype:trojan-activity; sid:100000504; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.131.186.250",nocase; classtype:trojan-activity; sid:100000505; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.132.219.147",nocase; classtype:trojan-activity; sid:100000506; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.133.98.135",nocase; classtype:trojan-activity; sid:100000507; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.134.14.130",nocase; classtype:trojan-activity; sid:100000508; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.154.236.114",nocase; classtype:trojan-activity; sid:100000509; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.159.8.100",nocase; classtype:trojan-activity; sid:100000510; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.183.16.71",nocase; classtype:trojan-activity; sid:100000511; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.191.164.92",nocase; classtype:trojan-activity; sid:100000512; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.192.101.163",nocase; classtype:trojan-activity; sid:100000513; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.193.53.237",nocase; classtype:trojan-activity; sid:100000514; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.194.235.37",nocase; classtype:trojan-activity; sid:100000515; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.194.35.146",nocase; classtype:trojan-activity; sid:100000516; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.194.52.79",nocase; classtype:trojan-activity; sid:100000517; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.194.60.238",nocase; classtype:trojan-activity; sid:100000518; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.195.112.240",nocase; classtype:trojan-activity; sid:100000519; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.195.184.191",nocase; classtype:trojan-activity; sid:100000520; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.195.98.141",nocase; classtype:trojan-activity; sid:100000521; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.212.29.154",nocase; classtype:trojan-activity; sid:100000522; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.213.225.130",nocase; classtype:trojan-activity; sid:100000523; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.233.130.162",nocase; classtype:trojan-activity; sid:100000524; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.233.152.249",nocase; classtype:trojan-activity; sid:100000525; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.234.116.110",nocase; classtype:trojan-activity; sid:100000526; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.234.184.57",nocase; classtype:trojan-activity; sid:100000527; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.240.103.89",nocase; classtype:trojan-activity; sid:100000528; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.240.181.57",nocase; classtype:trojan-activity; sid:100000529; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.240.79.61",nocase; classtype:trojan-activity; sid:100000530; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.241.11.41",nocase; classtype:trojan-activity; sid:100000531; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.241.148.58",nocase; classtype:trojan-activity; sid:100000532; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.241.184.124",nocase; classtype:trojan-activity; sid:100000533; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.28.217.23",nocase; classtype:trojan-activity; sid:100000534; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.4.44.113",nocase; classtype:trojan-activity; sid:100000535; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.5.5.242",nocase; classtype:trojan-activity; sid:100000536; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.8.17.78",nocase; classtype:trojan-activity; sid:100000537; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.129.221.150",nocase; classtype:trojan-activity; sid:100000538; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.129.76.230",nocase; classtype:trojan-activity; sid:100000539; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.129.78.176",nocase; classtype:trojan-activity; sid:100000540; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.130.40.31",nocase; classtype:trojan-activity; sid:100000541; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.104.82",nocase; classtype:trojan-activity; sid:100000542; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.151.135",nocase; classtype:trojan-activity; sid:100000543; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.24.185",nocase; classtype:trojan-activity; sid:100000544; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.26.243",nocase; classtype:trojan-activity; sid:100000545; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.54.33",nocase; classtype:trojan-activity; sid:100000546; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.132.110.150",nocase; classtype:trojan-activity; sid:100000547; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.135.34.49",nocase; classtype:trojan-activity; sid:100000548; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.152.26.45",nocase; classtype:trojan-activity; sid:100000549; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.153.236.6",nocase; classtype:trojan-activity; sid:100000550; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.160.126.238",nocase; classtype:trojan-activity; sid:100000551; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.163.65.64",nocase; classtype:trojan-activity; sid:100000552; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.165.123.7",nocase; classtype:trojan-activity; sid:100000553; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.187.111.160",nocase; classtype:trojan-activity; sid:100000554; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.199.56.198",nocase; classtype:trojan-activity; sid:100000555; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.230.174.233",nocase; classtype:trojan-activity; sid:100000556; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.254.251.54",nocase; classtype:trojan-activity; sid:100000557; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.5.92.20",nocase; classtype:trojan-activity; sid:100000558; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.6.0.4",nocase; classtype:trojan-activity; sid:100000559; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.67.89.28",nocase; classtype:trojan-activity; sid:100000560; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.7.254.85",nocase; classtype:trojan-activity; sid:100000561; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.80.46.73",nocase; classtype:trojan-activity; sid:100000562; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.93.94.207",nocase; classtype:trojan-activity; sid:100000563; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.105.217.252",nocase; classtype:trojan-activity; sid:100000564; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.128.28.161",nocase; classtype:trojan-activity; sid:100000565; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.142.93.34",nocase; classtype:trojan-activity; sid:100000566; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.191.113.212",nocase; classtype:trojan-activity; sid:100000567; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.209.71.6",nocase; classtype:trojan-activity; sid:100000568; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.40.1.235",nocase; classtype:trojan-activity; sid:100000569; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.40.73.68",nocase; classtype:trojan-activity; sid:100000570; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.43.23.193",nocase; classtype:trojan-activity; sid:100000571; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.46.142.96",nocase; classtype:trojan-activity; sid:100000572; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.46.255.38",nocase; classtype:trojan-activity; sid:100000573; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"128.116.133.92",nocase; classtype:trojan-activity; sid:100000574; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"130.255.159.133",nocase; classtype:trojan-activity; sid:100000575; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"134.195.139.4",nocase; classtype:trojan-activity; sid:100000576; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"135.148.36.127",nocase; classtype:trojan-activity; sid:100000577; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"138.99.204.224",nocase; classtype:trojan-activity; sid:100000578; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"139.159.226.180",nocase; classtype:trojan-activity; sid:100000579; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"139.170.173.198",nocase; classtype:trojan-activity; sid:100000580; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"139.216.102.151",nocase; classtype:trojan-activity; sid:100000581; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.102.17.222",nocase; classtype:trojan-activity; sid:100000582; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.136.80.242",nocase; classtype:trojan-activity; sid:100000583; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.138.8.51",nocase; classtype:trojan-activity; sid:100000584; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.160.34.50",nocase; classtype:trojan-activity; sid:100000585; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.189.247.118",nocase; classtype:trojan-activity; sid:100000586; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.232.33.212",nocase; classtype:trojan-activity; sid:100000587; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.37.222.190",nocase; classtype:trojan-activity; sid:100000588; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.45.127.110",nocase; classtype:trojan-activity; sid:100000589; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.46.25.17",nocase; classtype:trojan-activity; sid:100000590; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.46.98.241",nocase; classtype:trojan-activity; sid:100000591; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.50.129.248",nocase; classtype:trojan-activity; sid:100000592; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.55.29.2",nocase; classtype:trojan-activity; sid:100000593; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"142.11.216.5",nocase; classtype:trojan-activity; sid:100000594; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"142.177.56.127",nocase; classtype:trojan-activity; sid:100000595; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"143.198.120.58",nocase; classtype:trojan-activity; sid:100000596; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"146.71.79.230",nocase; classtype:trojan-activity; sid:100000597; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"148.69.108.177",nocase; classtype:trojan-activity; sid:100000598; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"149.255.15.134",nocase; classtype:trojan-activity; sid:100000599; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"149.255.15.184",nocase; classtype:trojan-activity; sid:100000600; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"149.255.15.87",nocase; classtype:trojan-activity; sid:100000601; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"149.255.15.99",nocase; classtype:trojan-activity; sid:100000602; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14karatvisions.com",nocase; classtype:trojan-activity; sid:100000603; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"150.116.207.99",nocase; classtype:trojan-activity; sid:100000604; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"151.177.163.87",nocase; classtype:trojan-activity; sid:100000605; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"151.33.230.191",nocase; classtype:trojan-activity; sid:100000606; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"153.101.234.167",nocase; classtype:trojan-activity; sid:100000607; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"153.101.47.145",nocase; classtype:trojan-activity; sid:100000608; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"153.3.152.106",nocase; classtype:trojan-activity; sid:100000609; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"153.34.135.92",nocase; classtype:trojan-activity; sid:100000610; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"157.230.219.6",nocase; classtype:trojan-activity; sid:100000611; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"158.101.165.14",nocase; classtype:trojan-activity; sid:100000612; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"158.174.213.128",nocase; classtype:trojan-activity; sid:100000613; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"158.51.125.115",nocase; classtype:trojan-activity; sid:100000614; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"159.224.74.112",nocase; classtype:trojan-activity; sid:100000615; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"162.194.28.60",nocase; classtype:trojan-activity; sid:100000616; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"162.209.98.174",nocase; classtype:trojan-activity; sid:100000617; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"163.53.206.228",nocase; classtype:trojan-activity; sid:100000618; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"165.90.16.5",nocase; classtype:trojan-activity; sid:100000619; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"167.114.172.177",nocase; classtype:trojan-activity; sid:100000620; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"168.205.223.254",nocase; classtype:trojan-activity; sid:100000621; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"170.81.238.178",nocase; classtype:trojan-activity; sid:100000622; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.120.222.98",nocase; classtype:trojan-activity; sid:100000623; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.121.255.12",nocase; classtype:trojan-activity; sid:100000624; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.123.14.190",nocase; classtype:trojan-activity; sid:100000625; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.34.176.217",nocase; classtype:trojan-activity; sid:100000626; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.34.179.178",nocase; classtype:trojan-activity; sid:100000627; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.35.162.156",nocase; classtype:trojan-activity; sid:100000628; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.35.174.198",nocase; classtype:trojan-activity; sid:100000629; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.105.36.168",nocase; classtype:trojan-activity; sid:100000630; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.114.244.127",nocase; classtype:trojan-activity; sid:100000631; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.245.186.107",nocase; classtype:trojan-activity; sid:100000632; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.245.5.185",nocase; classtype:trojan-activity; sid:100000633; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.245.5.190",nocase; classtype:trojan-activity; sid:100000634; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.245.81.19",nocase; classtype:trojan-activity; sid:100000635; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.93.194.114",nocase; classtype:trojan-activity; sid:100000636; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.167.85.89",nocase; classtype:trojan-activity; sid:100000637; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.169.46.85",nocase; classtype:trojan-activity; sid:100000638; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.19.58.108",nocase; classtype:trojan-activity; sid:100000639; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.233.85.171",nocase; classtype:trojan-activity; sid:100000640; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.235.209.70",nocase; classtype:trojan-activity; sid:100000641; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.25.113.8",nocase; classtype:trojan-activity; sid:100000642; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.52.95.134",nocase; classtype:trojan-activity; sid:100000643; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.52.97.25",nocase; classtype:trojan-activity; sid:100000644; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.56.119.108",nocase; classtype:trojan-activity; sid:100000645; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.56.92.166",nocase; classtype:trojan-activity; sid:100000646; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.63.64.213",nocase; classtype:trojan-activity; sid:100000647; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.106.33.85",nocase; classtype:trojan-activity; sid:100000648; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.61.3.149",nocase; classtype:trojan-activity; sid:100000649; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.61.48.94",nocase; classtype:trojan-activity; sid:100000650; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.73.246.193",nocase; classtype:trojan-activity; sid:100000651; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.81.78.7",nocase; classtype:trojan-activity; sid:100000652; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.83.73.163",nocase; classtype:trojan-activity; sid:100000653; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.10.147.167",nocase; classtype:trojan-activity; sid:100000654; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.11.193.66",nocase; classtype:trojan-activity; sid:100000655; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.11.65.112",nocase; classtype:trojan-activity; sid:100000656; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.117.66.74",nocase; classtype:trojan-activity; sid:100000657; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.169.13.182",nocase; classtype:trojan-activity; sid:100000658; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.201.104.192",nocase; classtype:trojan-activity; sid:100000659; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.208.230.8",nocase; classtype:trojan-activity; sid:100000660; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.213.25.192",nocase; classtype:trojan-activity; sid:100000661; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.42.46.118",nocase; classtype:trojan-activity; sid:100000662; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.7.184.32",nocase; classtype:trojan-activity; sid:100000663; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.9.24.110",nocase; classtype:trojan-activity; sid:100000664; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.111.174.35",nocase; classtype:trojan-activity; sid:100000665; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.111.174.63",nocase; classtype:trojan-activity; sid:100000666; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.111.174.66",nocase; classtype:trojan-activity; sid:100000667; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.111.174.67",nocase; classtype:trojan-activity; sid:100000668; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.104",nocase; classtype:trojan-activity; sid:100000669; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.113",nocase; classtype:trojan-activity; sid:100000670; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.60",nocase; classtype:trojan-activity; sid:100000671; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.66",nocase; classtype:trojan-activity; sid:100000672; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.76",nocase; classtype:trojan-activity; sid:100000673; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.84",nocase; classtype:trojan-activity; sid:100000674; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.91",nocase; classtype:trojan-activity; sid:100000675; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.12.117.70",nocase; classtype:trojan-activity; sid:100000676; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.123.7.115",nocase; classtype:trojan-activity; sid:100000677; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.123.7.127",nocase; classtype:trojan-activity; sid:100000678; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.123.9.243",nocase; classtype:trojan-activity; sid:100000679; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.124.7.225",nocase; classtype:trojan-activity; sid:100000680; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.221.188.251",nocase; classtype:trojan-activity; sid:100000681; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.221.251.238",nocase; classtype:trojan-activity; sid:100000682; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.240.84.106",nocase; classtype:trojan-activity; sid:100000683; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"177.11.92.78",nocase; classtype:trojan-activity; sid:100000684; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"177.131.226.235",nocase; classtype:trojan-activity; sid:100000685; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"177.54.82.154",nocase; classtype:trojan-activity; sid:100000686; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.124.182.187",nocase; classtype:trojan-activity; sid:100000687; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.134.185.112",nocase; classtype:trojan-activity; sid:100000688; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.150.174.65",nocase; classtype:trojan-activity; sid:100000689; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.151.143.2",nocase; classtype:trojan-activity; sid:100000690; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.165.122.141",nocase; classtype:trojan-activity; sid:100000691; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.1.179",nocase; classtype:trojan-activity; sid:100000692; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.10.164",nocase; classtype:trojan-activity; sid:100000693; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.10.94",nocase; classtype:trojan-activity; sid:100000694; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.101.51",nocase; classtype:trojan-activity; sid:100000695; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.102.138",nocase; classtype:trojan-activity; sid:100000696; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.102.142",nocase; classtype:trojan-activity; sid:100000697; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.102.162",nocase; classtype:trojan-activity; sid:100000698; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.102.25",nocase; classtype:trojan-activity; sid:100000699; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.103.143",nocase; classtype:trojan-activity; sid:100000700; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.103.173",nocase; classtype:trojan-activity; sid:100000701; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.104.112",nocase; classtype:trojan-activity; sid:100000702; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.104.69",nocase; classtype:trojan-activity; sid:100000703; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.105.213",nocase; classtype:trojan-activity; sid:100000704; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.105.238",nocase; classtype:trojan-activity; sid:100000705; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.105.7",nocase; classtype:trojan-activity; sid:100000706; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.107.0",nocase; classtype:trojan-activity; sid:100000707; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.108.173",nocase; classtype:trojan-activity; sid:100000708; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.108.87",nocase; classtype:trojan-activity; sid:100000709; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.109.118",nocase; classtype:trojan-activity; sid:100000710; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.110.201",nocase; classtype:trojan-activity; sid:100000711; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.111.135",nocase; classtype:trojan-activity; sid:100000712; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.111.171",nocase; classtype:trojan-activity; sid:100000713; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.111.190",nocase; classtype:trojan-activity; sid:100000714; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.111",nocase; classtype:trojan-activity; sid:100000715; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.135",nocase; classtype:trojan-activity; sid:100000716; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.159",nocase; classtype:trojan-activity; sid:100000717; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.198",nocase; classtype:trojan-activity; sid:100000718; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.85",nocase; classtype:trojan-activity; sid:100000719; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.114.151",nocase; classtype:trojan-activity; sid:100000720; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.114.178",nocase; classtype:trojan-activity; sid:100000721; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.114.57",nocase; classtype:trojan-activity; sid:100000722; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.115.166",nocase; classtype:trojan-activity; sid:100000723; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.116.101",nocase; classtype:trojan-activity; sid:100000724; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.116.138",nocase; classtype:trojan-activity; sid:100000725; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.116.242",nocase; classtype:trojan-activity; sid:100000726; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.118.112",nocase; classtype:trojan-activity; sid:100000727; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.118.116",nocase; classtype:trojan-activity; sid:100000728; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.118.244",nocase; classtype:trojan-activity; sid:100000729; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.119.69",nocase; classtype:trojan-activity; sid:100000730; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.12.135",nocase; classtype:trojan-activity; sid:100000731; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.120.154",nocase; classtype:trojan-activity; sid:100000732; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.121.0",nocase; classtype:trojan-activity; sid:100000733; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.121.228",nocase; classtype:trojan-activity; sid:100000734; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.122.28",nocase; classtype:trojan-activity; sid:100000735; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.213",nocase; classtype:trojan-activity; sid:100000736; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.223",nocase; classtype:trojan-activity; sid:100000737; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.232",nocase; classtype:trojan-activity; sid:100000738; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.248",nocase; classtype:trojan-activity; sid:100000739; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.26",nocase; classtype:trojan-activity; sid:100000740; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.91",nocase; classtype:trojan-activity; sid:100000741; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.124.4",nocase; classtype:trojan-activity; sid:100000742; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.125.14",nocase; classtype:trojan-activity; sid:100000743; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.126.129",nocase; classtype:trojan-activity; sid:100000744; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.126.254",nocase; classtype:trojan-activity; sid:100000745; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.126.46",nocase; classtype:trojan-activity; sid:100000746; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.127.202",nocase; classtype:trojan-activity; sid:100000747; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.127.63",nocase; classtype:trojan-activity; sid:100000748; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.14.14",nocase; classtype:trojan-activity; sid:100000749; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.15.199",nocase; classtype:trojan-activity; sid:100000750; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.15.232",nocase; classtype:trojan-activity; sid:100000751; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.15.44",nocase; classtype:trojan-activity; sid:100000752; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.17.194",nocase; classtype:trojan-activity; sid:100000753; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.17.236",nocase; classtype:trojan-activity; sid:100000754; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.18.75",nocase; classtype:trojan-activity; sid:100000755; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.19.163",nocase; classtype:trojan-activity; sid:100000756; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.158",nocase; classtype:trojan-activity; sid:100000757; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.217",nocase; classtype:trojan-activity; sid:100000758; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.225",nocase; classtype:trojan-activity; sid:100000759; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.59",nocase; classtype:trojan-activity; sid:100000760; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.20.126",nocase; classtype:trojan-activity; sid:100000761; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.20.7",nocase; classtype:trojan-activity; sid:100000762; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.20.74",nocase; classtype:trojan-activity; sid:100000763; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.21.149",nocase; classtype:trojan-activity; sid:100000764; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.23.119",nocase; classtype:trojan-activity; sid:100000765; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.24.166",nocase; classtype:trojan-activity; sid:100000766; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.24.232",nocase; classtype:trojan-activity; sid:100000767; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.25.129",nocase; classtype:trojan-activity; sid:100000768; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.25.177",nocase; classtype:trojan-activity; sid:100000769; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.27.32",nocase; classtype:trojan-activity; sid:100000770; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.27.46",nocase; classtype:trojan-activity; sid:100000771; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.29.233",nocase; classtype:trojan-activity; sid:100000772; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.30.133",nocase; classtype:trojan-activity; sid:100000773; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.30.151",nocase; classtype:trojan-activity; sid:100000774; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.32.146",nocase; classtype:trojan-activity; sid:100000775; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.234",nocase; classtype:trojan-activity; sid:100000017; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.237",nocase; classtype:trojan-activity; sid:100000018; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.245",nocase; classtype:trojan-activity; sid:100000019; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.249",nocase; classtype:trojan-activity; sid:100000020; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.25",nocase; classtype:trojan-activity; sid:100000021; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.38",nocase; classtype:trojan-activity; sid:100000022; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.41",nocase; classtype:trojan-activity; sid:100000023; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.43",nocase; classtype:trojan-activity; sid:100000024; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.45",nocase; classtype:trojan-activity; sid:100000025; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.56",nocase; classtype:trojan-activity; sid:100000026; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.63",nocase; classtype:trojan-activity; sid:100000027; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.69",nocase; classtype:trojan-activity; sid:100000028; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.8",nocase; classtype:trojan-activity; sid:100000029; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.80",nocase; classtype:trojan-activity; sid:100000030; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.94",nocase; classtype:trojan-activity; sid:100000031; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.222.98",nocase; classtype:trojan-activity; sid:100000032; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.10",nocase; classtype:trojan-activity; sid:100000033; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.105",nocase; classtype:trojan-activity; sid:100000034; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.109",nocase; classtype:trojan-activity; sid:100000035; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.126",nocase; classtype:trojan-activity; sid:100000036; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.127",nocase; classtype:trojan-activity; sid:100000037; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.130",nocase; classtype:trojan-activity; sid:100000038; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.146",nocase; classtype:trojan-activity; sid:100000039; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.148",nocase; classtype:trojan-activity; sid:100000040; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.15",nocase; classtype:trojan-activity; sid:100000041; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.151",nocase; classtype:trojan-activity; sid:100000042; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.223",nocase; classtype:trojan-activity; sid:100000043; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.4",nocase; classtype:trojan-activity; sid:100000044; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.48",nocase; classtype:trojan-activity; sid:100000045; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.58",nocase; classtype:trojan-activity; sid:100000046; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.59",nocase; classtype:trojan-activity; sid:100000047; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.6",nocase; classtype:trojan-activity; sid:100000048; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.61",nocase; classtype:trojan-activity; sid:100000049; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.71",nocase; classtype:trojan-activity; sid:100000050; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.83",nocase; classtype:trojan-activity; sid:100000051; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.246.223.94",nocase; classtype:trojan-activity; sid:100000052; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.247.221.141",nocase; classtype:trojan-activity; sid:100000053; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.247.221.142",nocase; classtype:trojan-activity; sid:100000054; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.250.159.41",nocase; classtype:trojan-activity; sid:100000055; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.65.166.225",nocase; classtype:trojan-activity; sid:100000056; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.82.104.89",nocase; classtype:trojan-activity; sid:100000057; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"100.12.184.63",nocase; classtype:trojan-activity; sid:100000058; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"100.12.51.122",nocase; classtype:trojan-activity; sid:100000059; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"100.8.77.4",nocase; classtype:trojan-activity; sid:100000060; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1008691.com",nocase; classtype:trojan-activity; sid:100000061; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.108.130.121",nocase; classtype:trojan-activity; sid:100000062; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.16.183.179",nocase; classtype:trojan-activity; sid:100000063; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.229.85.127",nocase; classtype:trojan-activity; sid:100000064; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.255.36.154",nocase; classtype:trojan-activity; sid:100000065; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.28.105.132",nocase; classtype:trojan-activity; sid:100000066; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.28.218.245",nocase; classtype:trojan-activity; sid:100000067; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.28.76.34",nocase; classtype:trojan-activity; sid:100000068; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.66.81.70",nocase; classtype:trojan-activity; sid:100000069; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.75.157.99",nocase; classtype:trojan-activity; sid:100000070; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.130.115.14",nocase; classtype:trojan-activity; sid:100000071; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.141.240.139",nocase; classtype:trojan-activity; sid:100000072; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.113.99.79",nocase; classtype:trojan-activity; sid:100000073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.125.218.107",nocase; classtype:trojan-activity; sid:100000074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.16.145.25",nocase; classtype:trojan-activity; sid:100000075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.204.168.34",nocase; classtype:trojan-activity; sid:100000076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.217.215.21",nocase; classtype:trojan-activity; sid:100000077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.219.152.228",nocase; classtype:trojan-activity; sid:100000078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.224.200.146",nocase; classtype:trojan-activity; sid:100000079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.224.200.40",nocase; classtype:trojan-activity; sid:100000080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.237.21.36",nocase; classtype:trojan-activity; sid:100000081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.238.228.3",nocase; classtype:trojan-activity; sid:100000082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.240.249.121",nocase; classtype:trojan-activity; sid:100000083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.4.117.26",nocase; classtype:trojan-activity; sid:100000084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.79.112.254",nocase; classtype:trojan-activity; sid:100000085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.82.98.170",nocase; classtype:trojan-activity; sid:100000086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.84.240.228",nocase; classtype:trojan-activity; sid:100000087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.84.241.94",nocase; classtype:trojan-activity; sid:100000088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.12",nocase; classtype:trojan-activity; sid:100000089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.14",nocase; classtype:trojan-activity; sid:100000090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.16",nocase; classtype:trojan-activity; sid:100000091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.46",nocase; classtype:trojan-activity; sid:100000092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.91.245.47",nocase; classtype:trojan-activity; sid:100000093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.92.25.90",nocase; classtype:trojan-activity; sid:100000094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.92.25.95",nocase; classtype:trojan-activity; sid:100000095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.97.184.180",nocase; classtype:trojan-activity; sid:100000096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.168.98.159",nocase; classtype:trojan-activity; sid:100000097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.184.75.123",nocase; classtype:trojan-activity; sid:100000098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.206.93.94",nocase; classtype:trojan-activity; sid:100000099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.33.52.85",nocase; classtype:trojan-activity; sid:100000100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.61.86.37",nocase; classtype:trojan-activity; sid:100000101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"104.7.141.172",nocase; classtype:trojan-activity; sid:100000102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"106.1.111.91",nocase; classtype:trojan-activity; sid:100000103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"106.104.172.178",nocase; classtype:trojan-activity; sid:100000104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"106.104.193.155",nocase; classtype:trojan-activity; sid:100000105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"106.105.33.43",nocase; classtype:trojan-activity; sid:100000106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.172.104.105",nocase; classtype:trojan-activity; sid:100000107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.172.193.132",nocase; classtype:trojan-activity; sid:100000108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.172.249.148",nocase; classtype:trojan-activity; sid:100000109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.173.219.80",nocase; classtype:trojan-activity; sid:100000110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.173.23.240",nocase; classtype:trojan-activity; sid:100000111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.174.250.107",nocase; classtype:trojan-activity; sid:100000112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.174.61.139",nocase; classtype:trojan-activity; sid:100000113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.175.197.135",nocase; classtype:trojan-activity; sid:100000114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.175.31.130",nocase; classtype:trojan-activity; sid:100000115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.175.33.48",nocase; classtype:trojan-activity; sid:100000116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.181.136.96",nocase; classtype:trojan-activity; sid:100000117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.194.242.170",nocase; classtype:trojan-activity; sid:100000118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.219.185.75",nocase; classtype:trojan-activity; sid:100000119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.220.119.25",nocase; classtype:trojan-activity; sid:100000120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"107.221.96.202",nocase; classtype:trojan-activity; sid:100000121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"108.190.201.37",nocase; classtype:trojan-activity; sid:100000122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"108.190.250.48",nocase; classtype:trojan-activity; sid:100000123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"108.249.194.121",nocase; classtype:trojan-activity; sid:100000124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.124.90.229",nocase; classtype:trojan-activity; sid:100000125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.233.196.232",nocase; classtype:trojan-activity; sid:100000126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.235.7.228",nocase; classtype:trojan-activity; sid:100000127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.248.58.238",nocase; classtype:trojan-activity; sid:100000128; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.86.85.253",nocase; classtype:trojan-activity; sid:100000129; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.95.200.102",nocase; classtype:trojan-activity; sid:100000130; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.95.200.230",nocase; classtype:trojan-activity; sid:100000131; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.96.127.90",nocase; classtype:trojan-activity; sid:100000132; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.96.57.246",nocase; classtype:trojan-activity; sid:100000133; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"109.99.37.97",nocase; classtype:trojan-activity; sid:100000134; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.14.58.190",nocase; classtype:trojan-activity; sid:100000135; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.228.195.46",nocase; classtype:trojan-activity; sid:100000136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.248.124.254",nocase; classtype:trojan-activity; sid:100000137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.248.175.141",nocase; classtype:trojan-activity; sid:100000138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.248.251.194",nocase; classtype:trojan-activity; sid:100000139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.251.10.18",nocase; classtype:trojan-activity; sid:100000140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.253.213.198",nocase; classtype:trojan-activity; sid:100000141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.255.101.184",nocase; classtype:trojan-activity; sid:100000142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.145.127",nocase; classtype:trojan-activity; sid:100000143; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.208.21",nocase; classtype:trojan-activity; sid:100000144; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.221.77",nocase; classtype:trojan-activity; sid:100000145; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.223.92",nocase; classtype:trojan-activity; sid:100000146; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.233.147",nocase; classtype:trojan-activity; sid:100000147; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.235.57",nocase; classtype:trojan-activity; sid:100000148; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.35.4.2",nocase; classtype:trojan-activity; sid:100000149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.89.10.147",nocase; classtype:trojan-activity; sid:100000150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"110.89.222.213",nocase; classtype:trojan-activity; sid:100000151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.118.41.173",nocase; classtype:trojan-activity; sid:100000152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.118.88.128",nocase; classtype:trojan-activity; sid:100000153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.118.88.61",nocase; classtype:trojan-activity; sid:100000154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.119.245.114",nocase; classtype:trojan-activity; sid:100000155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.125.67.125",nocase; classtype:trojan-activity; sid:100000156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.163.50.120",nocase; classtype:trojan-activity; sid:100000157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.170.86.31",nocase; classtype:trojan-activity; sid:100000158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.172.57.20",nocase; classtype:trojan-activity; sid:100000159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.171.111",nocase; classtype:trojan-activity; sid:100000160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.177.85",nocase; classtype:trojan-activity; sid:100000161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.23.84",nocase; classtype:trojan-activity; sid:100000162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.230.136",nocase; classtype:trojan-activity; sid:100000163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.27.9",nocase; classtype:trojan-activity; sid:100000164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.185.49.223",nocase; classtype:trojan-activity; sid:100000165; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.103.122",nocase; classtype:trojan-activity; sid:100000166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.103.66",nocase; classtype:trojan-activity; sid:100000167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.104.141",nocase; classtype:trojan-activity; sid:100000168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.106.19",nocase; classtype:trojan-activity; sid:100000169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.121.222",nocase; classtype:trojan-activity; sid:100000170; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.121.223",nocase; classtype:trojan-activity; sid:100000171; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.121.226",nocase; classtype:trojan-activity; sid:100000172; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.121.228",nocase; classtype:trojan-activity; sid:100000173; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.26.243",nocase; classtype:trojan-activity; sid:100000174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"111.38.8.81",nocase; classtype:trojan-activity; sid:100000175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.111.108.184",nocase; classtype:trojan-activity; sid:100000176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.133.222.151",nocase; classtype:trojan-activity; sid:100000177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.170.124.75",nocase; classtype:trojan-activity; sid:100000178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.170.233.9",nocase; classtype:trojan-activity; sid:100000179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.186.210.211",nocase; classtype:trojan-activity; sid:100000180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.186.96.252",nocase; classtype:trojan-activity; sid:100000181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.187.91.117",nocase; classtype:trojan-activity; sid:100000182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.214.127.42",nocase; classtype:trojan-activity; sid:100000183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.225.187.19",nocase; classtype:trojan-activity; sid:100000184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.225.236.77",nocase; classtype:trojan-activity; sid:100000185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.225.239.126",nocase; classtype:trojan-activity; sid:100000186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.225.43.27",nocase; classtype:trojan-activity; sid:100000187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.226.162.148",nocase; classtype:trojan-activity; sid:100000188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.226.67.193",nocase; classtype:trojan-activity; sid:100000189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.228.180.95",nocase; classtype:trojan-activity; sid:100000190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.229.178.109",nocase; classtype:trojan-activity; sid:100000191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.230.168.103",nocase; classtype:trojan-activity; sid:100000192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.234.218.202",nocase; classtype:trojan-activity; sid:100000193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.235.188.86",nocase; classtype:trojan-activity; sid:100000194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.236.171.69",nocase; classtype:trojan-activity; sid:100000195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.141.241",nocase; classtype:trojan-activity; sid:100000196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.144.226",nocase; classtype:trojan-activity; sid:100000197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.75.157",nocase; classtype:trojan-activity; sid:100000198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.237.99.207",nocase; classtype:trojan-activity; sid:100000199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.238.143.135",nocase; classtype:trojan-activity; sid:100000200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.238.190.207",nocase; classtype:trojan-activity; sid:100000201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.238.227.228",nocase; classtype:trojan-activity; sid:100000202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.238.39.2",nocase; classtype:trojan-activity; sid:100000203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.240.216.17",nocase; classtype:trojan-activity; sid:100000204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.245.12.89",nocase; classtype:trojan-activity; sid:100000205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.245.8.24",nocase; classtype:trojan-activity; sid:100000206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.246.126.58",nocase; classtype:trojan-activity; sid:100000207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.246.162.50",nocase; classtype:trojan-activity; sid:100000208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.246.180.49",nocase; classtype:trojan-activity; sid:100000209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.100.14",nocase; classtype:trojan-activity; sid:100000210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.16.222",nocase; classtype:trojan-activity; sid:100000211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.191.118",nocase; classtype:trojan-activity; sid:100000212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.214.146",nocase; classtype:trojan-activity; sid:100000213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.240.226",nocase; classtype:trojan-activity; sid:100000214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.247.82.122",nocase; classtype:trojan-activity; sid:100000215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.248.148.90",nocase; classtype:trojan-activity; sid:100000216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.248.197.164",nocase; classtype:trojan-activity; sid:100000217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.249.109.217",nocase; classtype:trojan-activity; sid:100000218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.249.118.157",nocase; classtype:trojan-activity; sid:100000219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.250.102.173",nocase; classtype:trojan-activity; sid:100000220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.251.218.210",nocase; classtype:trojan-activity; sid:100000221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.252.196.17",nocase; classtype:trojan-activity; sid:100000222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.252.221.244",nocase; classtype:trojan-activity; sid:100000223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.254.208.123",nocase; classtype:trojan-activity; sid:100000224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.255.6.129",nocase; classtype:trojan-activity; sid:100000225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.255.8.235",nocase; classtype:trojan-activity; sid:100000226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.26.212.80",nocase; classtype:trojan-activity; sid:100000227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.111",nocase; classtype:trojan-activity; sid:100000228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.117",nocase; classtype:trojan-activity; sid:100000229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.131",nocase; classtype:trojan-activity; sid:100000230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.132",nocase; classtype:trojan-activity; sid:100000231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.133",nocase; classtype:trojan-activity; sid:100000232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.138",nocase; classtype:trojan-activity; sid:100000233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.139",nocase; classtype:trojan-activity; sid:100000234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.143",nocase; classtype:trojan-activity; sid:100000235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.146",nocase; classtype:trojan-activity; sid:100000236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.147",nocase; classtype:trojan-activity; sid:100000237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.149",nocase; classtype:trojan-activity; sid:100000238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.151",nocase; classtype:trojan-activity; sid:100000239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.158",nocase; classtype:trojan-activity; sid:100000240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.162",nocase; classtype:trojan-activity; sid:100000241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.165",nocase; classtype:trojan-activity; sid:100000242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.175",nocase; classtype:trojan-activity; sid:100000243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.177",nocase; classtype:trojan-activity; sid:100000244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.179",nocase; classtype:trojan-activity; sid:100000245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.124.180",nocase; classtype:trojan-activity; sid:100000246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.127.155",nocase; classtype:trojan-activity; sid:100000247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.80.120",nocase; classtype:trojan-activity; sid:100000248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.82.29",nocase; classtype:trojan-activity; sid:100000249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.83.23",nocase; classtype:trojan-activity; sid:100000250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.85.113",nocase; classtype:trojan-activity; sid:100000251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.87.130",nocase; classtype:trojan-activity; sid:100000252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.88.116",nocase; classtype:trojan-activity; sid:100000253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.27.91.212",nocase; classtype:trojan-activity; sid:100000254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.158",nocase; classtype:trojan-activity; sid:100000255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.159",nocase; classtype:trojan-activity; sid:100000256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.168",nocase; classtype:trojan-activity; sid:100000257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.177",nocase; classtype:trojan-activity; sid:100000258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.188",nocase; classtype:trojan-activity; sid:100000259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.200",nocase; classtype:trojan-activity; sid:100000260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.219",nocase; classtype:trojan-activity; sid:100000261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.229",nocase; classtype:trojan-activity; sid:100000262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.230",nocase; classtype:trojan-activity; sid:100000263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.245",nocase; classtype:trojan-activity; sid:100000264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.247",nocase; classtype:trojan-activity; sid:100000265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.90",nocase; classtype:trojan-activity; sid:100000266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.1.91",nocase; classtype:trojan-activity; sid:100000267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.33",nocase; classtype:trojan-activity; sid:100000268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.38",nocase; classtype:trojan-activity; sid:100000269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.43",nocase; classtype:trojan-activity; sid:100000270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.48",nocase; classtype:trojan-activity; sid:100000271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.110.62",nocase; classtype:trojan-activity; sid:100000272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.38.19",nocase; classtype:trojan-activity; sid:100000273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.103",nocase; classtype:trojan-activity; sid:100000274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.124",nocase; classtype:trojan-activity; sid:100000275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.136",nocase; classtype:trojan-activity; sid:100000276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.57",nocase; classtype:trojan-activity; sid:100000277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.4.68",nocase; classtype:trojan-activity; sid:100000278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.30.97.184",nocase; classtype:trojan-activity; sid:100000279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.0.113",nocase; classtype:trojan-activity; sid:100000280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.176.16",nocase; classtype:trojan-activity; sid:100000281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.177.39",nocase; classtype:trojan-activity; sid:100000282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.240.239",nocase; classtype:trojan-activity; sid:100000283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.31.87.98",nocase; classtype:trojan-activity; sid:100000284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.53.224.79",nocase; classtype:trojan-activity; sid:100000285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.53.227.66",nocase; classtype:trojan-activity; sid:100000286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.65.53.175",nocase; classtype:trojan-activity; sid:100000287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.153.37",nocase; classtype:trojan-activity; sid:100000288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.162.159",nocase; classtype:trojan-activity; sid:100000289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.162.49",nocase; classtype:trojan-activity; sid:100000290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.175.147",nocase; classtype:trojan-activity; sid:100000291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.176.112",nocase; classtype:trojan-activity; sid:100000292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.176.84",nocase; classtype:trojan-activity; sid:100000293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.226.202",nocase; classtype:trojan-activity; sid:100000294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.72.231.35",nocase; classtype:trojan-activity; sid:100000295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.78.45.158",nocase; classtype:trojan-activity; sid:100000296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.80.127.91",nocase; classtype:trojan-activity; sid:100000297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.80.215.101",nocase; classtype:trojan-activity; sid:100000298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.82.146.253",nocase; classtype:trojan-activity; sid:100000299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.82.18.255",nocase; classtype:trojan-activity; sid:100000300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.82.224.139",nocase; classtype:trojan-activity; sid:100000301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"112.93.29.211",nocase; classtype:trojan-activity; sid:100000302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.11.95.254",nocase; classtype:trojan-activity; sid:100000303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.122.238.68",nocase; classtype:trojan-activity; sid:100000304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.161.58.249",nocase; classtype:trojan-activity; sid:100000305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.161.78.185",nocase; classtype:trojan-activity; sid:100000306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.227.194.172",nocase; classtype:trojan-activity; sid:100000307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.227.35.229",nocase; classtype:trojan-activity; sid:100000308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.231.211.131",nocase; classtype:trojan-activity; sid:100000309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.254.169.251",nocase; classtype:trojan-activity; sid:100000310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.128.133",nocase; classtype:trojan-activity; sid:100000311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.133.16",nocase; classtype:trojan-activity; sid:100000312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.136.39",nocase; classtype:trojan-activity; sid:100000313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.144.42",nocase; classtype:trojan-activity; sid:100000314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.59.191.47",nocase; classtype:trojan-activity; sid:100000315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.61.204.205",nocase; classtype:trojan-activity; sid:100000316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.87.32.93",nocase; classtype:trojan-activity; sid:100000317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"113.89.43.185",nocase; classtype:trojan-activity; sid:100000318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.111.242.3",nocase; classtype:trojan-activity; sid:100000319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.224.203.128",nocase; classtype:trojan-activity; sid:100000320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.229.165.194",nocase; classtype:trojan-activity; sid:100000321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.30.54.64",nocase; classtype:trojan-activity; sid:100000322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"114.79.172.42",nocase; classtype:trojan-activity; sid:100000323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.165.216.112",nocase; classtype:trojan-activity; sid:100000324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.201.38.185",nocase; classtype:trojan-activity; sid:100000325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.42.47.36",nocase; classtype:trojan-activity; sid:100000326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.50.227.209",nocase; classtype:trojan-activity; sid:100000327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.53.254.187",nocase; classtype:trojan-activity; sid:100000328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.55.158.93",nocase; classtype:trojan-activity; sid:100000329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.56.131.242",nocase; classtype:trojan-activity; sid:100000330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.56.133.96",nocase; classtype:trojan-activity; sid:100000331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.56.152.194",nocase; classtype:trojan-activity; sid:100000332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.58.132.140",nocase; classtype:trojan-activity; sid:100000333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.59.233.160",nocase; classtype:trojan-activity; sid:100000334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.73.3.11",nocase; classtype:trojan-activity; sid:100000335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.92.174.231",nocase; classtype:trojan-activity; sid:100000336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"115.97.142.58",nocase; classtype:trojan-activity; sid:100000337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.124.219.2",nocase; classtype:trojan-activity; sid:100000338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.132.151.60",nocase; classtype:trojan-activity; sid:100000339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.206.164.46",nocase; classtype:trojan-activity; sid:100000340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.211.100.26",nocase; classtype:trojan-activity; sid:100000341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"116.75.197.220",nocase; classtype:trojan-activity; sid:100000342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.204.138",nocase; classtype:trojan-activity; sid:100000343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.204.5",nocase; classtype:trojan-activity; sid:100000344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.220.126",nocase; classtype:trojan-activity; sid:100000345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.20.243.40",nocase; classtype:trojan-activity; sid:100000346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.200.76.54",nocase; classtype:trojan-activity; sid:100000347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.251.59.16",nocase; classtype:trojan-activity; sid:100000348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.26.104.74",nocase; classtype:trojan-activity; sid:100000349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.63.113.146",nocase; classtype:trojan-activity; sid:100000350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.63.195.140",nocase; classtype:trojan-activity; sid:100000351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.63.53.15",nocase; classtype:trojan-activity; sid:100000352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"117.86.105.110",nocase; classtype:trojan-activity; sid:100000353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.176.104.35",nocase; classtype:trojan-activity; sid:100000354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.176.157.64",nocase; classtype:trojan-activity; sid:100000355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.176.7.132",nocase; classtype:trojan-activity; sid:100000356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.223.32.74",nocase; classtype:trojan-activity; sid:100000357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.223.5.149",nocase; classtype:trojan-activity; sid:100000358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.223.72.141",nocase; classtype:trojan-activity; sid:100000359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.12.130",nocase; classtype:trojan-activity; sid:100000360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.128.147",nocase; classtype:trojan-activity; sid:100000361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.208.215",nocase; classtype:trojan-activity; sid:100000362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.209.108",nocase; classtype:trojan-activity; sid:100000363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.214.72",nocase; classtype:trojan-activity; sid:100000364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.88.146",nocase; classtype:trojan-activity; sid:100000365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.96.150",nocase; classtype:trojan-activity; sid:100000366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.232.96.6",nocase; classtype:trojan-activity; sid:100000367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.233.221.162",nocase; classtype:trojan-activity; sid:100000368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.233.63.194",nocase; classtype:trojan-activity; sid:100000369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.233.65.93",nocase; classtype:trojan-activity; sid:100000370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.42.125.246",nocase; classtype:trojan-activity; sid:100000371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.43.180.33",nocase; classtype:trojan-activity; sid:100000372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.79.50.203",nocase; classtype:trojan-activity; sid:100000373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.79.58.82",nocase; classtype:trojan-activity; sid:100000374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.99.179.164",nocase; classtype:trojan-activity; sid:100000375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.99.183.235",nocase; classtype:trojan-activity; sid:100000376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"118.99.239.217",nocase; classtype:trojan-activity; sid:100000377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.102.179.235",nocase; classtype:trojan-activity; sid:100000378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.108.161.25",nocase; classtype:trojan-activity; sid:100000379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.112.185.232",nocase; classtype:trojan-activity; sid:100000380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.123.238.52",nocase; classtype:trojan-activity; sid:100000381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.14.143.145",nocase; classtype:trojan-activity; sid:100000382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.147.213.57",nocase; classtype:trojan-activity; sid:100000383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.164.18.235",nocase; classtype:trojan-activity; sid:100000384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.164.218.229",nocase; classtype:trojan-activity; sid:100000385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.165.107.93",nocase; classtype:trojan-activity; sid:100000386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.165.241.222",nocase; classtype:trojan-activity; sid:100000387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.165.27.77",nocase; classtype:trojan-activity; sid:100000388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.165.68.145",nocase; classtype:trojan-activity; sid:100000389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.166.170.241",nocase; classtype:trojan-activity; sid:100000390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.166.97.6",nocase; classtype:trojan-activity; sid:100000391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.167.26.33",nocase; classtype:trojan-activity; sid:100000392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.177.147.38",nocase; classtype:trojan-activity; sid:100000393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.178.248.123",nocase; classtype:trojan-activity; sid:100000394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.179.43.1",nocase; classtype:trojan-activity; sid:100000395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.18.38.144",nocase; classtype:trojan-activity; sid:100000396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.180.106.217",nocase; classtype:trojan-activity; sid:100000397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.180.33.161",nocase; classtype:trojan-activity; sid:100000398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.181.119.21",nocase; classtype:trojan-activity; sid:100000399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.181.124.203",nocase; classtype:trojan-activity; sid:100000400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.182.97.232",nocase; classtype:trojan-activity; sid:100000401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.183.115.103",nocase; classtype:trojan-activity; sid:100000402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.184.172.199",nocase; classtype:trojan-activity; sid:100000403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.187.195.161",nocase; classtype:trojan-activity; sid:100000404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.187.245.61",nocase; classtype:trojan-activity; sid:100000405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.189.137.195",nocase; classtype:trojan-activity; sid:100000406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.189.227.244",nocase; classtype:trojan-activity; sid:100000407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.150.85",nocase; classtype:trojan-activity; sid:100000408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.187.206",nocase; classtype:trojan-activity; sid:100000409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.215.221",nocase; classtype:trojan-activity; sid:100000410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.240.20",nocase; classtype:trojan-activity; sid:100000411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.191.255.236",nocase; classtype:trojan-activity; sid:100000412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.204.30.144",nocase; classtype:trojan-activity; sid:100000413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.250.129.231",nocase; classtype:trojan-activity; sid:100000414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.251.105.221",nocase; classtype:trojan-activity; sid:100000415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.131.155",nocase; classtype:trojan-activity; sid:100000416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.143.46",nocase; classtype:trojan-activity; sid:100000417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.143.71",nocase; classtype:trojan-activity; sid:100000418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.144.75",nocase; classtype:trojan-activity; sid:100000419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.148.115",nocase; classtype:trojan-activity; sid:100000420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.155.57",nocase; classtype:trojan-activity; sid:100000421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.195.90",nocase; classtype:trojan-activity; sid:100000422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.206.43",nocase; classtype:trojan-activity; sid:100000423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"119.56.220.170",nocase; classtype:trojan-activity; sid:100000424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.132.113.2",nocase; classtype:trojan-activity; sid:100000425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.15.69.83",nocase; classtype:trojan-activity; sid:100000426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.178.187.6",nocase; classtype:trojan-activity; sid:100000427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.178.187.7",nocase; classtype:trojan-activity; sid:100000428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.178.187.8",nocase; classtype:trojan-activity; sid:100000429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.178.187.9",nocase; classtype:trojan-activity; sid:100000430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.207.39.227",nocase; classtype:trojan-activity; sid:100000431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"12.25.204.189",nocase; classtype:trojan-activity; sid:100000432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.0.255.173",nocase; classtype:trojan-activity; sid:100000433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.142.222.22",nocase; classtype:trojan-activity; sid:100000434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.150.213.110",nocase; classtype:trojan-activity; sid:100000435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.151.248.134",nocase; classtype:trojan-activity; sid:100000436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.180",nocase; classtype:trojan-activity; sid:100000437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.183",nocase; classtype:trojan-activity; sid:100000438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.185",nocase; classtype:trojan-activity; sid:100000439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.186",nocase; classtype:trojan-activity; sid:100000440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.193",nocase; classtype:trojan-activity; sid:100000441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.201",nocase; classtype:trojan-activity; sid:100000442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.202",nocase; classtype:trojan-activity; sid:100000443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.204",nocase; classtype:trojan-activity; sid:100000444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.208",nocase; classtype:trojan-activity; sid:100000445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.212",nocase; classtype:trojan-activity; sid:100000446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.193.91.233",nocase; classtype:trojan-activity; sid:100000447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.126.235",nocase; classtype:trojan-activity; sid:100000448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.126.239",nocase; classtype:trojan-activity; sid:100000449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.126.250",nocase; classtype:trojan-activity; sid:100000450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.126.60",nocase; classtype:trojan-activity; sid:100000451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.127.187",nocase; classtype:trojan-activity; sid:100000452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.209.99.127",nocase; classtype:trojan-activity; sid:100000453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.50.66.60",nocase; classtype:trojan-activity; sid:100000454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.50.93.115",nocase; classtype:trojan-activity; sid:100000455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.6.8.11",nocase; classtype:trojan-activity; sid:100000456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"120.7.75.99",nocase; classtype:trojan-activity; sid:100000457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.100.114.164",nocase; classtype:trojan-activity; sid:100000458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.100.96.8",nocase; classtype:trojan-activity; sid:100000459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.121.44.222",nocase; classtype:trojan-activity; sid:100000460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.123.53.25",nocase; classtype:trojan-activity; sid:100000461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.127.155.220",nocase; classtype:trojan-activity; sid:100000462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.141.11.56",nocase; classtype:trojan-activity; sid:100000463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.15.142.137",nocase; classtype:trojan-activity; sid:100000464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.159.22.144",nocase; classtype:trojan-activity; sid:100000465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.170.234.142",nocase; classtype:trojan-activity; sid:100000466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.170.8.146",nocase; classtype:trojan-activity; sid:100000467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.185.31.2",nocase; classtype:trojan-activity; sid:100000468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.190.36.8",nocase; classtype:trojan-activity; sid:100000469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.20.104.26",nocase; classtype:trojan-activity; sid:100000470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.225.11.163",nocase; classtype:trojan-activity; sid:100000471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.237.226.202",nocase; classtype:trojan-activity; sid:100000472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.24.116.173",nocase; classtype:trojan-activity; sid:100000473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.25.54.241",nocase; classtype:trojan-activity; sid:100000474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.254.76.17",nocase; classtype:trojan-activity; sid:100000475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"121.88.99.236",nocase; classtype:trojan-activity; sid:100000476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.100.150.204",nocase; classtype:trojan-activity; sid:100000477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.160.147.53",nocase; classtype:trojan-activity; sid:100000478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.188.86.225",nocase; classtype:trojan-activity; sid:100000479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.199.66.28",nocase; classtype:trojan-activity; sid:100000480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.199.72.23",nocase; classtype:trojan-activity; sid:100000481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.199.79.27",nocase; classtype:trojan-activity; sid:100000482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.202.37.85",nocase; classtype:trojan-activity; sid:100000483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"122.254.33.214",nocase; classtype:trojan-activity; sid:100000484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.0.240.58",nocase; classtype:trojan-activity; sid:100000485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.10.15.35",nocase; classtype:trojan-activity; sid:100000486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.124.244",nocase; classtype:trojan-activity; sid:100000487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.170.237",nocase; classtype:trojan-activity; sid:100000488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.182.187",nocase; classtype:trojan-activity; sid:100000489; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.19.248",nocase; classtype:trojan-activity; sid:100000490; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.200.98",nocase; classtype:trojan-activity; sid:100000491; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.110.238.188",nocase; classtype:trojan-activity; sid:100000492; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.129.2.28",nocase; classtype:trojan-activity; sid:100000493; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.129.84.36",nocase; classtype:trojan-activity; sid:100000494; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.130.208.52",nocase; classtype:trojan-activity; sid:100000495; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.130.27.19",nocase; classtype:trojan-activity; sid:100000496; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.130.37.182",nocase; classtype:trojan-activity; sid:100000497; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.131.186.250",nocase; classtype:trojan-activity; sid:100000498; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.132.219.147",nocase; classtype:trojan-activity; sid:100000499; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.133.98.135",nocase; classtype:trojan-activity; sid:100000500; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.134.14.130",nocase; classtype:trojan-activity; sid:100000501; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.154.236.114",nocase; classtype:trojan-activity; sid:100000502; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.159.8.100",nocase; classtype:trojan-activity; sid:100000503; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.183.16.71",nocase; classtype:trojan-activity; sid:100000504; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.191.164.92",nocase; classtype:trojan-activity; sid:100000505; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.192.101.163",nocase; classtype:trojan-activity; sid:100000506; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.193.53.237",nocase; classtype:trojan-activity; sid:100000507; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.194.235.37",nocase; classtype:trojan-activity; sid:100000508; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.194.35.146",nocase; classtype:trojan-activity; sid:100000509; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.194.52.79",nocase; classtype:trojan-activity; sid:100000510; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.194.60.238",nocase; classtype:trojan-activity; sid:100000511; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.195.112.240",nocase; classtype:trojan-activity; sid:100000512; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.195.184.191",nocase; classtype:trojan-activity; sid:100000513; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.195.98.141",nocase; classtype:trojan-activity; sid:100000514; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.212.29.154",nocase; classtype:trojan-activity; sid:100000515; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.213.225.130",nocase; classtype:trojan-activity; sid:100000516; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.233.130.162",nocase; classtype:trojan-activity; sid:100000517; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.233.152.249",nocase; classtype:trojan-activity; sid:100000518; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.234.116.110",nocase; classtype:trojan-activity; sid:100000519; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.234.184.57",nocase; classtype:trojan-activity; sid:100000520; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.240.103.89",nocase; classtype:trojan-activity; sid:100000521; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.240.181.57",nocase; classtype:trojan-activity; sid:100000522; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.240.79.61",nocase; classtype:trojan-activity; sid:100000523; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.241.11.41",nocase; classtype:trojan-activity; sid:100000524; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.241.148.58",nocase; classtype:trojan-activity; sid:100000525; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.241.184.124",nocase; classtype:trojan-activity; sid:100000526; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.28.217.23",nocase; classtype:trojan-activity; sid:100000527; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.5.5.242",nocase; classtype:trojan-activity; sid:100000528; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"123.9.193.157",nocase; classtype:trojan-activity; sid:100000529; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.129.221.150",nocase; classtype:trojan-activity; sid:100000530; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.129.76.230",nocase; classtype:trojan-activity; sid:100000531; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.129.78.176",nocase; classtype:trojan-activity; sid:100000532; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.130.40.31",nocase; classtype:trojan-activity; sid:100000533; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.104.82",nocase; classtype:trojan-activity; sid:100000534; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.151.135",nocase; classtype:trojan-activity; sid:100000535; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.24.185",nocase; classtype:trojan-activity; sid:100000536; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.26.243",nocase; classtype:trojan-activity; sid:100000537; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.131.54.33",nocase; classtype:trojan-activity; sid:100000538; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.132.110.150",nocase; classtype:trojan-activity; sid:100000539; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.135.34.49",nocase; classtype:trojan-activity; sid:100000540; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.152.26.45",nocase; classtype:trojan-activity; sid:100000541; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.153.136.175",nocase; classtype:trojan-activity; sid:100000542; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.153.236.6",nocase; classtype:trojan-activity; sid:100000543; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.160.126.238",nocase; classtype:trojan-activity; sid:100000544; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.163.65.64",nocase; classtype:trojan-activity; sid:100000545; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.165.123.7",nocase; classtype:trojan-activity; sid:100000546; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.187.111.160",nocase; classtype:trojan-activity; sid:100000547; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.199.56.198",nocase; classtype:trojan-activity; sid:100000548; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.230.174.233",nocase; classtype:trojan-activity; sid:100000549; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.254.251.54",nocase; classtype:trojan-activity; sid:100000550; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.5.112.43",nocase; classtype:trojan-activity; sid:100000551; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.5.92.20",nocase; classtype:trojan-activity; sid:100000552; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.6.0.4",nocase; classtype:trojan-activity; sid:100000553; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.67.89.28",nocase; classtype:trojan-activity; sid:100000554; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.7.254.85",nocase; classtype:trojan-activity; sid:100000555; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.80.46.73",nocase; classtype:trojan-activity; sid:100000556; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"124.93.94.207",nocase; classtype:trojan-activity; sid:100000557; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.105.217.252",nocase; classtype:trojan-activity; sid:100000558; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.128.28.161",nocase; classtype:trojan-activity; sid:100000559; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.142.93.34",nocase; classtype:trojan-activity; sid:100000560; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.191.113.212",nocase; classtype:trojan-activity; sid:100000561; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.40.1.235",nocase; classtype:trojan-activity; sid:100000562; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.40.73.68",nocase; classtype:trojan-activity; sid:100000563; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.43.23.193",nocase; classtype:trojan-activity; sid:100000564; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.46.142.96",nocase; classtype:trojan-activity; sid:100000565; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"125.46.255.38",nocase; classtype:trojan-activity; sid:100000566; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"128.116.133.92",nocase; classtype:trojan-activity; sid:100000567; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"130.255.159.133",nocase; classtype:trojan-activity; sid:100000568; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"134.195.139.4",nocase; classtype:trojan-activity; sid:100000569; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"134.236.252.28",nocase; classtype:trojan-activity; sid:100000570; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"135.148.36.127",nocase; classtype:trojan-activity; sid:100000571; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"138.99.204.224",nocase; classtype:trojan-activity; sid:100000572; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"139.159.226.180",nocase; classtype:trojan-activity; sid:100000573; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"139.170.173.198",nocase; classtype:trojan-activity; sid:100000574; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"139.216.102.151",nocase; classtype:trojan-activity; sid:100000575; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.102.17.222",nocase; classtype:trojan-activity; sid:100000576; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.136.80.242",nocase; classtype:trojan-activity; sid:100000577; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.138.8.51",nocase; classtype:trojan-activity; sid:100000578; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.160.34.50",nocase; classtype:trojan-activity; sid:100000579; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.189.247.118",nocase; classtype:trojan-activity; sid:100000580; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.232.33.212",nocase; classtype:trojan-activity; sid:100000581; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.37.222.190",nocase; classtype:trojan-activity; sid:100000582; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.42.237.237",nocase; classtype:trojan-activity; sid:100000583; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.45.127.110",nocase; classtype:trojan-activity; sid:100000584; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.46.25.17",nocase; classtype:trojan-activity; sid:100000585; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.46.98.241",nocase; classtype:trojan-activity; sid:100000586; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.50.129.248",nocase; classtype:trojan-activity; sid:100000587; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14.55.29.2",nocase; classtype:trojan-activity; sid:100000588; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"142.11.216.5",nocase; classtype:trojan-activity; sid:100000589; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"142.177.56.127",nocase; classtype:trojan-activity; sid:100000590; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"143.198.120.58",nocase; classtype:trojan-activity; sid:100000591; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"146.71.79.230",nocase; classtype:trojan-activity; sid:100000592; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"148.69.108.177",nocase; classtype:trojan-activity; sid:100000593; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"149.255.15.134",nocase; classtype:trojan-activity; sid:100000594; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"149.255.15.184",nocase; classtype:trojan-activity; sid:100000595; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"149.255.15.87",nocase; classtype:trojan-activity; sid:100000596; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"149.255.15.99",nocase; classtype:trojan-activity; sid:100000597; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"14karatvisions.com",nocase; classtype:trojan-activity; sid:100000598; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"150.116.207.99",nocase; classtype:trojan-activity; sid:100000599; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"151.177.163.87",nocase; classtype:trojan-activity; sid:100000600; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"151.33.230.191",nocase; classtype:trojan-activity; sid:100000601; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"153.101.234.167",nocase; classtype:trojan-activity; sid:100000602; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"153.101.47.145",nocase; classtype:trojan-activity; sid:100000603; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"153.3.152.106",nocase; classtype:trojan-activity; sid:100000604; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"153.34.135.92",nocase; classtype:trojan-activity; sid:100000605; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"157.230.219.6",nocase; classtype:trojan-activity; sid:100000606; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"158.101.165.14",nocase; classtype:trojan-activity; sid:100000607; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"158.174.213.128",nocase; classtype:trojan-activity; sid:100000608; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"158.51.125.115",nocase; classtype:trojan-activity; sid:100000609; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"159.224.74.112",nocase; classtype:trojan-activity; sid:100000610; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"162.194.28.60",nocase; classtype:trojan-activity; sid:100000611; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"162.209.98.174",nocase; classtype:trojan-activity; sid:100000612; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"163.53.206.228",nocase; classtype:trojan-activity; sid:100000613; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"165.90.16.5",nocase; classtype:trojan-activity; sid:100000614; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"167.114.172.177",nocase; classtype:trojan-activity; sid:100000615; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"170.81.238.178",nocase; classtype:trojan-activity; sid:100000616; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.120.222.98",nocase; classtype:trojan-activity; sid:100000617; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.121.255.12",nocase; classtype:trojan-activity; sid:100000618; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.123.14.190",nocase; classtype:trojan-activity; sid:100000619; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.34.176.217",nocase; classtype:trojan-activity; sid:100000620; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.34.179.178",nocase; classtype:trojan-activity; sid:100000621; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.35.162.156",nocase; classtype:trojan-activity; sid:100000622; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"171.35.174.198",nocase; classtype:trojan-activity; sid:100000623; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.105.36.168",nocase; classtype:trojan-activity; sid:100000624; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.105.68.51",nocase; classtype:trojan-activity; sid:100000625; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.114.244.127",nocase; classtype:trojan-activity; sid:100000626; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.245.186.107",nocase; classtype:trojan-activity; sid:100000627; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.245.5.185",nocase; classtype:trojan-activity; sid:100000628; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.245.5.190",nocase; classtype:trojan-activity; sid:100000629; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.245.81.19",nocase; classtype:trojan-activity; sid:100000630; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.93.176.142",nocase; classtype:trojan-activity; sid:100000631; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"172.93.194.114",nocase; classtype:trojan-activity; sid:100000632; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.167.85.89",nocase; classtype:trojan-activity; sid:100000633; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.169.46.85",nocase; classtype:trojan-activity; sid:100000634; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.19.58.108",nocase; classtype:trojan-activity; sid:100000635; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.233.85.171",nocase; classtype:trojan-activity; sid:100000636; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.235.209.70",nocase; classtype:trojan-activity; sid:100000637; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.25.113.8",nocase; classtype:trojan-activity; sid:100000638; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.52.95.134",nocase; classtype:trojan-activity; sid:100000639; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.52.97.25",nocase; classtype:trojan-activity; sid:100000640; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.56.119.108",nocase; classtype:trojan-activity; sid:100000641; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.56.92.166",nocase; classtype:trojan-activity; sid:100000642; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"173.63.64.213",nocase; classtype:trojan-activity; sid:100000643; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.61.3.149",nocase; classtype:trojan-activity; sid:100000644; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.73.246.193",nocase; classtype:trojan-activity; sid:100000645; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.81.78.7",nocase; classtype:trojan-activity; sid:100000646; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"174.83.73.163",nocase; classtype:trojan-activity; sid:100000647; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.10.147.167",nocase; classtype:trojan-activity; sid:100000648; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.11.65.112",nocase; classtype:trojan-activity; sid:100000649; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.117.66.74",nocase; classtype:trojan-activity; sid:100000650; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.169.13.182",nocase; classtype:trojan-activity; sid:100000651; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.201.104.192",nocase; classtype:trojan-activity; sid:100000652; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.208.230.8",nocase; classtype:trojan-activity; sid:100000653; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.213.25.192",nocase; classtype:trojan-activity; sid:100000654; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.42.46.118",nocase; classtype:trojan-activity; sid:100000655; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.7.184.32",nocase; classtype:trojan-activity; sid:100000656; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"175.9.24.110",nocase; classtype:trojan-activity; sid:100000657; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.111.174.35",nocase; classtype:trojan-activity; sid:100000658; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.111.174.63",nocase; classtype:trojan-activity; sid:100000659; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.111.174.66",nocase; classtype:trojan-activity; sid:100000660; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.111.174.67",nocase; classtype:trojan-activity; sid:100000661; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.104",nocase; classtype:trojan-activity; sid:100000662; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.113",nocase; classtype:trojan-activity; sid:100000663; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.60",nocase; classtype:trojan-activity; sid:100000664; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.66",nocase; classtype:trojan-activity; sid:100000665; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.76",nocase; classtype:trojan-activity; sid:100000666; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.84",nocase; classtype:trojan-activity; sid:100000667; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.161.91",nocase; classtype:trojan-activity; sid:100000668; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.113.174.139",nocase; classtype:trojan-activity; sid:100000669; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.12.117.70",nocase; classtype:trojan-activity; sid:100000670; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.123.7.115",nocase; classtype:trojan-activity; sid:100000671; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.123.7.127",nocase; classtype:trojan-activity; sid:100000672; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.124.7.225",nocase; classtype:trojan-activity; sid:100000673; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"176.240.84.106",nocase; classtype:trojan-activity; sid:100000674; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"177.11.92.78",nocase; classtype:trojan-activity; sid:100000675; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"177.131.226.235",nocase; classtype:trojan-activity; sid:100000676; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"177.54.82.154",nocase; classtype:trojan-activity; sid:100000677; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.124.182.187",nocase; classtype:trojan-activity; sid:100000678; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.150.174.65",nocase; classtype:trojan-activity; sid:100000679; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.151.143.2",nocase; classtype:trojan-activity; sid:100000680; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.165.122.141",nocase; classtype:trojan-activity; sid:100000681; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.17.171.144",nocase; classtype:trojan-activity; sid:100000682; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.0.143",nocase; classtype:trojan-activity; sid:100000683; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.1.179",nocase; classtype:trojan-activity; sid:100000684; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.10.164",nocase; classtype:trojan-activity; sid:100000685; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.10.76",nocase; classtype:trojan-activity; sid:100000686; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.10.94",nocase; classtype:trojan-activity; sid:100000687; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.101.51",nocase; classtype:trojan-activity; sid:100000688; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.102.138",nocase; classtype:trojan-activity; sid:100000689; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.102.142",nocase; classtype:trojan-activity; sid:100000690; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.102.162",nocase; classtype:trojan-activity; sid:100000691; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.102.25",nocase; classtype:trojan-activity; sid:100000692; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.103.173",nocase; classtype:trojan-activity; sid:100000693; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.103.52",nocase; classtype:trojan-activity; sid:100000694; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.104.112",nocase; classtype:trojan-activity; sid:100000695; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.104.67",nocase; classtype:trojan-activity; sid:100000696; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.104.69",nocase; classtype:trojan-activity; sid:100000697; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.105.213",nocase; classtype:trojan-activity; sid:100000698; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.105.238",nocase; classtype:trojan-activity; sid:100000699; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.105.7",nocase; classtype:trojan-activity; sid:100000700; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.107.0",nocase; classtype:trojan-activity; sid:100000701; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.107.71",nocase; classtype:trojan-activity; sid:100000702; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.108.173",nocase; classtype:trojan-activity; sid:100000703; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.108.87",nocase; classtype:trojan-activity; sid:100000704; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.109.118",nocase; classtype:trojan-activity; sid:100000705; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.110.201",nocase; classtype:trojan-activity; sid:100000706; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.111.135",nocase; classtype:trojan-activity; sid:100000707; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.111.171",nocase; classtype:trojan-activity; sid:100000708; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.111.190",nocase; classtype:trojan-activity; sid:100000709; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.135",nocase; classtype:trojan-activity; sid:100000710; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.159",nocase; classtype:trojan-activity; sid:100000711; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.198",nocase; classtype:trojan-activity; sid:100000712; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.112.85",nocase; classtype:trojan-activity; sid:100000713; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.114.146",nocase; classtype:trojan-activity; sid:100000714; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.114.151",nocase; classtype:trojan-activity; sid:100000715; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.114.57",nocase; classtype:trojan-activity; sid:100000716; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.115.166",nocase; classtype:trojan-activity; sid:100000717; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.116.101",nocase; classtype:trojan-activity; sid:100000718; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.116.138",nocase; classtype:trojan-activity; sid:100000719; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.116.20",nocase; classtype:trojan-activity; sid:100000720; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.116.242",nocase; classtype:trojan-activity; sid:100000721; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.118.112",nocase; classtype:trojan-activity; sid:100000722; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.119.69",nocase; classtype:trojan-activity; sid:100000723; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.12.135",nocase; classtype:trojan-activity; sid:100000724; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.120.154",nocase; classtype:trojan-activity; sid:100000725; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.121.228",nocase; classtype:trojan-activity; sid:100000726; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.121.54",nocase; classtype:trojan-activity; sid:100000727; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.122.28",nocase; classtype:trojan-activity; sid:100000728; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.213",nocase; classtype:trojan-activity; sid:100000729; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.232",nocase; classtype:trojan-activity; sid:100000730; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.248",nocase; classtype:trojan-activity; sid:100000731; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.26",nocase; classtype:trojan-activity; sid:100000732; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.123.91",nocase; classtype:trojan-activity; sid:100000733; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.124.4",nocase; classtype:trojan-activity; sid:100000734; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.125.14",nocase; classtype:trojan-activity; sid:100000735; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.125.149",nocase; classtype:trojan-activity; sid:100000736; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.126.129",nocase; classtype:trojan-activity; sid:100000737; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.126.46",nocase; classtype:trojan-activity; sid:100000738; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.127.202",nocase; classtype:trojan-activity; sid:100000739; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.127.223",nocase; classtype:trojan-activity; sid:100000740; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.14.14",nocase; classtype:trojan-activity; sid:100000741; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.14.155",nocase; classtype:trojan-activity; sid:100000742; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.15.199",nocase; classtype:trojan-activity; sid:100000743; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.15.232",nocase; classtype:trojan-activity; sid:100000744; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.15.44",nocase; classtype:trojan-activity; sid:100000745; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.16.26",nocase; classtype:trojan-activity; sid:100000746; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.17.236",nocase; classtype:trojan-activity; sid:100000747; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.19.160",nocase; classtype:trojan-activity; sid:100000748; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.19.163",nocase; classtype:trojan-activity; sid:100000749; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.158",nocase; classtype:trojan-activity; sid:100000750; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.217",nocase; classtype:trojan-activity; sid:100000751; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.225",nocase; classtype:trojan-activity; sid:100000752; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.254",nocase; classtype:trojan-activity; sid:100000753; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.2.59",nocase; classtype:trojan-activity; sid:100000754; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.20.126",nocase; classtype:trojan-activity; sid:100000755; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.20.7",nocase; classtype:trojan-activity; sid:100000756; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.20.74",nocase; classtype:trojan-activity; sid:100000757; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.21.41",nocase; classtype:trojan-activity; sid:100000758; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.22.120",nocase; classtype:trojan-activity; sid:100000759; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.24.166",nocase; classtype:trojan-activity; sid:100000760; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.24.232",nocase; classtype:trojan-activity; sid:100000761; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.25.129",nocase; classtype:trojan-activity; sid:100000762; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.25.177",nocase; classtype:trojan-activity; sid:100000763; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.27.32",nocase; classtype:trojan-activity; sid:100000764; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.27.46",nocase; classtype:trojan-activity; sid:100000765; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.29.233",nocase; classtype:trojan-activity; sid:100000766; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.3.86",nocase; classtype:trojan-activity; sid:100000767; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.30.109",nocase; classtype:trojan-activity; sid:100000768; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.30.133",nocase; classtype:trojan-activity; sid:100000769; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.30.151",nocase; classtype:trojan-activity; sid:100000770; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.31.55",nocase; classtype:trojan-activity; sid:100000771; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.32.146",nocase; classtype:trojan-activity; sid:100000772; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.32.186",nocase; classtype:trojan-activity; sid:100000773; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.33.179",nocase; classtype:trojan-activity; sid:100000774; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.33.32",nocase; classtype:trojan-activity; sid:100000775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.34.230",nocase; classtype:trojan-activity; sid:100000776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.35.170",nocase; classtype:trojan-activity; sid:100000777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.35.193",nocase; classtype:trojan-activity; sid:100000778; rev:1;) @@ -792,119 +792,119 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.38.12",nocase; classtype:trojan-activity; sid:100000786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.4.227",nocase; classtype:trojan-activity; sid:100000787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.4.29",nocase; classtype:trojan-activity; sid:100000788; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.43.121",nocase; classtype:trojan-activity; sid:100000789; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.43.217",nocase; classtype:trojan-activity; sid:100000790; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.43.238",nocase; classtype:trojan-activity; sid:100000791; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.44.186",nocase; classtype:trojan-activity; sid:100000792; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.44.241",nocase; classtype:trojan-activity; sid:100000793; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.40.209",nocase; classtype:trojan-activity; sid:100000789; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.42.46",nocase; classtype:trojan-activity; sid:100000790; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.43.121",nocase; classtype:trojan-activity; sid:100000791; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.43.217",nocase; classtype:trojan-activity; sid:100000792; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.44.186",nocase; classtype:trojan-activity; sid:100000793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.45.125",nocase; classtype:trojan-activity; sid:100000794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.45.26",nocase; classtype:trojan-activity; sid:100000795; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.46.41",nocase; classtype:trojan-activity; sid:100000796; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.46.59",nocase; classtype:trojan-activity; sid:100000797; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.47.15",nocase; classtype:trojan-activity; sid:100000798; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.47.181",nocase; classtype:trojan-activity; sid:100000799; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.47.222",nocase; classtype:trojan-activity; sid:100000800; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.47.80",nocase; classtype:trojan-activity; sid:100000801; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.48.40",nocase; classtype:trojan-activity; sid:100000802; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.46.59",nocase; classtype:trojan-activity; sid:100000796; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.47.220",nocase; classtype:trojan-activity; sid:100000797; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.47.222",nocase; classtype:trojan-activity; sid:100000798; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.47.80",nocase; classtype:trojan-activity; sid:100000799; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.48.140",nocase; classtype:trojan-activity; sid:100000800; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.48.223",nocase; classtype:trojan-activity; sid:100000801; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.48.67",nocase; classtype:trojan-activity; sid:100000802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.5.254",nocase; classtype:trojan-activity; sid:100000803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.5.44",nocase; classtype:trojan-activity; sid:100000804; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.5.74",nocase; classtype:trojan-activity; sid:100000805; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.50.217",nocase; classtype:trojan-activity; sid:100000806; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.50.42",nocase; classtype:trojan-activity; sid:100000807; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.50.217",nocase; classtype:trojan-activity; sid:100000805; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.50.42",nocase; classtype:trojan-activity; sid:100000806; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.50.54",nocase; classtype:trojan-activity; sid:100000807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.53.101",nocase; classtype:trojan-activity; sid:100000808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.54.186",nocase; classtype:trojan-activity; sid:100000809; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.54.234",nocase; classtype:trojan-activity; sid:100000810; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.54.58",nocase; classtype:trojan-activity; sid:100000811; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.55.99",nocase; classtype:trojan-activity; sid:100000812; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.56.11",nocase; classtype:trojan-activity; sid:100000813; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.56.185",nocase; classtype:trojan-activity; sid:100000814; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.56.56",nocase; classtype:trojan-activity; sid:100000815; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.57.134",nocase; classtype:trojan-activity; sid:100000816; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.57.14",nocase; classtype:trojan-activity; sid:100000817; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.57.183",nocase; classtype:trojan-activity; sid:100000818; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.58.230",nocase; classtype:trojan-activity; sid:100000819; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.58.234",nocase; classtype:trojan-activity; sid:100000820; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.58.235",nocase; classtype:trojan-activity; sid:100000821; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.59.106",nocase; classtype:trojan-activity; sid:100000822; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.60.247",nocase; classtype:trojan-activity; sid:100000823; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.61.103",nocase; classtype:trojan-activity; sid:100000824; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.61.210",nocase; classtype:trojan-activity; sid:100000825; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.62.241",nocase; classtype:trojan-activity; sid:100000826; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.62.60",nocase; classtype:trojan-activity; sid:100000827; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.64.156",nocase; classtype:trojan-activity; sid:100000828; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.64.17",nocase; classtype:trojan-activity; sid:100000829; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.64.35",nocase; classtype:trojan-activity; sid:100000830; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.65.208",nocase; classtype:trojan-activity; sid:100000831; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.68.123",nocase; classtype:trojan-activity; sid:100000832; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.68.209",nocase; classtype:trojan-activity; sid:100000833; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.68.44",nocase; classtype:trojan-activity; sid:100000834; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.68.57",nocase; classtype:trojan-activity; sid:100000835; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.7.156",nocase; classtype:trojan-activity; sid:100000836; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.70.218",nocase; classtype:trojan-activity; sid:100000837; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.70.250",nocase; classtype:trojan-activity; sid:100000838; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.70.74",nocase; classtype:trojan-activity; sid:100000839; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.72.148",nocase; classtype:trojan-activity; sid:100000840; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.72.158",nocase; classtype:trojan-activity; sid:100000841; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.72.75",nocase; classtype:trojan-activity; sid:100000842; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.73.238",nocase; classtype:trojan-activity; sid:100000843; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.75.181",nocase; classtype:trojan-activity; sid:100000844; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.75.205",nocase; classtype:trojan-activity; sid:100000845; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.54.58",nocase; classtype:trojan-activity; sid:100000810; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.55.99",nocase; classtype:trojan-activity; sid:100000811; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.56.185",nocase; classtype:trojan-activity; sid:100000812; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.56.56",nocase; classtype:trojan-activity; sid:100000813; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.56.64",nocase; classtype:trojan-activity; sid:100000814; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.57.14",nocase; classtype:trojan-activity; sid:100000815; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.57.183",nocase; classtype:trojan-activity; sid:100000816; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.57.204",nocase; classtype:trojan-activity; sid:100000817; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.58.230",nocase; classtype:trojan-activity; sid:100000818; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.58.234",nocase; classtype:trojan-activity; sid:100000819; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.58.235",nocase; classtype:trojan-activity; sid:100000820; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.59.106",nocase; classtype:trojan-activity; sid:100000821; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.60.247",nocase; classtype:trojan-activity; sid:100000822; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.61.103",nocase; classtype:trojan-activity; sid:100000823; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.62.60",nocase; classtype:trojan-activity; sid:100000824; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.64.156",nocase; classtype:trojan-activity; sid:100000825; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.64.35",nocase; classtype:trojan-activity; sid:100000826; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.65.189",nocase; classtype:trojan-activity; sid:100000827; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.65.208",nocase; classtype:trojan-activity; sid:100000828; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.66.186",nocase; classtype:trojan-activity; sid:100000829; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.68.123",nocase; classtype:trojan-activity; sid:100000830; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.68.44",nocase; classtype:trojan-activity; sid:100000831; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.68.57",nocase; classtype:trojan-activity; sid:100000832; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.69.79",nocase; classtype:trojan-activity; sid:100000833; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.7.156",nocase; classtype:trojan-activity; sid:100000834; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.70.218",nocase; classtype:trojan-activity; sid:100000835; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.70.250",nocase; classtype:trojan-activity; sid:100000836; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.70.74",nocase; classtype:trojan-activity; sid:100000837; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.72.126",nocase; classtype:trojan-activity; sid:100000838; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.72.158",nocase; classtype:trojan-activity; sid:100000839; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.72.75",nocase; classtype:trojan-activity; sid:100000840; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.73.238",nocase; classtype:trojan-activity; sid:100000841; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.75.181",nocase; classtype:trojan-activity; sid:100000842; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.75.205",nocase; classtype:trojan-activity; sid:100000843; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.75.214",nocase; classtype:trojan-activity; sid:100000844; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.77.248",nocase; classtype:trojan-activity; sid:100000845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.77.47",nocase; classtype:trojan-activity; sid:100000846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.78.2",nocase; classtype:trojan-activity; sid:100000847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.78.242",nocase; classtype:trojan-activity; sid:100000848; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.78.243",nocase; classtype:trojan-activity; sid:100000849; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.79.146",nocase; classtype:trojan-activity; sid:100000850; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.79.146",nocase; classtype:trojan-activity; sid:100000849; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.79.198",nocase; classtype:trojan-activity; sid:100000850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.79.66",nocase; classtype:trojan-activity; sid:100000851; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.8.248",nocase; classtype:trojan-activity; sid:100000852; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.8.85",nocase; classtype:trojan-activity; sid:100000853; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.8.85",nocase; classtype:trojan-activity; sid:100000852; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.8.93",nocase; classtype:trojan-activity; sid:100000853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.80.142",nocase; classtype:trojan-activity; sid:100000854; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.81.185",nocase; classtype:trojan-activity; sid:100000855; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.81.192",nocase; classtype:trojan-activity; sid:100000856; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.81.226",nocase; classtype:trojan-activity; sid:100000857; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.83.224",nocase; classtype:trojan-activity; sid:100000858; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.84.195",nocase; classtype:trojan-activity; sid:100000859; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.84.215",nocase; classtype:trojan-activity; sid:100000860; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.86.182",nocase; classtype:trojan-activity; sid:100000861; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.86.47",nocase; classtype:trojan-activity; sid:100000862; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.86.59",nocase; classtype:trojan-activity; sid:100000863; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.87.146",nocase; classtype:trojan-activity; sid:100000864; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.80.167",nocase; classtype:trojan-activity; sid:100000855; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.81.185",nocase; classtype:trojan-activity; sid:100000856; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.81.192",nocase; classtype:trojan-activity; sid:100000857; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.81.226",nocase; classtype:trojan-activity; sid:100000858; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.81.240",nocase; classtype:trojan-activity; sid:100000859; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.84.195",nocase; classtype:trojan-activity; sid:100000860; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.84.215",nocase; classtype:trojan-activity; sid:100000861; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.86.117",nocase; classtype:trojan-activity; sid:100000862; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.86.182",nocase; classtype:trojan-activity; sid:100000863; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.86.59",nocase; classtype:trojan-activity; sid:100000864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.87.16",nocase; classtype:trojan-activity; sid:100000865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.87.207",nocase; classtype:trojan-activity; sid:100000866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.87.42",nocase; classtype:trojan-activity; sid:100000867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.88.102",nocase; classtype:trojan-activity; sid:100000868; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.88.207",nocase; classtype:trojan-activity; sid:100000869; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.88.85",nocase; classtype:trojan-activity; sid:100000869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.89.121",nocase; classtype:trojan-activity; sid:100000870; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.89.45",nocase; classtype:trojan-activity; sid:100000871; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.89.69",nocase; classtype:trojan-activity; sid:100000872; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.91.223",nocase; classtype:trojan-activity; sid:100000873; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.92.144",nocase; classtype:trojan-activity; sid:100000874; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.92.33",nocase; classtype:trojan-activity; sid:100000875; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.89.132",nocase; classtype:trojan-activity; sid:100000871; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.89.45",nocase; classtype:trojan-activity; sid:100000872; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.89.69",nocase; classtype:trojan-activity; sid:100000873; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.91.223",nocase; classtype:trojan-activity; sid:100000874; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.92.144",nocase; classtype:trojan-activity; sid:100000875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.93.113",nocase; classtype:trojan-activity; sid:100000876; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.93.200",nocase; classtype:trojan-activity; sid:100000877; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.93.234",nocase; classtype:trojan-activity; sid:100000878; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.93.98",nocase; classtype:trojan-activity; sid:100000879; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.94.224",nocase; classtype:trojan-activity; sid:100000880; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.93.234",nocase; classtype:trojan-activity; sid:100000877; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.93.98",nocase; classtype:trojan-activity; sid:100000878; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.94.224",nocase; classtype:trojan-activity; sid:100000879; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.94.248",nocase; classtype:trojan-activity; sid:100000880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.94.27",nocase; classtype:trojan-activity; sid:100000881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.94.32",nocase; classtype:trojan-activity; sid:100000882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.94.40",nocase; classtype:trojan-activity; sid:100000883; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.95.60",nocase; classtype:trojan-activity; sid:100000884; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.96.106",nocase; classtype:trojan-activity; sid:100000885; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.95.105",nocase; classtype:trojan-activity; sid:100000884; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.95.188",nocase; classtype:trojan-activity; sid:100000885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.96.125",nocase; classtype:trojan-activity; sid:100000886; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.97.127",nocase; classtype:trojan-activity; sid:100000887; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.97.227",nocase; classtype:trojan-activity; sid:100000888; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.96.93",nocase; classtype:trojan-activity; sid:100000887; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.97.127",nocase; classtype:trojan-activity; sid:100000888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.99.106",nocase; classtype:trojan-activity; sid:100000889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.99.209",nocase; classtype:trojan-activity; sid:100000890; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.19.183.14",nocase; classtype:trojan-activity; sid:100000891; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.205.101.33",nocase; classtype:trojan-activity; sid:100000892; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.21.164.68",nocase; classtype:trojan-activity; sid:100000893; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.217.8.194",nocase; classtype:trojan-activity; sid:100000894; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.22.117.102",nocase; classtype:trojan-activity; sid:100000895; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.222.252.130",nocase; classtype:trojan-activity; sid:100000896; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.34.183.30",nocase; classtype:trojan-activity; sid:100000897; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.48.235.59",nocase; classtype:trojan-activity; sid:100000898; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.95.136.35",nocase; classtype:trojan-activity; sid:100000899; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"179.159.58.134",nocase; classtype:trojan-activity; sid:100000900; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"179.4.187.39",nocase; classtype:trojan-activity; sid:100000901; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.175.99.21",nocase; classtype:trojan-activity; sid:100000891; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.19.183.14",nocase; classtype:trojan-activity; sid:100000892; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.205.101.33",nocase; classtype:trojan-activity; sid:100000893; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.21.164.68",nocase; classtype:trojan-activity; sid:100000894; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.217.8.194",nocase; classtype:trojan-activity; sid:100000895; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.22.117.102",nocase; classtype:trojan-activity; sid:100000896; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.222.252.130",nocase; classtype:trojan-activity; sid:100000897; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.34.183.30",nocase; classtype:trojan-activity; sid:100000898; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.48.235.59",nocase; classtype:trojan-activity; sid:100000899; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"178.95.136.35",nocase; classtype:trojan-activity; sid:100000900; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"179.159.58.134",nocase; classtype:trojan-activity; sid:100000901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"179.43.176.41",nocase; classtype:trojan-activity; sid:100000902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"179.43.176.48",nocase; classtype:trojan-activity; sid:100000903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"179.60.84.7",nocase; classtype:trojan-activity; sid:100000904; rev:1;) @@ -941,196 +941,196 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"181.49.236.4",nocase; classtype:trojan-activity; sid:100000935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"181.49.59.162",nocase; classtype:trojan-activity; sid:100000936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"181.80.69.94",nocase; classtype:trojan-activity; sid:100000937; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.115.179.201",nocase; classtype:trojan-activity; sid:100000938; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.119.206.219",nocase; classtype:trojan-activity; sid:100000939; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.119.225.221",nocase; classtype:trojan-activity; sid:100000940; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.119.228.125",nocase; classtype:trojan-activity; sid:100000941; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.120.16.22",nocase; classtype:trojan-activity; sid:100000942; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.120.16.46",nocase; classtype:trojan-activity; sid:100000943; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.126.116.209",nocase; classtype:trojan-activity; sid:100000944; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.127.139.169",nocase; classtype:trojan-activity; sid:100000945; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.160.98.250",nocase; classtype:trojan-activity; sid:100000946; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.233.0.252",nocase; classtype:trojan-activity; sid:100000947; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.235.252.31",nocase; classtype:trojan-activity; sid:100000948; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.53.197.62",nocase; classtype:trojan-activity; sid:100000949; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"183.105.104.83",nocase; classtype:trojan-activity; sid:100000950; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.112.177.134",nocase; classtype:trojan-activity; sid:100000938; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.115.179.201",nocase; classtype:trojan-activity; sid:100000939; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.119.206.219",nocase; classtype:trojan-activity; sid:100000940; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.119.225.221",nocase; classtype:trojan-activity; sid:100000941; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.119.228.125",nocase; classtype:trojan-activity; sid:100000942; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.120.16.22",nocase; classtype:trojan-activity; sid:100000943; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.120.16.46",nocase; classtype:trojan-activity; sid:100000944; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.126.116.209",nocase; classtype:trojan-activity; sid:100000945; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.127.139.169",nocase; classtype:trojan-activity; sid:100000946; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.160.98.250",nocase; classtype:trojan-activity; sid:100000947; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.233.0.252",nocase; classtype:trojan-activity; sid:100000948; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.235.252.31",nocase; classtype:trojan-activity; sid:100000949; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"182.53.197.62",nocase; classtype:trojan-activity; sid:100000950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"183.105.225.154",nocase; classtype:trojan-activity; sid:100000951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"183.109.169.45",nocase; classtype:trojan-activity; sid:100000952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"183.143.148.105",nocase; classtype:trojan-activity; sid:100000953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"183.188.50.93",nocase; classtype:trojan-activity; sid:100000954; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"183.83.8.225",nocase; classtype:trojan-activity; sid:100000955; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"184.164.185.41",nocase; classtype:trojan-activity; sid:100000956; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"184.74.149.230",nocase; classtype:trojan-activity; sid:100000957; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"184.82.15.135",nocase; classtype:trojan-activity; sid:100000958; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.106.209.68",nocase; classtype:trojan-activity; sid:100000959; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.107.3.8",nocase; classtype:trojan-activity; sid:100000960; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.117.2.107",nocase; classtype:trojan-activity; sid:100000961; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.172.110.235",nocase; classtype:trojan-activity; sid:100000962; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.174.101.41",nocase; classtype:trojan-activity; sid:100000963; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.181.10.234",nocase; classtype:trojan-activity; sid:100000964; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.21.106.210",nocase; classtype:trojan-activity; sid:100000965; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.215.113.112",nocase; classtype:trojan-activity; sid:100000966; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.215.113.54",nocase; classtype:trojan-activity; sid:100000967; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.215.113.93",nocase; classtype:trojan-activity; sid:100000968; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.221.3.244",nocase; classtype:trojan-activity; sid:100000969; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.222.58.152",nocase; classtype:trojan-activity; sid:100000970; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.224.129.224",nocase; classtype:trojan-activity; sid:100000971; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.228.141.74",nocase; classtype:trojan-activity; sid:100000972; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.233.186.151",nocase; classtype:trojan-activity; sid:100000973; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.245.96.94",nocase; classtype:trojan-activity; sid:100000974; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.26.113.95",nocase; classtype:trojan-activity; sid:100000975; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.34.16.231",nocase; classtype:trojan-activity; sid:100000976; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.38.142.236",nocase; classtype:trojan-activity; sid:100000977; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.55.1.182",nocase; classtype:trojan-activity; sid:100000978; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.68.230.207",nocase; classtype:trojan-activity; sid:100000979; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.8.173.159",nocase; classtype:trojan-activity; sid:100000980; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.81.157.186",nocase; classtype:trojan-activity; sid:100000981; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.217.185",nocase; classtype:trojan-activity; sid:100000982; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.217.213",nocase; classtype:trojan-activity; sid:100000983; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.219.160",nocase; classtype:trojan-activity; sid:100000984; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.219.161",nocase; classtype:trojan-activity; sid:100000985; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.219.219",nocase; classtype:trojan-activity; sid:100000986; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.151.144.85",nocase; classtype:trojan-activity; sid:100000987; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.219.164",nocase; classtype:trojan-activity; sid:100000988; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.243.112",nocase; classtype:trojan-activity; sid:100000989; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.243.77",nocase; classtype:trojan-activity; sid:100000990; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.243.91",nocase; classtype:trojan-activity; sid:100000991; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.253.150",nocase; classtype:trojan-activity; sid:100000992; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.225.120.173",nocase; classtype:trojan-activity; sid:100000993; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.232.44.86",nocase; classtype:trojan-activity; sid:100000994; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.28.60.184",nocase; classtype:trojan-activity; sid:100000995; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.34.4.40",nocase; classtype:trojan-activity; sid:100000996; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.73.188.132",nocase; classtype:trojan-activity; sid:100000997; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"187.12.10.98",nocase; classtype:trojan-activity; sid:100000998; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"187.188.124.229",nocase; classtype:trojan-activity; sid:100000999; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.10.21.14",nocase; classtype:trojan-activity; sid:100001000; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.10.231.246",nocase; classtype:trojan-activity; sid:100001001; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.13.179.87",nocase; classtype:trojan-activity; sid:100001002; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.138.200.32",nocase; classtype:trojan-activity; sid:100001003; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.143.220.152",nocase; classtype:trojan-activity; sid:100001004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.152.41.141",nocase; classtype:trojan-activity; sid:100001005; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.169.178.50",nocase; classtype:trojan-activity; sid:100001006; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.169.179.127",nocase; classtype:trojan-activity; sid:100001007; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.169.36.163",nocase; classtype:trojan-activity; sid:100001008; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.242.167.159",nocase; classtype:trojan-activity; sid:100001009; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.242.242.144",nocase; classtype:trojan-activity; sid:100001010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.83.202.25",nocase; classtype:trojan-activity; sid:100001011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.0.42.106",nocase; classtype:trojan-activity; sid:100001012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.109.178.139",nocase; classtype:trojan-activity; sid:100001013; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.110.161.252",nocase; classtype:trojan-activity; sid:100001014; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.111.151.164",nocase; classtype:trojan-activity; sid:100001015; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.119.207.58",nocase; classtype:trojan-activity; sid:100001016; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.12.99.194",nocase; classtype:trojan-activity; sid:100001017; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.160",nocase; classtype:trojan-activity; sid:100001018; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.3",nocase; classtype:trojan-activity; sid:100001019; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.37",nocase; classtype:trojan-activity; sid:100001020; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.41",nocase; classtype:trojan-activity; sid:100001021; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.42",nocase; classtype:trojan-activity; sid:100001022; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.76",nocase; classtype:trojan-activity; sid:100001023; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.130.15.212",nocase; classtype:trojan-activity; sid:100001024; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.130.20.14",nocase; classtype:trojan-activity; sid:100001025; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.147.16.184",nocase; classtype:trojan-activity; sid:100001026; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.159.240.9",nocase; classtype:trojan-activity; sid:100001027; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.187.55.150",nocase; classtype:trojan-activity; sid:100001028; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.210.214.130",nocase; classtype:trojan-activity; sid:100001029; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.213.177.39",nocase; classtype:trojan-activity; sid:100001030; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.213.226.63",nocase; classtype:trojan-activity; sid:100001031; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.213.49.207",nocase; classtype:trojan-activity; sid:100001032; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.214.24.194",nocase; classtype:trojan-activity; sid:100001033; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.216.140.123",nocase; classtype:trojan-activity; sid:100001034; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.65.206.162",nocase; classtype:trojan-activity; sid:100001035; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.85.213.51",nocase; classtype:trojan-activity; sid:100001036; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.98.37.135",nocase; classtype:trojan-activity; sid:100001037; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.98.37.200",nocase; classtype:trojan-activity; sid:100001038; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.98.41.33",nocase; classtype:trojan-activity; sid:100001039; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"191.255.248.220",nocase; classtype:trojan-activity; sid:100001040; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.153.57.94",nocase; classtype:trojan-activity; sid:100001041; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.210.175.130",nocase; classtype:trojan-activity; sid:100001042; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.185.106",nocase; classtype:trojan-activity; sid:100001043; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.209.27",nocase; classtype:trojan-activity; sid:100001044; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.220.55",nocase; classtype:trojan-activity; sid:100001045; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.228.67",nocase; classtype:trojan-activity; sid:100001046; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.230.72",nocase; classtype:trojan-activity; sid:100001047; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.230.74",nocase; classtype:trojan-activity; sid:100001048; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.230.76",nocase; classtype:trojan-activity; sid:100001049; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.236.147.58",nocase; classtype:trojan-activity; sid:100001050; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.99.240.77",nocase; classtype:trojan-activity; sid:100001051; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.113.107.243",nocase; classtype:trojan-activity; sid:100001052; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.147.142.230",nocase; classtype:trojan-activity; sid:100001053; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.15.36.167",nocase; classtype:trojan-activity; sid:100001054; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.152.35.139",nocase; classtype:trojan-activity; sid:100001055; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.38.20.199",nocase; classtype:trojan-activity; sid:100001056; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"195.139.126.51",nocase; classtype:trojan-activity; sid:100001057; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"195.228.231.218",nocase; classtype:trojan-activity; sid:100001058; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"195.24.94.187",nocase; classtype:trojan-activity; sid:100001059; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"195.5.3.87",nocase; classtype:trojan-activity; sid:100001060; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"196.202.26.182",nocase; classtype:trojan-activity; sid:100001061; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"196.221.148.90",nocase; classtype:trojan-activity; sid:100001062; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"196.221.166.203",nocase; classtype:trojan-activity; sid:100001063; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"197.50.27.115",nocase; classtype:trojan-activity; sid:100001064; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"198.23.133.218",nocase; classtype:trojan-activity; sid:100001065; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"198.23.174.104",nocase; classtype:trojan-activity; sid:100001066; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"198.23.213.61",nocase; classtype:trojan-activity; sid:100001067; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"198.23.251.105",nocase; classtype:trojan-activity; sid:100001068; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"198.46.132.132",nocase; classtype:trojan-activity; sid:100001069; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1am.co.nz",nocase; classtype:trojan-activity; sid:100001070; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.239.22.188",nocase; classtype:trojan-activity; sid:100001071; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.36.231.201",nocase; classtype:trojan-activity; sid:100001072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.37.149.230",nocase; classtype:trojan-activity; sid:100001073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.45.111.158",nocase; classtype:trojan-activity; sid:100001074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.45.4.24",nocase; classtype:trojan-activity; sid:100001075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.55.125.182",nocase; classtype:trojan-activity; sid:100001076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.55.92.184",nocase; classtype:trojan-activity; sid:100001077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.56.8.80",nocase; classtype:trojan-activity; sid:100001078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.57.122.107",nocase; classtype:trojan-activity; sid:100001079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.83.152.16",nocase; classtype:trojan-activity; sid:100001080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"20.185.42.197",nocase; classtype:trojan-activity; sid:100001081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"200.105.167.98",nocase; classtype:trojan-activity; sid:100001082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"200.111.189.70",nocase; classtype:trojan-activity; sid:100001083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"200.194.4.24",nocase; classtype:trojan-activity; sid:100001084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"200.30.132.50",nocase; classtype:trojan-activity; sid:100001085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.170.46.2",nocase; classtype:trojan-activity; sid:100001086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.184.163.170",nocase; classtype:trojan-activity; sid:100001087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.187.102.73",nocase; classtype:trojan-activity; sid:100001088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.200.254.86",nocase; classtype:trojan-activity; sid:100001089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.203.221.20",nocase; classtype:trojan-activity; sid:100001090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.203.27.37",nocase; classtype:trojan-activity; sid:100001091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.107.233.41",nocase; classtype:trojan-activity; sid:100001092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.150.176.100",nocase; classtype:trojan-activity; sid:100001093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.166.217.54",nocase; classtype:trojan-activity; sid:100001094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.175.103.10",nocase; classtype:trojan-activity; sid:100001095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.29.95.12",nocase; classtype:trojan-activity; sid:100001096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.4.124.58",nocase; classtype:trojan-activity; sid:100001097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.51.176.114",nocase; classtype:trojan-activity; sid:100001098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.51.191.174",nocase; classtype:trojan-activity; sid:100001099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.74.236.9",nocase; classtype:trojan-activity; sid:100001100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.109.201.243",nocase; classtype:trojan-activity; sid:100001101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.159.80.128",nocase; classtype:trojan-activity; sid:100001102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.159.80.129",nocase; classtype:trojan-activity; sid:100001103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.170.123.78",nocase; classtype:trojan-activity; sid:100001104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.189.156.107",nocase; classtype:trojan-activity; sid:100001105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.204.232.18",nocase; classtype:trojan-activity; sid:100001106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.229.21.56",nocase; classtype:trojan-activity; sid:100001107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.236.190.28",nocase; classtype:trojan-activity; sid:100001108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.238.86.202",nocase; classtype:trojan-activity; sid:100001109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.243.142.132",nocase; classtype:trojan-activity; sid:100001110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.70.166.107",nocase; classtype:trojan-activity; sid:100001111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.77.80.159",nocase; classtype:trojan-activity; sid:100001112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.80.119.166",nocase; classtype:trojan-activity; sid:100001113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.80.171.138",nocase; classtype:trojan-activity; sid:100001114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.82.36.34",nocase; classtype:trojan-activity; sid:100001115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.93.6.28",nocase; classtype:trojan-activity; sid:100001116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"204.195.116.171",nocase; classtype:trojan-activity; sid:100001117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"206.248.137.132",nocase; classtype:trojan-activity; sid:100001118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"206.47.41.166",nocase; classtype:trojan-activity; sid:100001119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"207.5.32.6",nocase; classtype:trojan-activity; sid:100001120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"208.163.58.18",nocase; classtype:trojan-activity; sid:100001121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"208.75.27.157",nocase; classtype:trojan-activity; sid:100001122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"209.141.40.190",nocase; classtype:trojan-activity; sid:100001123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"209.141.40.31",nocase; classtype:trojan-activity; sid:100001124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"209.146.98.50",nocase; classtype:trojan-activity; sid:100001125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"210.124.149.19",nocase; classtype:trojan-activity; sid:100001126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"210.180.17.140",nocase; classtype:trojan-activity; sid:100001127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"183.83.1.1",nocase; classtype:trojan-activity; sid:100000955; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"183.83.14.20",nocase; classtype:trojan-activity; sid:100000956; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"184.164.185.41",nocase; classtype:trojan-activity; sid:100000957; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"184.175.115.10",nocase; classtype:trojan-activity; sid:100000958; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"184.74.149.230",nocase; classtype:trojan-activity; sid:100000959; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"184.82.15.135",nocase; classtype:trojan-activity; sid:100000960; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.106.209.68",nocase; classtype:trojan-activity; sid:100000961; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.107.3.8",nocase; classtype:trojan-activity; sid:100000962; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.117.2.107",nocase; classtype:trojan-activity; sid:100000963; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.172.110.235",nocase; classtype:trojan-activity; sid:100000964; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.174.101.41",nocase; classtype:trojan-activity; sid:100000965; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.181.10.234",nocase; classtype:trojan-activity; sid:100000966; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.21.106.210",nocase; classtype:trojan-activity; sid:100000967; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.215.113.112",nocase; classtype:trojan-activity; sid:100000968; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.215.113.54",nocase; classtype:trojan-activity; sid:100000969; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.215.113.93",nocase; classtype:trojan-activity; sid:100000970; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.221.3.244",nocase; classtype:trojan-activity; sid:100000971; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.222.58.152",nocase; classtype:trojan-activity; sid:100000972; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.228.141.74",nocase; classtype:trojan-activity; sid:100000973; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.233.186.151",nocase; classtype:trojan-activity; sid:100000974; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.245.96.94",nocase; classtype:trojan-activity; sid:100000975; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.26.113.95",nocase; classtype:trojan-activity; sid:100000976; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.34.16.231",nocase; classtype:trojan-activity; sid:100000977; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.38.142.236",nocase; classtype:trojan-activity; sid:100000978; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.55.1.182",nocase; classtype:trojan-activity; sid:100000979; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.68.230.207",nocase; classtype:trojan-activity; sid:100000980; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.8.173.159",nocase; classtype:trojan-activity; sid:100000981; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.81.154.208",nocase; classtype:trojan-activity; sid:100000982; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.81.157.186",nocase; classtype:trojan-activity; sid:100000983; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.217.185",nocase; classtype:trojan-activity; sid:100000984; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.217.213",nocase; classtype:trojan-activity; sid:100000985; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.219.160",nocase; classtype:trojan-activity; sid:100000986; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.219.161",nocase; classtype:trojan-activity; sid:100000987; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"185.82.219.219",nocase; classtype:trojan-activity; sid:100000988; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.151.144.85",nocase; classtype:trojan-activity; sid:100000989; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.219.164",nocase; classtype:trojan-activity; sid:100000990; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.243.112",nocase; classtype:trojan-activity; sid:100000991; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.243.77",nocase; classtype:trojan-activity; sid:100000992; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.243.91",nocase; classtype:trojan-activity; sid:100000993; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.179.253.150",nocase; classtype:trojan-activity; sid:100000994; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.225.120.173",nocase; classtype:trojan-activity; sid:100000995; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.232.44.86",nocase; classtype:trojan-activity; sid:100000996; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.28.60.184",nocase; classtype:trojan-activity; sid:100000997; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.34.4.40",nocase; classtype:trojan-activity; sid:100000998; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"186.73.188.132",nocase; classtype:trojan-activity; sid:100000999; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"187.12.10.98",nocase; classtype:trojan-activity; sid:100001000; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"187.188.124.229",nocase; classtype:trojan-activity; sid:100001001; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.10.21.14",nocase; classtype:trojan-activity; sid:100001002; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.10.231.246",nocase; classtype:trojan-activity; sid:100001003; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.13.179.87",nocase; classtype:trojan-activity; sid:100001004; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.138.200.32",nocase; classtype:trojan-activity; sid:100001005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.143.220.152",nocase; classtype:trojan-activity; sid:100001006; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.152.41.141",nocase; classtype:trojan-activity; sid:100001007; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.169.178.50",nocase; classtype:trojan-activity; sid:100001008; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.169.179.127",nocase; classtype:trojan-activity; sid:100001009; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.169.199.59",nocase; classtype:trojan-activity; sid:100001010; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.169.30.30",nocase; classtype:trojan-activity; sid:100001011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.169.36.163",nocase; classtype:trojan-activity; sid:100001012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.242.167.159",nocase; classtype:trojan-activity; sid:100001013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.242.242.144",nocase; classtype:trojan-activity; sid:100001014; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"188.83.202.25",nocase; classtype:trojan-activity; sid:100001015; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.0.42.106",nocase; classtype:trojan-activity; sid:100001016; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.109.178.139",nocase; classtype:trojan-activity; sid:100001017; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.110.161.252",nocase; classtype:trojan-activity; sid:100001018; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.111.151.164",nocase; classtype:trojan-activity; sid:100001019; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.119.207.58",nocase; classtype:trojan-activity; sid:100001020; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.12.99.194",nocase; classtype:trojan-activity; sid:100001021; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.160",nocase; classtype:trojan-activity; sid:100001022; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.3",nocase; classtype:trojan-activity; sid:100001023; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.37",nocase; classtype:trojan-activity; sid:100001024; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.41",nocase; classtype:trojan-activity; sid:100001025; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.42",nocase; classtype:trojan-activity; sid:100001026; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.122.112.76",nocase; classtype:trojan-activity; sid:100001027; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.130.15.212",nocase; classtype:trojan-activity; sid:100001028; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.130.20.14",nocase; classtype:trojan-activity; sid:100001029; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.147.16.184",nocase; classtype:trojan-activity; sid:100001030; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.159.240.9",nocase; classtype:trojan-activity; sid:100001031; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.187.55.150",nocase; classtype:trojan-activity; sid:100001032; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.210.214.130",nocase; classtype:trojan-activity; sid:100001033; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.213.177.39",nocase; classtype:trojan-activity; sid:100001034; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.213.226.63",nocase; classtype:trojan-activity; sid:100001035; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.213.49.207",nocase; classtype:trojan-activity; sid:100001036; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.214.24.194",nocase; classtype:trojan-activity; sid:100001037; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.216.140.123",nocase; classtype:trojan-activity; sid:100001038; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.65.206.162",nocase; classtype:trojan-activity; sid:100001039; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.85.213.51",nocase; classtype:trojan-activity; sid:100001040; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.92.4.231",nocase; classtype:trojan-activity; sid:100001041; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.98.37.135",nocase; classtype:trojan-activity; sid:100001042; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.98.37.200",nocase; classtype:trojan-activity; sid:100001043; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"190.98.41.33",nocase; classtype:trojan-activity; sid:100001044; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"191.255.248.220",nocase; classtype:trojan-activity; sid:100001045; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.153.57.94",nocase; classtype:trojan-activity; sid:100001046; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.210.175.130",nocase; classtype:trojan-activity; sid:100001047; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.185.106",nocase; classtype:trojan-activity; sid:100001048; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.209.27",nocase; classtype:trojan-activity; sid:100001049; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.220.55",nocase; classtype:trojan-activity; sid:100001050; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.228.67",nocase; classtype:trojan-activity; sid:100001051; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.230.72",nocase; classtype:trojan-activity; sid:100001052; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.230.74",nocase; classtype:trojan-activity; sid:100001053; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.227.230.76",nocase; classtype:trojan-activity; sid:100001054; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"192.99.240.77",nocase; classtype:trojan-activity; sid:100001055; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.113.107.243",nocase; classtype:trojan-activity; sid:100001056; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.147.142.230",nocase; classtype:trojan-activity; sid:100001057; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.15.36.167",nocase; classtype:trojan-activity; sid:100001058; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.152.35.139",nocase; classtype:trojan-activity; sid:100001059; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"194.38.20.199",nocase; classtype:trojan-activity; sid:100001060; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"195.139.126.51",nocase; classtype:trojan-activity; sid:100001061; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"195.228.231.218",nocase; classtype:trojan-activity; sid:100001062; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"195.24.94.187",nocase; classtype:trojan-activity; sid:100001063; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"195.5.3.87",nocase; classtype:trojan-activity; sid:100001064; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"196.202.26.182",nocase; classtype:trojan-activity; sid:100001065; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"196.218.48.82",nocase; classtype:trojan-activity; sid:100001066; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"196.221.148.90",nocase; classtype:trojan-activity; sid:100001067; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"196.221.166.203",nocase; classtype:trojan-activity; sid:100001068; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"197.50.27.115",nocase; classtype:trojan-activity; sid:100001069; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"198.23.213.61",nocase; classtype:trojan-activity; sid:100001070; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"198.23.251.105",nocase; classtype:trojan-activity; sid:100001071; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"198.46.132.132",nocase; classtype:trojan-activity; sid:100001072; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1am.co.nz",nocase; classtype:trojan-activity; sid:100001073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.239.22.188",nocase; classtype:trojan-activity; sid:100001074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.36.231.201",nocase; classtype:trojan-activity; sid:100001075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.37.149.230",nocase; classtype:trojan-activity; sid:100001076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.37.203.65",nocase; classtype:trojan-activity; sid:100001077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.45.111.158",nocase; classtype:trojan-activity; sid:100001078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.45.4.24",nocase; classtype:trojan-activity; sid:100001079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.55.125.182",nocase; classtype:trojan-activity; sid:100001080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.55.92.184",nocase; classtype:trojan-activity; sid:100001081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.56.8.80",nocase; classtype:trojan-activity; sid:100001082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.57.122.107",nocase; classtype:trojan-activity; sid:100001083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.83.152.16",nocase; classtype:trojan-activity; sid:100001084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"20.185.42.197",nocase; classtype:trojan-activity; sid:100001085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"200.105.167.98",nocase; classtype:trojan-activity; sid:100001086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"200.111.189.70",nocase; classtype:trojan-activity; sid:100001087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"200.194.4.24",nocase; classtype:trojan-activity; sid:100001088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"200.30.132.50",nocase; classtype:trojan-activity; sid:100001089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.170.46.2",nocase; classtype:trojan-activity; sid:100001090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.171.40.215",nocase; classtype:trojan-activity; sid:100001091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.184.163.170",nocase; classtype:trojan-activity; sid:100001092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.187.102.73",nocase; classtype:trojan-activity; sid:100001093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.200.254.86",nocase; classtype:trojan-activity; sid:100001094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.203.221.20",nocase; classtype:trojan-activity; sid:100001095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"201.203.27.37",nocase; classtype:trojan-activity; sid:100001096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.107.233.41",nocase; classtype:trojan-activity; sid:100001097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.166.217.54",nocase; classtype:trojan-activity; sid:100001098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.175.103.10",nocase; classtype:trojan-activity; sid:100001099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.29.95.12",nocase; classtype:trojan-activity; sid:100001100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.4.124.58",nocase; classtype:trojan-activity; sid:100001101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.51.176.114",nocase; classtype:trojan-activity; sid:100001102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"202.51.191.174",nocase; classtype:trojan-activity; sid:100001103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.109.201.243",nocase; classtype:trojan-activity; sid:100001104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.159.80.128",nocase; classtype:trojan-activity; sid:100001105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.159.80.129",nocase; classtype:trojan-activity; sid:100001106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.159.80.164",nocase; classtype:trojan-activity; sid:100001107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.170.123.78",nocase; classtype:trojan-activity; sid:100001108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.189.156.107",nocase; classtype:trojan-activity; sid:100001109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.204.232.18",nocase; classtype:trojan-activity; sid:100001110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.229.21.56",nocase; classtype:trojan-activity; sid:100001111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.236.190.28",nocase; classtype:trojan-activity; sid:100001112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.70.166.107",nocase; classtype:trojan-activity; sid:100001113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.80.119.166",nocase; classtype:trojan-activity; sid:100001114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.80.171.138",nocase; classtype:trojan-activity; sid:100001115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.82.36.34",nocase; classtype:trojan-activity; sid:100001116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"203.93.6.28",nocase; classtype:trojan-activity; sid:100001117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"204.195.116.171",nocase; classtype:trojan-activity; sid:100001118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"206.248.137.132",nocase; classtype:trojan-activity; sid:100001119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"206.47.41.166",nocase; classtype:trojan-activity; sid:100001120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"207.5.32.6",nocase; classtype:trojan-activity; sid:100001121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"208.163.58.18",nocase; classtype:trojan-activity; sid:100001122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"208.75.27.157",nocase; classtype:trojan-activity; sid:100001123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"209.141.40.190",nocase; classtype:trojan-activity; sid:100001124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"209.141.40.31",nocase; classtype:trojan-activity; sid:100001125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"209.146.98.50",nocase; classtype:trojan-activity; sid:100001126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"210.124.149.19",nocase; classtype:trojan-activity; sid:100001127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"210.216.152.122",nocase; classtype:trojan-activity; sid:100001128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"210.216.153.142",nocase; classtype:trojan-activity; sid:100001129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"210.57.234.93",nocase; classtype:trojan-activity; sid:100001130; rev:1;) @@ -1139,479 +1139,479 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"210.68.242.114",nocase; classtype:trojan-activity; sid:100001133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.187.132.204",nocase; classtype:trojan-activity; sid:100001134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.187.75.220",nocase; classtype:trojan-activity; sid:100001135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.200.160.239",nocase; classtype:trojan-activity; sid:100001136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.204.215.157",nocase; classtype:trojan-activity; sid:100001137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.210.66.179",nocase; classtype:trojan-activity; sid:100001138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.210.93.93",nocase; classtype:trojan-activity; sid:100001139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.216.66.105",nocase; classtype:trojan-activity; sid:100001140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.237.114.96",nocase; classtype:trojan-activity; sid:100001141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.237.120.13",nocase; classtype:trojan-activity; sid:100001142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.204.215.157",nocase; classtype:trojan-activity; sid:100001136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.210.66.179",nocase; classtype:trojan-activity; sid:100001137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.210.93.93",nocase; classtype:trojan-activity; sid:100001138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.216.66.105",nocase; classtype:trojan-activity; sid:100001139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.237.114.96",nocase; classtype:trojan-activity; sid:100001140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.237.120.13",nocase; classtype:trojan-activity; sid:100001141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.237.246.137",nocase; classtype:trojan-activity; sid:100001142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.238.83.238",nocase; classtype:trojan-activity; sid:100001143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.247.5.96",nocase; classtype:trojan-activity; sid:100001144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.32.122.110",nocase; classtype:trojan-activity; sid:100001145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"211.93.191.153",nocase; classtype:trojan-activity; sid:100001146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"212.122.86.105",nocase; classtype:trojan-activity; sid:100001147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"212.143.227.22",nocase; classtype:trojan-activity; sid:100001148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"212.46.197.114",nocase; classtype:trojan-activity; sid:100001149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"212.56.197.230",nocase; classtype:trojan-activity; sid:100001150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.123.206.197",nocase; classtype:trojan-activity; sid:100001151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.135.178.253",nocase; classtype:trojan-activity; sid:100001152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.14.173.117",nocase; classtype:trojan-activity; sid:100001153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.149.190.193",nocase; classtype:trojan-activity; sid:100001154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.104.12",nocase; classtype:trojan-activity; sid:100001155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.104.99",nocase; classtype:trojan-activity; sid:100001156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.111.201",nocase; classtype:trojan-activity; sid:100001157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.114.136",nocase; classtype:trojan-activity; sid:100001158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.114.165",nocase; classtype:trojan-activity; sid:100001159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.115.104",nocase; classtype:trojan-activity; sid:100001160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.116.153",nocase; classtype:trojan-activity; sid:100001161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.126.20",nocase; classtype:trojan-activity; sid:100001162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.126.201",nocase; classtype:trojan-activity; sid:100001163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.126.243",nocase; classtype:trojan-activity; sid:100001164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"212.156.215.178",nocase; classtype:trojan-activity; sid:100001149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"212.46.197.114",nocase; classtype:trojan-activity; sid:100001150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"212.56.197.230",nocase; classtype:trojan-activity; sid:100001151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.123.206.197",nocase; classtype:trojan-activity; sid:100001152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.135.178.253",nocase; classtype:trojan-activity; sid:100001153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.14.173.117",nocase; classtype:trojan-activity; sid:100001154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.149.190.193",nocase; classtype:trojan-activity; sid:100001155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.104.12",nocase; classtype:trojan-activity; sid:100001156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.104.99",nocase; classtype:trojan-activity; sid:100001157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.111.201",nocase; classtype:trojan-activity; sid:100001158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.114.136",nocase; classtype:trojan-activity; sid:100001159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.116.153",nocase; classtype:trojan-activity; sid:100001160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.118.10",nocase; classtype:trojan-activity; sid:100001161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.118.216",nocase; classtype:trojan-activity; sid:100001162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.126.20",nocase; classtype:trojan-activity; sid:100001163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.126.201",nocase; classtype:trojan-activity; sid:100001164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.163.126.7",nocase; classtype:trojan-activity; sid:100001165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.189.178.163",nocase; classtype:trojan-activity; sid:100001166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.240.218.15",nocase; classtype:trojan-activity; sid:100001167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.249.156.189",nocase; classtype:trojan-activity; sid:100001168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.91.244.58",nocase; classtype:trojan-activity; sid:100001169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.186.69.101",nocase; classtype:trojan-activity; sid:100001166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.189.178.163",nocase; classtype:trojan-activity; sid:100001167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.240.218.15",nocase; classtype:trojan-activity; sid:100001168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.249.156.189",nocase; classtype:trojan-activity; sid:100001169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"213.92.254.52",nocase; classtype:trojan-activity; sid:100001170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"216.158.238.236",nocase; classtype:trojan-activity; sid:100001171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"216.170.240.98",nocase; classtype:trojan-activity; sid:100001172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"216.183.54.169",nocase; classtype:trojan-activity; sid:100001173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"216.36.12.98",nocase; classtype:trojan-activity; sid:100001174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"217.11.75.162",nocase; classtype:trojan-activity; sid:100001175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.12.181.110",nocase; classtype:trojan-activity; sid:100001176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.161.69.135",nocase; classtype:trojan-activity; sid:100001177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.2.40.34",nocase; classtype:trojan-activity; sid:100001178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.234.165.18",nocase; classtype:trojan-activity; sid:100001179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.238.246.3",nocase; classtype:trojan-activity; sid:100001180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.35.207.119",nocase; classtype:trojan-activity; sid:100001181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.35.227.133",nocase; classtype:trojan-activity; sid:100001182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.35.68.35",nocase; classtype:trojan-activity; sid:100001183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.35.81.81",nocase; classtype:trojan-activity; sid:100001184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.56.93.129",nocase; classtype:trojan-activity; sid:100001185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.59.116.203",nocase; classtype:trojan-activity; sid:100001186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.79.103.159",nocase; classtype:trojan-activity; sid:100001187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.93.102.63",nocase; classtype:trojan-activity; sid:100001188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.93.102.75",nocase; classtype:trojan-activity; sid:100001189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.155.29.165",nocase; classtype:trojan-activity; sid:100001190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.155.64.104",nocase; classtype:trojan-activity; sid:100001191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.157.139.165",nocase; classtype:trojan-activity; sid:100001192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.157.202.92",nocase; classtype:trojan-activity; sid:100001193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.157.214.235",nocase; classtype:trojan-activity; sid:100001194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.241.6.180",nocase; classtype:trojan-activity; sid:100001195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.1.148",nocase; classtype:trojan-activity; sid:100001196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.1.84",nocase; classtype:trojan-activity; sid:100001197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.163.7",nocase; classtype:trojan-activity; sid:100001198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.171.144",nocase; classtype:trojan-activity; sid:100001199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.245.63",nocase; classtype:trojan-activity; sid:100001200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.5.140",nocase; classtype:trojan-activity; sid:100001201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.69.71.186",nocase; classtype:trojan-activity; sid:100001202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.80.217.209",nocase; classtype:trojan-activity; sid:100001203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.85.145.194",nocase; classtype:trojan-activity; sid:100001204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"21robo.com",nocase; classtype:trojan-activity; sid:100001205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.118.168.155",nocase; classtype:trojan-activity; sid:100001206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.126.237.74",nocase; classtype:trojan-activity; sid:100001207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.132.89.154",nocase; classtype:trojan-activity; sid:100001208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.200.22.163",nocase; classtype:trojan-activity; sid:100001209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.90.159.188",nocase; classtype:trojan-activity; sid:100001210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.0.133.84",nocase; classtype:trojan-activity; sid:100001211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.124.78.15",nocase; classtype:trojan-activity; sid:100001212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.157.191.178",nocase; classtype:trojan-activity; sid:100001213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.160.136.213",nocase; classtype:trojan-activity; sid:100001214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.201.54.97",nocase; classtype:trojan-activity; sid:100001215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.202.232.230",nocase; classtype:trojan-activity; sid:100001216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.214.130.147",nocase; classtype:trojan-activity; sid:100001217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.214.251.109",nocase; classtype:trojan-activity; sid:100001218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.116.167",nocase; classtype:trojan-activity; sid:100001219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.172.207",nocase; classtype:trojan-activity; sid:100001220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.184.31",nocase; classtype:trojan-activity; sid:100001221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.252.64",nocase; classtype:trojan-activity; sid:100001222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.8.64",nocase; classtype:trojan-activity; sid:100001223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.232.183.167",nocase; classtype:trojan-activity; sid:100001224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.235.137.36",nocase; classtype:trojan-activity; sid:100001225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.3.112.125",nocase; classtype:trojan-activity; sid:100001226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.3.43.223",nocase; classtype:trojan-activity; sid:100001227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.3.68.16",nocase; classtype:trojan-activity; sid:100001228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.108.17.64",nocase; classtype:trojan-activity; sid:100001229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.118.248.149",nocase; classtype:trojan-activity; sid:100001230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.119.65.145",nocase; classtype:trojan-activity; sid:100001231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.132.125.138",nocase; classtype:trojan-activity; sid:100001232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.133.103.120",nocase; classtype:trojan-activity; sid:100001233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.135.9.5",nocase; classtype:trojan-activity; sid:100001234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.137.139.86",nocase; classtype:trojan-activity; sid:100001235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.137.73.214",nocase; classtype:trojan-activity; sid:100001236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.138.201.129",nocase; classtype:trojan-activity; sid:100001237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.140.17.245",nocase; classtype:trojan-activity; sid:100001238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.185.116.233",nocase; classtype:trojan-activity; sid:100001239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.187.9.178",nocase; classtype:trojan-activity; sid:100001240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.211.72.66",nocase; classtype:trojan-activity; sid:100001241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.236.85.220",nocase; classtype:trojan-activity; sid:100001242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.238.230.7",nocase; classtype:trojan-activity; sid:100001243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.239.83.232",nocase; classtype:trojan-activity; sid:100001244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.248.64.253",nocase; classtype:trojan-activity; sid:100001245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.92.9.126",nocase; classtype:trojan-activity; sid:100001246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.95.190.20",nocase; classtype:trojan-activity; sid:100001247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.99.171.192",nocase; classtype:trojan-activity; sid:100001248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.13.87.209",nocase; classtype:trojan-activity; sid:100001249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.131.201.82",nocase; classtype:trojan-activity; sid:100001250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.166.117.210",nocase; classtype:trojan-activity; sid:100001251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.167.118.17",nocase; classtype:trojan-activity; sid:100001252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.212.234.84",nocase; classtype:trojan-activity; sid:100001253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.212.5.29",nocase; classtype:trojan-activity; sid:100001254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.212.73.175",nocase; classtype:trojan-activity; sid:100001255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.115.118.232",nocase; classtype:trojan-activity; sid:100001256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.125.186.135",nocase; classtype:trojan-activity; sid:100001257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.126.120.25",nocase; classtype:trojan-activity; sid:100001258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.24.213.121",nocase; classtype:trojan-activity; sid:100001259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.243.149.13",nocase; classtype:trojan-activity; sid:100001260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.243.21.167",nocase; classtype:trojan-activity; sid:100001261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.95.89.21",nocase; classtype:trojan-activity; sid:100001262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.103.74.180",nocase; classtype:trojan-activity; sid:100001263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.11.141.134",nocase; classtype:trojan-activity; sid:100001264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.119.158.74",nocase; classtype:trojan-activity; sid:100001265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.137.147.95",nocase; classtype:trojan-activity; sid:100001266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.137.233.132",nocase; classtype:trojan-activity; sid:100001267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.158.25.98",nocase; classtype:trojan-activity; sid:100001268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.176.206.12",nocase; classtype:trojan-activity; sid:100001269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.184.1.41",nocase; classtype:trojan-activity; sid:100001270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.192.191.109",nocase; classtype:trojan-activity; sid:100001271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.225.114.161",nocase; classtype:trojan-activity; sid:100001272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.227.190.78",nocase; classtype:trojan-activity; sid:100001273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.35.245.52",nocase; classtype:trojan-activity; sid:100001274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.39.181.18",nocase; classtype:trojan-activity; sid:100001275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.39.34.242",nocase; classtype:trojan-activity; sid:100001276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.42.229.143",nocase; classtype:trojan-activity; sid:100001277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.45.4.1",nocase; classtype:trojan-activity; sid:100001278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.51.91.113",nocase; classtype:trojan-activity; sid:100001279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.53.163.10",nocase; classtype:trojan-activity; sid:100001280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.53.163.9",nocase; classtype:trojan-activity; sid:100001281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.89.140.190",nocase; classtype:trojan-activity; sid:100001282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.1.245.16",nocase; classtype:trojan-activity; sid:100001283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.1.245.7",nocase; classtype:trojan-activity; sid:100001284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.105.106.201",nocase; classtype:trojan-activity; sid:100001285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.105.152.107",nocase; classtype:trojan-activity; sid:100001286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.116.84.57",nocase; classtype:trojan-activity; sid:100001287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.117.105.125",nocase; classtype:trojan-activity; sid:100001288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.14.211.219",nocase; classtype:trojan-activity; sid:100001289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.14.81.201",nocase; classtype:trojan-activity; sid:100001290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.141.218.17",nocase; classtype:trojan-activity; sid:100001291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.147.29.52",nocase; classtype:trojan-activity; sid:100001292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.147.40.128",nocase; classtype:trojan-activity; sid:100001293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.184.251.135",nocase; classtype:trojan-activity; sid:100001294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.193.217.210",nocase; classtype:trojan-activity; sid:100001295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.194.149.142",nocase; classtype:trojan-activity; sid:100001296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.194.192.66",nocase; classtype:trojan-activity; sid:100001297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.197.23.215",nocase; classtype:trojan-activity; sid:100001298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.199.232.65",nocase; classtype:trojan-activity; sid:100001299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.199.34.48",nocase; classtype:trojan-activity; sid:100001300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.200.110.211",nocase; classtype:trojan-activity; sid:100001301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.200.32.146",nocase; classtype:trojan-activity; sid:100001302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.201.183.149",nocase; classtype:trojan-activity; sid:100001303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.202.182.201",nocase; classtype:trojan-activity; sid:100001304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.102.12",nocase; classtype:trojan-activity; sid:100001305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.116.86",nocase; classtype:trojan-activity; sid:100001306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.165.138",nocase; classtype:trojan-activity; sid:100001307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.185.42",nocase; classtype:trojan-activity; sid:100001308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.255.42",nocase; classtype:trojan-activity; sid:100001309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.28.115",nocase; classtype:trojan-activity; sid:100001310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.4.188",nocase; classtype:trojan-activity; sid:100001311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.47.104",nocase; classtype:trojan-activity; sid:100001312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.68.144",nocase; classtype:trojan-activity; sid:100001313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.87.75",nocase; classtype:trojan-activity; sid:100001314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.94.134",nocase; classtype:trojan-activity; sid:100001315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.204.253.74",nocase; classtype:trojan-activity; sid:100001316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.205.178.110",nocase; classtype:trojan-activity; sid:100001317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.206.136.101",nocase; classtype:trojan-activity; sid:100001318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.206.154.122",nocase; classtype:trojan-activity; sid:100001319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.206.80.209",nocase; classtype:trojan-activity; sid:100001320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.119.27",nocase; classtype:trojan-activity; sid:100001321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.237.105",nocase; classtype:trojan-activity; sid:100001322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.247.130",nocase; classtype:trojan-activity; sid:100001323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.25.59",nocase; classtype:trojan-activity; sid:100001324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.34.2",nocase; classtype:trojan-activity; sid:100001325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.209.208.122",nocase; classtype:trojan-activity; sid:100001326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.209.231.15",nocase; classtype:trojan-activity; sid:100001327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.21.151.205",nocase; classtype:trojan-activity; sid:100001328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.107.125",nocase; classtype:trojan-activity; sid:100001329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.234.28",nocase; classtype:trojan-activity; sid:100001330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.236.134",nocase; classtype:trojan-activity; sid:100001331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.32.122",nocase; classtype:trojan-activity; sid:100001332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.63.243",nocase; classtype:trojan-activity; sid:100001333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.104.201",nocase; classtype:trojan-activity; sid:100001334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.109.105",nocase; classtype:trojan-activity; sid:100001335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.110.189",nocase; classtype:trojan-activity; sid:100001336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.175.208",nocase; classtype:trojan-activity; sid:100001337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.255.202",nocase; classtype:trojan-activity; sid:100001338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.66.112",nocase; classtype:trojan-activity; sid:100001339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.84.74",nocase; classtype:trojan-activity; sid:100001340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.214.37.129",nocase; classtype:trojan-activity; sid:100001341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.139.242",nocase; classtype:trojan-activity; sid:100001342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.190.172",nocase; classtype:trojan-activity; sid:100001343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.212.209",nocase; classtype:trojan-activity; sid:100001344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.253.149",nocase; classtype:trojan-activity; sid:100001345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.71.243",nocase; classtype:trojan-activity; sid:100001346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.98.242",nocase; classtype:trojan-activity; sid:100001347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.128.156",nocase; classtype:trojan-activity; sid:100001348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.144.66",nocase; classtype:trojan-activity; sid:100001349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.225.28",nocase; classtype:trojan-activity; sid:100001350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.227.95",nocase; classtype:trojan-activity; sid:100001351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.234.98",nocase; classtype:trojan-activity; sid:100001352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.217.191.58",nocase; classtype:trojan-activity; sid:100001353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.218.248.121",nocase; classtype:trojan-activity; sid:100001354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.132.71",nocase; classtype:trojan-activity; sid:100001355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.151.83",nocase; classtype:trojan-activity; sid:100001356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.160.112",nocase; classtype:trojan-activity; sid:100001357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.176.72",nocase; classtype:trojan-activity; sid:100001358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.83.244",nocase; classtype:trojan-activity; sid:100001359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.220.20.66",nocase; classtype:trojan-activity; sid:100001360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.220.249.0",nocase; classtype:trojan-activity; sid:100001361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.220.85.168",nocase; classtype:trojan-activity; sid:100001362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.221.239.223",nocase; classtype:trojan-activity; sid:100001363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.222.241.223",nocase; classtype:trojan-activity; sid:100001364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.222.76.80",nocase; classtype:trojan-activity; sid:100001365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.223.242.164",nocase; classtype:trojan-activity; sid:100001366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.129.198",nocase; classtype:trojan-activity; sid:100001367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.154.13",nocase; classtype:trojan-activity; sid:100001368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.2.30",nocase; classtype:trojan-activity; sid:100001369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.212.124",nocase; classtype:trojan-activity; sid:100001370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.58.5",nocase; classtype:trojan-activity; sid:100001371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.7.204.255",nocase; classtype:trojan-activity; sid:100001372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.0.98.131",nocase; classtype:trojan-activity; sid:100001373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.11.51.57",nocase; classtype:trojan-activity; sid:100001374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.13.23.180",nocase; classtype:trojan-activity; sid:100001375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.124.130",nocase; classtype:trojan-activity; sid:100001376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.146.199",nocase; classtype:trojan-activity; sid:100001377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.179.83",nocase; classtype:trojan-activity; sid:100001378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.184.59",nocase; classtype:trojan-activity; sid:100001379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.191.243",nocase; classtype:trojan-activity; sid:100001380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.194.67",nocase; classtype:trojan-activity; sid:100001381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.216.132",nocase; classtype:trojan-activity; sid:100001382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.219.28",nocase; classtype:trojan-activity; sid:100001383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.24.115",nocase; classtype:trojan-activity; sid:100001384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.30.65",nocase; classtype:trojan-activity; sid:100001385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.63.203",nocase; classtype:trojan-activity; sid:100001386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.65.233",nocase; classtype:trojan-activity; sid:100001387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.79.66",nocase; classtype:trojan-activity; sid:100001388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.94.16",nocase; classtype:trojan-activity; sid:100001389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.179.201.26",nocase; classtype:trojan-activity; sid:100001390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.195.84.250",nocase; classtype:trojan-activity; sid:100001391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.210.20.138",nocase; classtype:trojan-activity; sid:100001392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.210.20.177",nocase; classtype:trojan-activity; sid:100001393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.210.20.69",nocase; classtype:trojan-activity; sid:100001394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.28.7.159",nocase; classtype:trojan-activity; sid:100001395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.30.119.23",nocase; classtype:trojan-activity; sid:100001396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.32.120.79",nocase; classtype:trojan-activity; sid:100001397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"32.208.157.193",nocase; classtype:trojan-activity; sid:100001398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"32792.prolocksmithwinterpark.com",nocase; classtype:trojan-activity; sid:100001399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"34.122.44.188",nocase; classtype:trojan-activity; sid:100001400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"35.184.169.169",nocase; classtype:trojan-activity; sid:100001401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.108.231.218",nocase; classtype:trojan-activity; sid:100001402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.248.83.98",nocase; classtype:trojan-activity; sid:100001403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.249.49.142",nocase; classtype:trojan-activity; sid:100001404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.250.203.246",nocase; classtype:trojan-activity; sid:100001405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.251.157.225",nocase; classtype:trojan-activity; sid:100001406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.251.18.18",nocase; classtype:trojan-activity; sid:100001407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.251.51.244",nocase; classtype:trojan-activity; sid:100001408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.255.90.219",nocase; classtype:trojan-activity; sid:100001409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.33.160.167",nocase; classtype:trojan-activity; sid:100001410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.34.150.236",nocase; classtype:trojan-activity; sid:100001411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.66.105.159",nocase; classtype:trojan-activity; sid:100001412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.66.133.125",nocase; classtype:trojan-activity; sid:100001413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.66.139.36",nocase; classtype:trojan-activity; sid:100001414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.89.18.133",nocase; classtype:trojan-activity; sid:100001415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.91.89.187",nocase; classtype:trojan-activity; sid:100001416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"360.lcy2zzx.pw",nocase; classtype:trojan-activity; sid:100001417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"360down7.miiyun.cn",nocase; classtype:trojan-activity; sid:100001418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.222.98.51",nocase; classtype:trojan-activity; sid:100001419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.233.60.68",nocase; classtype:trojan-activity; sid:100001420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.34.179.221",nocase; classtype:trojan-activity; sid:100001421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.34.180.172",nocase; classtype:trojan-activity; sid:100001422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.44.238.35",nocase; classtype:trojan-activity; sid:100001423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.52.118.199",nocase; classtype:trojan-activity; sid:100001424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.54.14.36",nocase; classtype:trojan-activity; sid:100001425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.113.245.254",nocase; classtype:trojan-activity; sid:100001426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.113.98.136",nocase; classtype:trojan-activity; sid:100001427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.117.31.162",nocase; classtype:trojan-activity; sid:100001428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.162.104.119",nocase; classtype:trojan-activity; sid:100001429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.162.98.216",nocase; classtype:trojan-activity; sid:100001430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.65.196.34",nocase; classtype:trojan-activity; sid:100001431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.66.44.109",nocase; classtype:trojan-activity; sid:100001432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.104.83",nocase; classtype:trojan-activity; sid:100001433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.125.186",nocase; classtype:trojan-activity; sid:100001434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.146.60",nocase; classtype:trojan-activity; sid:100001435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.206.228",nocase; classtype:trojan-activity; sid:100001436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.92.131",nocase; classtype:trojan-activity; sid:100001437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.68.171.125",nocase; classtype:trojan-activity; sid:100001438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.68.249.255",nocase; classtype:trojan-activity; sid:100001439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.68.60.61",nocase; classtype:trojan-activity; sid:100001440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.72.167.202",nocase; classtype:trojan-activity; sid:100001441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.72.67.64",nocase; classtype:trojan-activity; sid:100001442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.73.10.198",nocase; classtype:trojan-activity; sid:100001443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.73.163.231",nocase; classtype:trojan-activity; sid:100001444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.73.168.234",nocase; classtype:trojan-activity; sid:100001445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.73.203.225",nocase; classtype:trojan-activity; sid:100001446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.76.194.65",nocase; classtype:trojan-activity; sid:100001447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.76.78.251",nocase; classtype:trojan-activity; sid:100001448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.113.201",nocase; classtype:trojan-activity; sid:100001449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.114.45",nocase; classtype:trojan-activity; sid:100001450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.150.203",nocase; classtype:trojan-activity; sid:100001451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.209.209",nocase; classtype:trojan-activity; sid:100001452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.48.213",nocase; classtype:trojan-activity; sid:100001453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.63.152",nocase; classtype:trojan-activity; sid:100001454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.79.166.31",nocase; classtype:trojan-activity; sid:100001455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.79.218.46",nocase; classtype:trojan-activity; sid:100001456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.79.91.244",nocase; classtype:trojan-activity; sid:100001457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.79.93.171",nocase; classtype:trojan-activity; sid:100001458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.127.214",nocase; classtype:trojan-activity; sid:100001459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.18.140",nocase; classtype:trojan-activity; sid:100001460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.191.137",nocase; classtype:trojan-activity; sid:100001461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.205.255",nocase; classtype:trojan-activity; sid:100001462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.24.54",nocase; classtype:trojan-activity; sid:100001463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.36.151",nocase; classtype:trojan-activity; sid:100001464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.37.182",nocase; classtype:trojan-activity; sid:100001465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.81.251.0",nocase; classtype:trojan-activity; sid:100001466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.81.27.15",nocase; classtype:trojan-activity; sid:100001467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.81.29.231",nocase; classtype:trojan-activity; sid:100001468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.81.70.88",nocase; classtype:trojan-activity; sid:100001469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.83.94.11",nocase; classtype:trojan-activity; sid:100001470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.84.115.152",nocase; classtype:trojan-activity; sid:100001471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.85.54.4",nocase; classtype:trojan-activity; sid:100001472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.86.211.20",nocase; classtype:trojan-activity; sid:100001473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.86.234.187",nocase; classtype:trojan-activity; sid:100001474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.86.78.244",nocase; classtype:trojan-activity; sid:100001475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.87.63.58",nocase; classtype:trojan-activity; sid:100001476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.87.93.109",nocase; classtype:trojan-activity; sid:100001477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.143.176",nocase; classtype:trojan-activity; sid:100001478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.155.96",nocase; classtype:trojan-activity; sid:100001479; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.233.131",nocase; classtype:trojan-activity; sid:100001480; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.67.238",nocase; classtype:trojan-activity; sid:100001481; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.72.9",nocase; classtype:trojan-activity; sid:100001482; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.89.145.11",nocase; classtype:trojan-activity; sid:100001483; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.89.146.36",nocase; classtype:trojan-activity; sid:100001484; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.89.63.23",nocase; classtype:trojan-activity; sid:100001485; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.90.176.191",nocase; classtype:trojan-activity; sid:100001486; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.90.86.212",nocase; classtype:trojan-activity; sid:100001487; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"40.88.2.151",nocase; classtype:trojan-activity; sid:100001488; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.139.209.46",nocase; classtype:trojan-activity; sid:100001489; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.165.130.43",nocase; classtype:trojan-activity; sid:100001490; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.190.63.174",nocase; classtype:trojan-activity; sid:100001491; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.193.192.100",nocase; classtype:trojan-activity; sid:100001492; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.219.185.171",nocase; classtype:trojan-activity; sid:100001493; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.226.60.115",nocase; classtype:trojan-activity; sid:100001494; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.72.203.82",nocase; classtype:trojan-activity; sid:100001495; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.76.157.2",nocase; classtype:trojan-activity; sid:100001496; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.86.18.200",nocase; classtype:trojan-activity; sid:100001497; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.86.18.201",nocase; classtype:trojan-activity; sid:100001498; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.86.5.197",nocase; classtype:trojan-activity; sid:100001499; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.202.101.199",nocase; classtype:trojan-activity; sid:100001500; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.228.60.114",nocase; classtype:trojan-activity; sid:100001501; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.229.173.80",nocase; classtype:trojan-activity; sid:100001502; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.230.91.1",nocase; classtype:trojan-activity; sid:100001503; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.231.208.64",nocase; classtype:trojan-activity; sid:100001504; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.56.15.227",nocase; classtype:trojan-activity; sid:100001505; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.61.99.155",nocase; classtype:trojan-activity; sid:100001506; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.82.217.241",nocase; classtype:trojan-activity; sid:100001507; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"43.241.106.183",nocase; classtype:trojan-activity; sid:100001508; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"43.241.108.134",nocase; classtype:trojan-activity; sid:100001509; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"43.252.8.94",nocase; classtype:trojan-activity; sid:100001510; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.133.1.242",nocase; classtype:trojan-activity; sid:100001511; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.133.203.192",nocase; classtype:trojan-activity; sid:100001512; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.135.134.228",nocase; classtype:trojan-activity; sid:100001513; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.14.149.178",nocase; classtype:trojan-activity; sid:100001514; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.14.149.182",nocase; classtype:trojan-activity; sid:100001515; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.14.149.204",nocase; classtype:trojan-activity; sid:100001516; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.141.84.182",nocase; classtype:trojan-activity; sid:100001517; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.141.84.184",nocase; classtype:trojan-activity; sid:100001518; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.118",nocase; classtype:trojan-activity; sid:100001519; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.135",nocase; classtype:trojan-activity; sid:100001520; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.139",nocase; classtype:trojan-activity; sid:100001521; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.213",nocase; classtype:trojan-activity; sid:100001522; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.242",nocase; classtype:trojan-activity; sid:100001523; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.27",nocase; classtype:trojan-activity; sid:100001524; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.148.10.47",nocase; classtype:trojan-activity; sid:100001525; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.148.10.94",nocase; classtype:trojan-activity; sid:100001526; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.176.109.205",nocase; classtype:trojan-activity; sid:100001527; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.176.111.159",nocase; classtype:trojan-activity; sid:100001528; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.176.111.35",nocase; classtype:trojan-activity; sid:100001529; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.201.167.13",nocase; classtype:trojan-activity; sid:100001530; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.22.209.58",nocase; classtype:trojan-activity; sid:100001531; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.232.73.56",nocase; classtype:trojan-activity; sid:100001532; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.248.194.48",nocase; classtype:trojan-activity; sid:100001533; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.27.253.137",nocase; classtype:trojan-activity; sid:100001534; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.51.104.59",nocase; classtype:trojan-activity; sid:100001535; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.6.24.251",nocase; classtype:trojan-activity; sid:100001536; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.85.90.131",nocase; classtype:trojan-activity; sid:100001537; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.85.90.203",nocase; classtype:trojan-activity; sid:100001538; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.89.26.245",nocase; classtype:trojan-activity; sid:100001539; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.9.148.37",nocase; classtype:trojan-activity; sid:100001540; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.92.108.35",nocase; classtype:trojan-activity; sid:100001541; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.95.169.153",nocase; classtype:trojan-activity; sid:100001542; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.114.28.132",nocase; classtype:trojan-activity; sid:100001543; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.161.185.15",nocase; classtype:trojan-activity; sid:100001544; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.172.75.231",nocase; classtype:trojan-activity; sid:100001545; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.20.63.218",nocase; classtype:trojan-activity; sid:100001546; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.214.27.4",nocase; classtype:trojan-activity; sid:100001547; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.214.35.50",nocase; classtype:trojan-activity; sid:100001548; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.236.65.83",nocase; classtype:trojan-activity; sid:100001549; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.24.130.254",nocase; classtype:trojan-activity; sid:100001550; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.241.120.165",nocase; classtype:trojan-activity; sid:100001551; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.243.179.115",nocase; classtype:trojan-activity; sid:100001552; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.249.33.79",nocase; classtype:trojan-activity; sid:100001553; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.25.242.211",nocase; classtype:trojan-activity; sid:100001554; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.42.118.86",nocase; classtype:trojan-activity; sid:100001555; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.42.86.128",nocase; classtype:trojan-activity; sid:100001556; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.97.76.242",nocase; classtype:trojan-activity; sid:100001557; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.103.219.77",nocase; classtype:trojan-activity; sid:100001558; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.145.152.26",nocase; classtype:trojan-activity; sid:100001559; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.151.23.172",nocase; classtype:trojan-activity; sid:100001560; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.157.97.71",nocase; classtype:trojan-activity; sid:100001561; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.16.131.51",nocase; classtype:trojan-activity; sid:100001562; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.21.202.98",nocase; classtype:trojan-activity; sid:100001563; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.46.231.38",nocase; classtype:trojan-activity; sid:100001564; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.142.162.113",nocase; classtype:trojan-activity; sid:100001565; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.142.87.36",nocase; classtype:trojan-activity; sid:100001566; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.143.43.93",nocase; classtype:trojan-activity; sid:100001567; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.156.35.166",nocase; classtype:trojan-activity; sid:100001568; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.158.201.200",nocase; classtype:trojan-activity; sid:100001569; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.159.20.121",nocase; classtype:trojan-activity; sid:100001570; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.159.21.3",nocase; classtype:trojan-activity; sid:100001571; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.174.182.99",nocase; classtype:trojan-activity; sid:100001572; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.213.170.49",nocase; classtype:trojan-activity; sid:100001573; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.213.178.183",nocase; classtype:trojan-activity; sid:100001574; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.213.179.129",nocase; classtype:trojan-activity; sid:100001575; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.14.122.233",nocase; classtype:trojan-activity; sid:100001576; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.188.62.111",nocase; classtype:trojan-activity; sid:100001577; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.2.70.50",nocase; classtype:trojan-activity; sid:100001578; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.53.146.179",nocase; classtype:trojan-activity; sid:100001579; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.95.226.154",nocase; classtype:trojan-activity; sid:100001580; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.115.174.102",nocase; classtype:trojan-activity; sid:100001581; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.115.174.103",nocase; classtype:trojan-activity; sid:100001582; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.115.174.106",nocase; classtype:trojan-activity; sid:100001583; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.121.91.255",nocase; classtype:trojan-activity; sid:100001584; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.247.83.66",nocase; classtype:trojan-activity; sid:100001585; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.252.47.29",nocase; classtype:trojan-activity; sid:100001586; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"54.36.114.136",nocase; classtype:trojan-activity; sid:100001587; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"54.36.180.122",nocase; classtype:trojan-activity; sid:100001588; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.114.246.26",nocase; classtype:trojan-activity; sid:100001589; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.115.162.92",nocase; classtype:trojan-activity; sid:100001590; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.115.174.4",nocase; classtype:trojan-activity; sid:100001591; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.125.191.4",nocase; classtype:trojan-activity; sid:100001592; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.126.247.118",nocase; classtype:trojan-activity; sid:100001593; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.141.122.109",nocase; classtype:trojan-activity; sid:100001594; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.142.166.120",nocase; classtype:trojan-activity; sid:100001595; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.142.200.124",nocase; classtype:trojan-activity; sid:100001596; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.218.67.253",nocase; classtype:trojan-activity; sid:100001597; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.22.212.107",nocase; classtype:trojan-activity; sid:100001598; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.226.129.29",nocase; classtype:trojan-activity; sid:100001599; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.229.194.122",nocase; classtype:trojan-activity; sid:100001600; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.230.89.42",nocase; classtype:trojan-activity; sid:100001601; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.237.125.4",nocase; classtype:trojan-activity; sid:100001602; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.238.42.192",nocase; classtype:trojan-activity; sid:100001603; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.240.147.97",nocase; classtype:trojan-activity; sid:100001604; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.241.78.55",nocase; classtype:trojan-activity; sid:100001605; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.243.126.133",nocase; classtype:trojan-activity; sid:100001606; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.72.165.153",nocase; classtype:trojan-activity; sid:100001607; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.72.165.39",nocase; classtype:trojan-activity; sid:100001608; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"216.183.54.196",nocase; classtype:trojan-activity; sid:100001174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"216.36.12.98",nocase; classtype:trojan-activity; sid:100001175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"217.11.75.162",nocase; classtype:trojan-activity; sid:100001176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"217.12.209.82",nocase; classtype:trojan-activity; sid:100001177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.12.181.110",nocase; classtype:trojan-activity; sid:100001178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.2.40.34",nocase; classtype:trojan-activity; sid:100001179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.234.165.18",nocase; classtype:trojan-activity; sid:100001180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.238.246.3",nocase; classtype:trojan-activity; sid:100001181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.255.226.166",nocase; classtype:trojan-activity; sid:100001182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.32.118.1",nocase; classtype:trojan-activity; sid:100001183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.35.207.119",nocase; classtype:trojan-activity; sid:100001184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.35.227.133",nocase; classtype:trojan-activity; sid:100001185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.35.68.35",nocase; classtype:trojan-activity; sid:100001186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.35.81.81",nocase; classtype:trojan-activity; sid:100001187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.56.93.129",nocase; classtype:trojan-activity; sid:100001188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.59.116.203",nocase; classtype:trojan-activity; sid:100001189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.79.103.159",nocase; classtype:trojan-activity; sid:100001190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.93.102.63",nocase; classtype:trojan-activity; sid:100001191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"218.93.102.75",nocase; classtype:trojan-activity; sid:100001192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.155.234.33",nocase; classtype:trojan-activity; sid:100001193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.155.29.165",nocase; classtype:trojan-activity; sid:100001194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.155.64.104",nocase; classtype:trojan-activity; sid:100001195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.157.139.165",nocase; classtype:trojan-activity; sid:100001196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.241.6.180",nocase; classtype:trojan-activity; sid:100001197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.1.148",nocase; classtype:trojan-activity; sid:100001198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.1.84",nocase; classtype:trojan-activity; sid:100001199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.163.7",nocase; classtype:trojan-activity; sid:100001200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.171.144",nocase; classtype:trojan-activity; sid:100001201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.245.63",nocase; classtype:trojan-activity; sid:100001202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.68.5.140",nocase; classtype:trojan-activity; sid:100001203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.69.71.186",nocase; classtype:trojan-activity; sid:100001204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.80.217.209",nocase; classtype:trojan-activity; sid:100001205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"219.85.145.194",nocase; classtype:trojan-activity; sid:100001206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"21robo.com",nocase; classtype:trojan-activity; sid:100001207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.118.168.155",nocase; classtype:trojan-activity; sid:100001208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.126.237.74",nocase; classtype:trojan-activity; sid:100001209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.200.22.163",nocase; classtype:trojan-activity; sid:100001210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.81.44.181",nocase; classtype:trojan-activity; sid:100001211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"220.90.159.188",nocase; classtype:trojan-activity; sid:100001212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.0.133.84",nocase; classtype:trojan-activity; sid:100001213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.124.78.15",nocase; classtype:trojan-activity; sid:100001214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.157.191.178",nocase; classtype:trojan-activity; sid:100001215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.160.136.213",nocase; classtype:trojan-activity; sid:100001216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.201.54.97",nocase; classtype:trojan-activity; sid:100001217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.202.232.230",nocase; classtype:trojan-activity; sid:100001218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.214.130.147",nocase; classtype:trojan-activity; sid:100001219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.214.251.109",nocase; classtype:trojan-activity; sid:100001220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.116.167",nocase; classtype:trojan-activity; sid:100001221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.172.207",nocase; classtype:trojan-activity; sid:100001222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.184.31",nocase; classtype:trojan-activity; sid:100001223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.252.64",nocase; classtype:trojan-activity; sid:100001224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.215.8.64",nocase; classtype:trojan-activity; sid:100001225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.232.183.167",nocase; classtype:trojan-activity; sid:100001226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.235.137.36",nocase; classtype:trojan-activity; sid:100001227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.3.112.125",nocase; classtype:trojan-activity; sid:100001228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.3.43.223",nocase; classtype:trojan-activity; sid:100001229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"221.3.68.16",nocase; classtype:trojan-activity; sid:100001230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.108.17.64",nocase; classtype:trojan-activity; sid:100001231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.118.248.149",nocase; classtype:trojan-activity; sid:100001232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.119.65.145",nocase; classtype:trojan-activity; sid:100001233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.132.125.138",nocase; classtype:trojan-activity; sid:100001234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.133.103.120",nocase; classtype:trojan-activity; sid:100001235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.135.9.5",nocase; classtype:trojan-activity; sid:100001236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.137.133.125",nocase; classtype:trojan-activity; sid:100001237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.137.139.86",nocase; classtype:trojan-activity; sid:100001238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.137.73.214",nocase; classtype:trojan-activity; sid:100001239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.140.17.245",nocase; classtype:trojan-activity; sid:100001240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.142.210.144",nocase; classtype:trojan-activity; sid:100001241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.185.116.233",nocase; classtype:trojan-activity; sid:100001242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.186.20.19",nocase; classtype:trojan-activity; sid:100001243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.187.9.178",nocase; classtype:trojan-activity; sid:100001244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.211.72.66",nocase; classtype:trojan-activity; sid:100001245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.236.85.220",nocase; classtype:trojan-activity; sid:100001246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.238.230.7",nocase; classtype:trojan-activity; sid:100001247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.239.83.232",nocase; classtype:trojan-activity; sid:100001248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.248.64.253",nocase; classtype:trojan-activity; sid:100001249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.92.9.126",nocase; classtype:trojan-activity; sid:100001250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.95.190.20",nocase; classtype:trojan-activity; sid:100001251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"222.99.171.192",nocase; classtype:trojan-activity; sid:100001252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.13.87.209",nocase; classtype:trojan-activity; sid:100001253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.131.201.82",nocase; classtype:trojan-activity; sid:100001254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.166.117.210",nocase; classtype:trojan-activity; sid:100001255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.167.118.17",nocase; classtype:trojan-activity; sid:100001256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.212.234.84",nocase; classtype:trojan-activity; sid:100001257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.212.5.29",nocase; classtype:trojan-activity; sid:100001258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"223.212.73.175",nocase; classtype:trojan-activity; sid:100001259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.115.118.232",nocase; classtype:trojan-activity; sid:100001260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.125.186.135",nocase; classtype:trojan-activity; sid:100001261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.126.120.25",nocase; classtype:trojan-activity; sid:100001262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.24.213.121",nocase; classtype:trojan-activity; sid:100001263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.243.149.13",nocase; classtype:trojan-activity; sid:100001264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.243.21.167",nocase; classtype:trojan-activity; sid:100001265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.95.122.24",nocase; classtype:trojan-activity; sid:100001266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"23.95.89.21",nocase; classtype:trojan-activity; sid:100001267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.103.74.180",nocase; classtype:trojan-activity; sid:100001268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.11.141.134",nocase; classtype:trojan-activity; sid:100001269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.119.158.74",nocase; classtype:trojan-activity; sid:100001270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.137.147.95",nocase; classtype:trojan-activity; sid:100001271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.137.233.132",nocase; classtype:trojan-activity; sid:100001272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.158.25.98",nocase; classtype:trojan-activity; sid:100001273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.176.206.12",nocase; classtype:trojan-activity; sid:100001274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.184.1.41",nocase; classtype:trojan-activity; sid:100001275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.192.191.109",nocase; classtype:trojan-activity; sid:100001276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.225.114.161",nocase; classtype:trojan-activity; sid:100001277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.227.190.78",nocase; classtype:trojan-activity; sid:100001278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.35.245.52",nocase; classtype:trojan-activity; sid:100001279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.39.181.18",nocase; classtype:trojan-activity; sid:100001280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.39.34.242",nocase; classtype:trojan-activity; sid:100001281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.42.229.143",nocase; classtype:trojan-activity; sid:100001282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.45.4.1",nocase; classtype:trojan-activity; sid:100001283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.51.91.113",nocase; classtype:trojan-activity; sid:100001284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.53.163.10",nocase; classtype:trojan-activity; sid:100001285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.53.163.9",nocase; classtype:trojan-activity; sid:100001286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"24.89.140.190",nocase; classtype:trojan-activity; sid:100001287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.1.245.16",nocase; classtype:trojan-activity; sid:100001288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.1.245.7",nocase; classtype:trojan-activity; sid:100001289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.105.106.201",nocase; classtype:trojan-activity; sid:100001290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.105.152.107",nocase; classtype:trojan-activity; sid:100001291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.116.84.57",nocase; classtype:trojan-activity; sid:100001292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.117.105.125",nocase; classtype:trojan-activity; sid:100001293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.14.211.219",nocase; classtype:trojan-activity; sid:100001294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.14.81.201",nocase; classtype:trojan-activity; sid:100001295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.141.218.17",nocase; classtype:trojan-activity; sid:100001296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.147.29.52",nocase; classtype:trojan-activity; sid:100001297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.147.40.128",nocase; classtype:trojan-activity; sid:100001298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.184.251.135",nocase; classtype:trojan-activity; sid:100001299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.193.217.210",nocase; classtype:trojan-activity; sid:100001300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.194.192.66",nocase; classtype:trojan-activity; sid:100001301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.197.23.215",nocase; classtype:trojan-activity; sid:100001302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.199.232.65",nocase; classtype:trojan-activity; sid:100001303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.199.34.48",nocase; classtype:trojan-activity; sid:100001304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.200.110.211",nocase; classtype:trojan-activity; sid:100001305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.200.32.146",nocase; classtype:trojan-activity; sid:100001306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.201.183.149",nocase; classtype:trojan-activity; sid:100001307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.202.182.201",nocase; classtype:trojan-activity; sid:100001308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.102.12",nocase; classtype:trojan-activity; sid:100001309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.116.86",nocase; classtype:trojan-activity; sid:100001310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.165.138",nocase; classtype:trojan-activity; sid:100001311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.185.42",nocase; classtype:trojan-activity; sid:100001312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.255.42",nocase; classtype:trojan-activity; sid:100001313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.28.115",nocase; classtype:trojan-activity; sid:100001314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.4.188",nocase; classtype:trojan-activity; sid:100001315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.47.104",nocase; classtype:trojan-activity; sid:100001316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.68.144",nocase; classtype:trojan-activity; sid:100001317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.87.75",nocase; classtype:trojan-activity; sid:100001318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.203.94.134",nocase; classtype:trojan-activity; sid:100001319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.204.253.74",nocase; classtype:trojan-activity; sid:100001320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.205.178.110",nocase; classtype:trojan-activity; sid:100001321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.206.136.101",nocase; classtype:trojan-activity; sid:100001322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.206.154.122",nocase; classtype:trojan-activity; sid:100001323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.206.80.209",nocase; classtype:trojan-activity; sid:100001324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.119.27",nocase; classtype:trojan-activity; sid:100001325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.237.105",nocase; classtype:trojan-activity; sid:100001326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.247.130",nocase; classtype:trojan-activity; sid:100001327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.25.59",nocase; classtype:trojan-activity; sid:100001328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.208.34.2",nocase; classtype:trojan-activity; sid:100001329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.209.231.15",nocase; classtype:trojan-activity; sid:100001330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.21.151.205",nocase; classtype:trojan-activity; sid:100001331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.107.125",nocase; classtype:trojan-activity; sid:100001332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.234.28",nocase; classtype:trojan-activity; sid:100001333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.236.134",nocase; classtype:trojan-activity; sid:100001334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.32.122",nocase; classtype:trojan-activity; sid:100001335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.210.63.243",nocase; classtype:trojan-activity; sid:100001336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.104.201",nocase; classtype:trojan-activity; sid:100001337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.109.105",nocase; classtype:trojan-activity; sid:100001338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.110.189",nocase; classtype:trojan-activity; sid:100001339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.175.208",nocase; classtype:trojan-activity; sid:100001340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.255.202",nocase; classtype:trojan-activity; sid:100001341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.66.112",nocase; classtype:trojan-activity; sid:100001342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.213.84.74",nocase; classtype:trojan-activity; sid:100001343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.214.37.129",nocase; classtype:trojan-activity; sid:100001344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.139.242",nocase; classtype:trojan-activity; sid:100001345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.190.172",nocase; classtype:trojan-activity; sid:100001346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.212.209",nocase; classtype:trojan-activity; sid:100001347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.253.149",nocase; classtype:trojan-activity; sid:100001348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.71.243",nocase; classtype:trojan-activity; sid:100001349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.215.98.242",nocase; classtype:trojan-activity; sid:100001350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.128.156",nocase; classtype:trojan-activity; sid:100001351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.144.66",nocase; classtype:trojan-activity; sid:100001352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.225.28",nocase; classtype:trojan-activity; sid:100001353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.227.95",nocase; classtype:trojan-activity; sid:100001354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.216.234.98",nocase; classtype:trojan-activity; sid:100001355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.217.191.58",nocase; classtype:trojan-activity; sid:100001356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.218.248.121",nocase; classtype:trojan-activity; sid:100001357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.132.71",nocase; classtype:trojan-activity; sid:100001358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.151.83",nocase; classtype:trojan-activity; sid:100001359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.160.112",nocase; classtype:trojan-activity; sid:100001360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.176.72",nocase; classtype:trojan-activity; sid:100001361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.219.83.244",nocase; classtype:trojan-activity; sid:100001362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.220.20.66",nocase; classtype:trojan-activity; sid:100001363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.220.249.0",nocase; classtype:trojan-activity; sid:100001364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.220.85.168",nocase; classtype:trojan-activity; sid:100001365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.221.239.223",nocase; classtype:trojan-activity; sid:100001366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.222.241.223",nocase; classtype:trojan-activity; sid:100001367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.222.76.80",nocase; classtype:trojan-activity; sid:100001368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.223.242.164",nocase; classtype:trojan-activity; sid:100001369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.129.198",nocase; classtype:trojan-activity; sid:100001370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.154.13",nocase; classtype:trojan-activity; sid:100001371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.171.36",nocase; classtype:trojan-activity; sid:100001372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.212.124",nocase; classtype:trojan-activity; sid:100001373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.35.58.5",nocase; classtype:trojan-activity; sid:100001374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"27.6.255.101",nocase; classtype:trojan-activity; sid:100001375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.0.98.131",nocase; classtype:trojan-activity; sid:100001376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.11.51.57",nocase; classtype:trojan-activity; sid:100001377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.13.23.180",nocase; classtype:trojan-activity; sid:100001378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.124.130",nocase; classtype:trojan-activity; sid:100001379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.146.199",nocase; classtype:trojan-activity; sid:100001380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.179.83",nocase; classtype:trojan-activity; sid:100001381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.184.59",nocase; classtype:trojan-activity; sid:100001382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.191.243",nocase; classtype:trojan-activity; sid:100001383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.194.67",nocase; classtype:trojan-activity; sid:100001384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.216.132",nocase; classtype:trojan-activity; sid:100001385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.219.28",nocase; classtype:trojan-activity; sid:100001386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.24.115",nocase; classtype:trojan-activity; sid:100001387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.30.65",nocase; classtype:trojan-activity; sid:100001388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.63.203",nocase; classtype:trojan-activity; sid:100001389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.65.233",nocase; classtype:trojan-activity; sid:100001390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.79.66",nocase; classtype:trojan-activity; sid:100001391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.168.94.16",nocase; classtype:trojan-activity; sid:100001392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.179.201.26",nocase; classtype:trojan-activity; sid:100001393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.195.84.250",nocase; classtype:trojan-activity; sid:100001394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.210.20.138",nocase; classtype:trojan-activity; sid:100001395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.210.20.177",nocase; classtype:trojan-activity; sid:100001396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.210.20.69",nocase; classtype:trojan-activity; sid:100001397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.28.7.159",nocase; classtype:trojan-activity; sid:100001398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.30.119.23",nocase; classtype:trojan-activity; sid:100001399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"31.32.120.79",nocase; classtype:trojan-activity; sid:100001400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"32.208.157.193",nocase; classtype:trojan-activity; sid:100001401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"34.122.44.188",nocase; classtype:trojan-activity; sid:100001402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"35.184.169.169",nocase; classtype:trojan-activity; sid:100001403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.108.231.218",nocase; classtype:trojan-activity; sid:100001404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.248.83.98",nocase; classtype:trojan-activity; sid:100001405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.249.49.142",nocase; classtype:trojan-activity; sid:100001406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.250.203.246",nocase; classtype:trojan-activity; sid:100001407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.251.157.225",nocase; classtype:trojan-activity; sid:100001408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.251.18.18",nocase; classtype:trojan-activity; sid:100001409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.251.51.244",nocase; classtype:trojan-activity; sid:100001410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.255.90.219",nocase; classtype:trojan-activity; sid:100001411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.33.160.167",nocase; classtype:trojan-activity; sid:100001412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.34.150.236",nocase; classtype:trojan-activity; sid:100001413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.66.105.159",nocase; classtype:trojan-activity; sid:100001414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.66.133.125",nocase; classtype:trojan-activity; sid:100001415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.66.139.36",nocase; classtype:trojan-activity; sid:100001416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.67.152.161",nocase; classtype:trojan-activity; sid:100001417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.89.18.133",nocase; classtype:trojan-activity; sid:100001418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"36.91.89.187",nocase; classtype:trojan-activity; sid:100001419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"360.lcy2zzx.pw",nocase; classtype:trojan-activity; sid:100001420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"360down7.miiyun.cn",nocase; classtype:trojan-activity; sid:100001421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.222.98.51",nocase; classtype:trojan-activity; sid:100001422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.233.60.68",nocase; classtype:trojan-activity; sid:100001423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.34.179.221",nocase; classtype:trojan-activity; sid:100001424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.34.180.172",nocase; classtype:trojan-activity; sid:100001425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.44.238.35",nocase; classtype:trojan-activity; sid:100001426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.52.118.199",nocase; classtype:trojan-activity; sid:100001427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"37.54.14.36",nocase; classtype:trojan-activity; sid:100001428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.113.245.254",nocase; classtype:trojan-activity; sid:100001429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.113.98.136",nocase; classtype:trojan-activity; sid:100001430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.117.31.162",nocase; classtype:trojan-activity; sid:100001431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.162.104.119",nocase; classtype:trojan-activity; sid:100001432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.162.98.216",nocase; classtype:trojan-activity; sid:100001433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.65.196.34",nocase; classtype:trojan-activity; sid:100001434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.66.44.109",nocase; classtype:trojan-activity; sid:100001435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.104.83",nocase; classtype:trojan-activity; sid:100001436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.125.186",nocase; classtype:trojan-activity; sid:100001437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.146.60",nocase; classtype:trojan-activity; sid:100001438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.206.228",nocase; classtype:trojan-activity; sid:100001439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.67.92.131",nocase; classtype:trojan-activity; sid:100001440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.68.171.125",nocase; classtype:trojan-activity; sid:100001441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.68.249.255",nocase; classtype:trojan-activity; sid:100001442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.68.60.61",nocase; classtype:trojan-activity; sid:100001443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.72.167.202",nocase; classtype:trojan-activity; sid:100001444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.72.67.64",nocase; classtype:trojan-activity; sid:100001445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.73.10.198",nocase; classtype:trojan-activity; sid:100001446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.73.163.231",nocase; classtype:trojan-activity; sid:100001447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.73.168.234",nocase; classtype:trojan-activity; sid:100001448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.73.203.225",nocase; classtype:trojan-activity; sid:100001449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.76.194.65",nocase; classtype:trojan-activity; sid:100001450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.76.78.251",nocase; classtype:trojan-activity; sid:100001451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.113.201",nocase; classtype:trojan-activity; sid:100001452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.114.45",nocase; classtype:trojan-activity; sid:100001453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.150.203",nocase; classtype:trojan-activity; sid:100001454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.209.209",nocase; classtype:trojan-activity; sid:100001455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.48.213",nocase; classtype:trojan-activity; sid:100001456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.77.63.152",nocase; classtype:trojan-activity; sid:100001457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.79.166.31",nocase; classtype:trojan-activity; sid:100001458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.79.218.46",nocase; classtype:trojan-activity; sid:100001459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.79.91.244",nocase; classtype:trojan-activity; sid:100001460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.79.93.171",nocase; classtype:trojan-activity; sid:100001461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.127.214",nocase; classtype:trojan-activity; sid:100001462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.18.140",nocase; classtype:trojan-activity; sid:100001463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.191.137",nocase; classtype:trojan-activity; sid:100001464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.205.255",nocase; classtype:trojan-activity; sid:100001465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.24.54",nocase; classtype:trojan-activity; sid:100001466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.36.151",nocase; classtype:trojan-activity; sid:100001467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.80.37.182",nocase; classtype:trojan-activity; sid:100001468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.81.251.0",nocase; classtype:trojan-activity; sid:100001469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.81.27.15",nocase; classtype:trojan-activity; sid:100001470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.81.29.231",nocase; classtype:trojan-activity; sid:100001471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.81.70.88",nocase; classtype:trojan-activity; sid:100001472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.83.94.11",nocase; classtype:trojan-activity; sid:100001473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.84.115.152",nocase; classtype:trojan-activity; sid:100001474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.85.54.4",nocase; classtype:trojan-activity; sid:100001475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.86.211.20",nocase; classtype:trojan-activity; sid:100001476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.86.234.187",nocase; classtype:trojan-activity; sid:100001477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.86.78.244",nocase; classtype:trojan-activity; sid:100001478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.87.63.58",nocase; classtype:trojan-activity; sid:100001479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.87.93.109",nocase; classtype:trojan-activity; sid:100001480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.143.176",nocase; classtype:trojan-activity; sid:100001481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.155.96",nocase; classtype:trojan-activity; sid:100001482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.233.131",nocase; classtype:trojan-activity; sid:100001483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.67.238",nocase; classtype:trojan-activity; sid:100001484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.88.72.9",nocase; classtype:trojan-activity; sid:100001485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.89.145.11",nocase; classtype:trojan-activity; sid:100001486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.89.146.36",nocase; classtype:trojan-activity; sid:100001487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.89.63.23",nocase; classtype:trojan-activity; sid:100001488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.90.176.191",nocase; classtype:trojan-activity; sid:100001489; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"39.90.86.212",nocase; classtype:trojan-activity; sid:100001490; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"40.88.2.151",nocase; classtype:trojan-activity; sid:100001491; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.139.209.46",nocase; classtype:trojan-activity; sid:100001492; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.165.130.43",nocase; classtype:trojan-activity; sid:100001493; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.193.192.100",nocase; classtype:trojan-activity; sid:100001494; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.219.185.171",nocase; classtype:trojan-activity; sid:100001495; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.226.60.115",nocase; classtype:trojan-activity; sid:100001496; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.72.203.82",nocase; classtype:trojan-activity; sid:100001497; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.76.157.2",nocase; classtype:trojan-activity; sid:100001498; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.86.18.200",nocase; classtype:trojan-activity; sid:100001499; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.86.5.164",nocase; classtype:trojan-activity; sid:100001500; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"41.86.5.197",nocase; classtype:trojan-activity; sid:100001501; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.202.101.118",nocase; classtype:trojan-activity; sid:100001502; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.202.101.199",nocase; classtype:trojan-activity; sid:100001503; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.224.51.229",nocase; classtype:trojan-activity; sid:100001504; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.228.60.114",nocase; classtype:trojan-activity; sid:100001505; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.229.173.80",nocase; classtype:trojan-activity; sid:100001506; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.230.91.1",nocase; classtype:trojan-activity; sid:100001507; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.231.208.64",nocase; classtype:trojan-activity; sid:100001508; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.236.212.157",nocase; classtype:trojan-activity; sid:100001509; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.56.15.227",nocase; classtype:trojan-activity; sid:100001510; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"42.61.99.155",nocase; classtype:trojan-activity; sid:100001511; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"43.230.207.204",nocase; classtype:trojan-activity; sid:100001512; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"43.241.106.183",nocase; classtype:trojan-activity; sid:100001513; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.133.1.242",nocase; classtype:trojan-activity; sid:100001514; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.133.203.192",nocase; classtype:trojan-activity; sid:100001515; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.135.134.228",nocase; classtype:trojan-activity; sid:100001516; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.14.149.178",nocase; classtype:trojan-activity; sid:100001517; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.14.149.182",nocase; classtype:trojan-activity; sid:100001518; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.14.149.204",nocase; classtype:trojan-activity; sid:100001519; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.141.84.184",nocase; classtype:trojan-activity; sid:100001520; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.118",nocase; classtype:trojan-activity; sid:100001521; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.135",nocase; classtype:trojan-activity; sid:100001522; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.139",nocase; classtype:trojan-activity; sid:100001523; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.213",nocase; classtype:trojan-activity; sid:100001524; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.242",nocase; classtype:trojan-activity; sid:100001525; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.144.225.27",nocase; classtype:trojan-activity; sid:100001526; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.148.10.47",nocase; classtype:trojan-activity; sid:100001527; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.148.10.94",nocase; classtype:trojan-activity; sid:100001528; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.156.22.230",nocase; classtype:trojan-activity; sid:100001529; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.176.109.205",nocase; classtype:trojan-activity; sid:100001530; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.176.111.159",nocase; classtype:trojan-activity; sid:100001531; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.176.111.35",nocase; classtype:trojan-activity; sid:100001532; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.201.167.13",nocase; classtype:trojan-activity; sid:100001533; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.22.209.58",nocase; classtype:trojan-activity; sid:100001534; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.232.73.56",nocase; classtype:trojan-activity; sid:100001535; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.248.194.48",nocase; classtype:trojan-activity; sid:100001536; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.27.253.137",nocase; classtype:trojan-activity; sid:100001537; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.51.104.59",nocase; classtype:trojan-activity; sid:100001538; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.6.24.251",nocase; classtype:trojan-activity; sid:100001539; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.85.90.131",nocase; classtype:trojan-activity; sid:100001540; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.85.90.203",nocase; classtype:trojan-activity; sid:100001541; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.89.26.245",nocase; classtype:trojan-activity; sid:100001542; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.9.148.37",nocase; classtype:trojan-activity; sid:100001543; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.92.108.35",nocase; classtype:trojan-activity; sid:100001544; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"45.95.169.153",nocase; classtype:trojan-activity; sid:100001545; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.114.28.132",nocase; classtype:trojan-activity; sid:100001546; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.172.75.231",nocase; classtype:trojan-activity; sid:100001547; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.20.63.218",nocase; classtype:trojan-activity; sid:100001548; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.214.27.4",nocase; classtype:trojan-activity; sid:100001549; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.214.35.50",nocase; classtype:trojan-activity; sid:100001550; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.236.65.83",nocase; classtype:trojan-activity; sid:100001551; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.24.130.254",nocase; classtype:trojan-activity; sid:100001552; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.241.120.165",nocase; classtype:trojan-activity; sid:100001553; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.243.179.115",nocase; classtype:trojan-activity; sid:100001554; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.249.33.79",nocase; classtype:trojan-activity; sid:100001555; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.25.242.211",nocase; classtype:trojan-activity; sid:100001556; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.42.118.86",nocase; classtype:trojan-activity; sid:100001557; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.42.86.128",nocase; classtype:trojan-activity; sid:100001558; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"46.97.76.242",nocase; classtype:trojan-activity; sid:100001559; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.103.219.77",nocase; classtype:trojan-activity; sid:100001560; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.145.152.26",nocase; classtype:trojan-activity; sid:100001561; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.151.23.172",nocase; classtype:trojan-activity; sid:100001562; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.157.97.71",nocase; classtype:trojan-activity; sid:100001563; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.16.131.51",nocase; classtype:trojan-activity; sid:100001564; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.21.202.98",nocase; classtype:trojan-activity; sid:100001565; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"47.46.231.38",nocase; classtype:trojan-activity; sid:100001566; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.142.162.113",nocase; classtype:trojan-activity; sid:100001567; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.142.87.36",nocase; classtype:trojan-activity; sid:100001568; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.143.43.93",nocase; classtype:trojan-activity; sid:100001569; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.156.35.166",nocase; classtype:trojan-activity; sid:100001570; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.158.201.200",nocase; classtype:trojan-activity; sid:100001571; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.159.20.121",nocase; classtype:trojan-activity; sid:100001572; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.159.21.3",nocase; classtype:trojan-activity; sid:100001573; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.174.182.99",nocase; classtype:trojan-activity; sid:100001574; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.213.170.49",nocase; classtype:trojan-activity; sid:100001575; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.213.178.183",nocase; classtype:trojan-activity; sid:100001576; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"49.213.179.129",nocase; classtype:trojan-activity; sid:100001577; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"4et3ja.am.files.1drv.com",nocase; classtype:trojan-activity; sid:100001578; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.14.122.233",nocase; classtype:trojan-activity; sid:100001579; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.188.62.111",nocase; classtype:trojan-activity; sid:100001580; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.2.70.50",nocase; classtype:trojan-activity; sid:100001581; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.53.146.179",nocase; classtype:trojan-activity; sid:100001582; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"5.95.226.154",nocase; classtype:trojan-activity; sid:100001583; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.115.174.102",nocase; classtype:trojan-activity; sid:100001584; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.115.174.103",nocase; classtype:trojan-activity; sid:100001585; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.115.174.106",nocase; classtype:trojan-activity; sid:100001586; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.121.91.255",nocase; classtype:trojan-activity; sid:100001587; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.247.83.66",nocase; classtype:trojan-activity; sid:100001588; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"50.252.47.29",nocase; classtype:trojan-activity; sid:100001589; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"54.36.114.136",nocase; classtype:trojan-activity; sid:100001590; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"54.36.180.122",nocase; classtype:trojan-activity; sid:100001591; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.114.246.26",nocase; classtype:trojan-activity; sid:100001592; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.115.162.92",nocase; classtype:trojan-activity; sid:100001593; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.115.174.4",nocase; classtype:trojan-activity; sid:100001594; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.125.191.4",nocase; classtype:trojan-activity; sid:100001595; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.126.247.118",nocase; classtype:trojan-activity; sid:100001596; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.142.166.120",nocase; classtype:trojan-activity; sid:100001597; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.142.200.124",nocase; classtype:trojan-activity; sid:100001598; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.22.212.107",nocase; classtype:trojan-activity; sid:100001599; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.226.129.29",nocase; classtype:trojan-activity; sid:100001600; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.229.194.122",nocase; classtype:trojan-activity; sid:100001601; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.230.89.42",nocase; classtype:trojan-activity; sid:100001602; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.237.125.4",nocase; classtype:trojan-activity; sid:100001603; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.238.42.192",nocase; classtype:trojan-activity; sid:100001604; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.240.147.97",nocase; classtype:trojan-activity; sid:100001605; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.241.78.55",nocase; classtype:trojan-activity; sid:100001606; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.243.126.133",nocase; classtype:trojan-activity; sid:100001607; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.72.165.153",nocase; classtype:trojan-activity; sid:100001608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.76.151.51",nocase; classtype:trojan-activity; sid:100001609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"58.97.206.33",nocase; classtype:trojan-activity; sid:100001610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"59.0.211.161",nocase; classtype:trojan-activity; sid:100001611; rev:1;) @@ -1622,30 +1622,30 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"59.151.246.125",nocase; classtype:trojan-activity; sid:100001616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"59.173.193.208",nocase; classtype:trojan-activity; sid:100001617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"59.23.114.97",nocase; classtype:trojan-activity; sid:100001618; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"59.30.12.254",nocase; classtype:trojan-activity; sid:100001619; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.13.61.12",nocase; classtype:trojan-activity; sid:100001620; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.208.135.42",nocase; classtype:trojan-activity; sid:100001621; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.209.122.57",nocase; classtype:trojan-activity; sid:100001622; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.209.186.185",nocase; classtype:trojan-activity; sid:100001623; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.209.216.23",nocase; classtype:trojan-activity; sid:100001624; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.209.233.94",nocase; classtype:trojan-activity; sid:100001625; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.211.6.112",nocase; classtype:trojan-activity; sid:100001626; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.100.83",nocase; classtype:trojan-activity; sid:100001627; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.111.39",nocase; classtype:trojan-activity; sid:100001628; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.206.246",nocase; classtype:trojan-activity; sid:100001629; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.218.31",nocase; classtype:trojan-activity; sid:100001630; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.220.167",nocase; classtype:trojan-activity; sid:100001631; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.254.178",nocase; classtype:trojan-activity; sid:100001632; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.213.83.55",nocase; classtype:trojan-activity; sid:100001633; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.215.195.111",nocase; classtype:trojan-activity; sid:100001634; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.217.177.196",nocase; classtype:trojan-activity; sid:100001635; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.217.86.208",nocase; classtype:trojan-activity; sid:100001636; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.15.104",nocase; classtype:trojan-activity; sid:100001637; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.4.72",nocase; classtype:trojan-activity; sid:100001638; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.44.99",nocase; classtype:trojan-activity; sid:100001639; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.51.127",nocase; classtype:trojan-activity; sid:100001640; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.60.174",nocase; classtype:trojan-activity; sid:100001641; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.8.81",nocase; classtype:trojan-activity; sid:100001642; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"59.26.181.228",nocase; classtype:trojan-activity; sid:100001619; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"59.30.12.254",nocase; classtype:trojan-activity; sid:100001620; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.13.61.12",nocase; classtype:trojan-activity; sid:100001621; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.208.135.42",nocase; classtype:trojan-activity; sid:100001622; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.209.122.57",nocase; classtype:trojan-activity; sid:100001623; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.209.186.185",nocase; classtype:trojan-activity; sid:100001624; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.209.216.23",nocase; classtype:trojan-activity; sid:100001625; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.209.233.94",nocase; classtype:trojan-activity; sid:100001626; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.211.6.112",nocase; classtype:trojan-activity; sid:100001627; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.100.83",nocase; classtype:trojan-activity; sid:100001628; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.111.39",nocase; classtype:trojan-activity; sid:100001629; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.206.246",nocase; classtype:trojan-activity; sid:100001630; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.218.31",nocase; classtype:trojan-activity; sid:100001631; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.220.167",nocase; classtype:trojan-activity; sid:100001632; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.212.254.178",nocase; classtype:trojan-activity; sid:100001633; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.213.83.55",nocase; classtype:trojan-activity; sid:100001634; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.215.195.111",nocase; classtype:trojan-activity; sid:100001635; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.217.177.196",nocase; classtype:trojan-activity; sid:100001636; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.217.86.208",nocase; classtype:trojan-activity; sid:100001637; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.15.104",nocase; classtype:trojan-activity; sid:100001638; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.4.72",nocase; classtype:trojan-activity; sid:100001639; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.44.99",nocase; classtype:trojan-activity; sid:100001640; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.51.127",nocase; classtype:trojan-activity; sid:100001641; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.253.60.174",nocase; classtype:trojan-activity; sid:100001642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.7.10.121",nocase; classtype:trojan-activity; sid:100001643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"60.7.8.43",nocase; classtype:trojan-activity; sid:100001644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"61.164.96.98",nocase; classtype:trojan-activity; sid:100001645; rev:1;) @@ -1676,928 +1676,928 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.141.73.58",nocase; classtype:trojan-activity; sid:100001670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.219.131.205",nocase; classtype:trojan-activity; sid:100001671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.219.143.46",nocase; classtype:trojan-activity; sid:100001672; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.219.227.31",nocase; classtype:trojan-activity; sid:100001673; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.31.126.33",nocase; classtype:trojan-activity; sid:100001674; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.38.149.66",nocase; classtype:trojan-activity; sid:100001675; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.38.222.98",nocase; classtype:trojan-activity; sid:100001676; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.43.207.148",nocase; classtype:trojan-activity; sid:100001677; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.90.165.236",nocase; classtype:trojan-activity; sid:100001678; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"63.245.122.93",nocase; classtype:trojan-activity; sid:100001679; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.125.128.196",nocase; classtype:trojan-activity; sid:100001680; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.21.58.252",nocase; classtype:trojan-activity; sid:100001681; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.26.155.131",nocase; classtype:trojan-activity; sid:100001682; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.35.61.255",nocase; classtype:trojan-activity; sid:100001683; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.229.214.115",nocase; classtype:trojan-activity; sid:100001684; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.57.55.210",nocase; classtype:trojan-activity; sid:100001685; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.74.7.197",nocase; classtype:trojan-activity; sid:100001686; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.97.181.196",nocase; classtype:trojan-activity; sid:100001687; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"67.245.151.203",nocase; classtype:trojan-activity; sid:100001688; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"67.8.138.101",nocase; classtype:trojan-activity; sid:100001689; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"67.83.49.234",nocase; classtype:trojan-activity; sid:100001690; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"67.84.138.165",nocase; classtype:trojan-activity; sid:100001691; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.148.103.248",nocase; classtype:trojan-activity; sid:100001692; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.174.182.226",nocase; classtype:trojan-activity; sid:100001693; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.175.107.153",nocase; classtype:trojan-activity; sid:100001694; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.188.144.143",nocase; classtype:trojan-activity; sid:100001695; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.204.88.29",nocase; classtype:trojan-activity; sid:100001696; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.205.106.84",nocase; classtype:trojan-activity; sid:100001697; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.205.119.241",nocase; classtype:trojan-activity; sid:100001698; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.78.33.33",nocase; classtype:trojan-activity; sid:100001699; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.115.37.205",nocase; classtype:trojan-activity; sid:100001700; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.120.237.255",nocase; classtype:trojan-activity; sid:100001701; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.123.245.151",nocase; classtype:trojan-activity; sid:100001702; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.124.231.110",nocase; classtype:trojan-activity; sid:100001703; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.127.214.47",nocase; classtype:trojan-activity; sid:100001704; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.146.232.34",nocase; classtype:trojan-activity; sid:100001705; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.165.173.49",nocase; classtype:trojan-activity; sid:100001706; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.196.158.227",nocase; classtype:trojan-activity; sid:100001707; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.222.157.166",nocase; classtype:trojan-activity; sid:100001708; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.229.0.133",nocase; classtype:trojan-activity; sid:100001709; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.63.73.234",nocase; classtype:trojan-activity; sid:100001710; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.75.115.194",nocase; classtype:trojan-activity; sid:100001711; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.75.227.186",nocase; classtype:trojan-activity; sid:100001712; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.76.240.206",nocase; classtype:trojan-activity; sid:100001713; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.115.31.30",nocase; classtype:trojan-activity; sid:100001714; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.118.240.88",nocase; classtype:trojan-activity; sid:100001715; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.167.10.180",nocase; classtype:trojan-activity; sid:100001716; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.236.190.250",nocase; classtype:trojan-activity; sid:100001717; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.25.5.105",nocase; classtype:trojan-activity; sid:100001718; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.93.129.118",nocase; classtype:trojan-activity; sid:100001719; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.127.148.69",nocase; classtype:trojan-activity; sid:100001720; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.146.190.91",nocase; classtype:trojan-activity; sid:100001721; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.204.63.239",nocase; classtype:trojan-activity; sid:100001722; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.29.48.164",nocase; classtype:trojan-activity; sid:100001723; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.34.191.213",nocase; classtype:trojan-activity; sid:100001724; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.40.234.166",nocase; classtype:trojan-activity; sid:100001725; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.43.106.142",nocase; classtype:trojan-activity; sid:100001726; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.43.2.122",nocase; classtype:trojan-activity; sid:100001727; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.43.235.106",nocase; classtype:trojan-activity; sid:100001728; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.47.133.58",nocase; classtype:trojan-activity; sid:100001729; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.71.60.69",nocase; classtype:trojan-activity; sid:100001730; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.85.106.211",nocase; classtype:trojan-activity; sid:100001731; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.17.22.30",nocase; classtype:trojan-activity; sid:100001732; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.189.180.98",nocase; classtype:trojan-activity; sid:100001733; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.189.200.62",nocase; classtype:trojan-activity; sid:100001734; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.202.249.109",nocase; classtype:trojan-activity; sid:100001735; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.214.69.226",nocase; classtype:trojan-activity; sid:100001736; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.229.230.118",nocase; classtype:trojan-activity; sid:100001737; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.31.40.122",nocase; classtype:trojan-activity; sid:100001738; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"73.112.123.203",nocase; classtype:trojan-activity; sid:100001739; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"73.204.216.103",nocase; classtype:trojan-activity; sid:100001740; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"73.70.164.42",nocase; classtype:trojan-activity; sid:100001741; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.101.1.159",nocase; classtype:trojan-activity; sid:100001742; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.108.224.112",nocase; classtype:trojan-activity; sid:100001743; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.119.195.101",nocase; classtype:trojan-activity; sid:100001744; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.194.117.165",nocase; classtype:trojan-activity; sid:100001745; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.195.115.176",nocase; classtype:trojan-activity; sid:100001746; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.199.84.77",nocase; classtype:trojan-activity; sid:100001747; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.64.139.223",nocase; classtype:trojan-activity; sid:100001748; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.75.165.81",nocase; classtype:trojan-activity; sid:100001749; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"75.127.141.52",nocase; classtype:trojan-activity; sid:100001750; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"75.83.102.27",nocase; classtype:trojan-activity; sid:100001751; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"75.99.213.61",nocase; classtype:trojan-activity; sid:100001752; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.170.11.82",nocase; classtype:trojan-activity; sid:100001753; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.178.22.145",nocase; classtype:trojan-activity; sid:100001754; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.217.92.231",nocase; classtype:trojan-activity; sid:100001755; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.250.199.133",nocase; classtype:trojan-activity; sid:100001756; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.254.129.227",nocase; classtype:trojan-activity; sid:100001757; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.84.134.33",nocase; classtype:trojan-activity; sid:100001758; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.95.12.137",nocase; classtype:trojan-activity; sid:100001759; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.111.182.31",nocase; classtype:trojan-activity; sid:100001760; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.237.25.210",nocase; classtype:trojan-activity; sid:100001761; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.71.50.153",nocase; classtype:trojan-activity; sid:100001762; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.71.52.220",nocase; classtype:trojan-activity; sid:100001763; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.89.203.238",nocase; classtype:trojan-activity; sid:100001764; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77st.net",nocase; classtype:trojan-activity; sid:100001765; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.145.224.45",nocase; classtype:trojan-activity; sid:100001766; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.187.141.144",nocase; classtype:trojan-activity; sid:100001767; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.187.240.125",nocase; classtype:trojan-activity; sid:100001768; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.187.41.200",nocase; classtype:trojan-activity; sid:100001769; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.188.106.235",nocase; classtype:trojan-activity; sid:100001770; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.188.168.64",nocase; classtype:trojan-activity; sid:100001771; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.188.188.141",nocase; classtype:trojan-activity; sid:100001772; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.189.104.157",nocase; classtype:trojan-activity; sid:100001773; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.189.176.163",nocase; classtype:trojan-activity; sid:100001774; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.23.172.81",nocase; classtype:trojan-activity; sid:100001775; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.8.225.77",nocase; classtype:trojan-activity; sid:100001776; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.11.195.121",nocase; classtype:trojan-activity; sid:100001777; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.130.253.13",nocase; classtype:trojan-activity; sid:100001778; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.147.123.48",nocase; classtype:trojan-activity; sid:100001779; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.167.189.236",nocase; classtype:trojan-activity; sid:100001780; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.175.42.244",nocase; classtype:trojan-activity; sid:100001781; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.21.84.63",nocase; classtype:trojan-activity; sid:100001782; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.7.170.58",nocase; classtype:trojan-activity; sid:100001783; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.79.58.94",nocase; classtype:trojan-activity; sid:100001784; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.8.70.162",nocase; classtype:trojan-activity; sid:100001785; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.9.88.185",nocase; classtype:trojan-activity; sid:100001786; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.107.89.207",nocase; classtype:trojan-activity; sid:100001787; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.19.101.218",nocase; classtype:trojan-activity; sid:100001788; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.211.181.77",nocase; classtype:trojan-activity; sid:100001789; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.217.12.7",nocase; classtype:trojan-activity; sid:100001790; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.99.128.61",nocase; classtype:trojan-activity; sid:100001791; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.136.146.213",nocase; classtype:trojan-activity; sid:100001792; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.165.44.109",nocase; classtype:trojan-activity; sid:100001793; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.191.40.58",nocase; classtype:trojan-activity; sid:100001794; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.213.141.184",nocase; classtype:trojan-activity; sid:100001795; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.215.199.29",nocase; classtype:trojan-activity; sid:100001796; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.218.187.113",nocase; classtype:trojan-activity; sid:100001797; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.218.195.216",nocase; classtype:trojan-activity; sid:100001798; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.237.128.200",nocase; classtype:trojan-activity; sid:100001799; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.244.219.41",nocase; classtype:trojan-activity; sid:100001800; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.246.225.203",nocase; classtype:trojan-activity; sid:100001801; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.92.36.96",nocase; classtype:trojan-activity; sid:100001802; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.103.108.72",nocase; classtype:trojan-activity; sid:100001803; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.135.196.130",nocase; classtype:trojan-activity; sid:100001804; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.166.212.178",nocase; classtype:trojan-activity; sid:100001805; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.166.85.112",nocase; classtype:trojan-activity; sid:100001806; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.207.61.194",nocase; classtype:trojan-activity; sid:100001807; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.209.250.155",nocase; classtype:trojan-activity; sid:100001808; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.211.156.38",nocase; classtype:trojan-activity; sid:100001809; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.59.31.181",nocase; classtype:trojan-activity; sid:100001810; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.62.110.252",nocase; classtype:trojan-activity; sid:100001811; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.62.53.77",nocase; classtype:trojan-activity; sid:100001812; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.80.138.72",nocase; classtype:trojan-activity; sid:100001813; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.80.139.92",nocase; classtype:trojan-activity; sid:100001814; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.80.154.214",nocase; classtype:trojan-activity; sid:100001815; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.80.187.109",nocase; classtype:trojan-activity; sid:100001816; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.100.54",nocase; classtype:trojan-activity; sid:100001817; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.106.65",nocase; classtype:trojan-activity; sid:100001818; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.108.172",nocase; classtype:trojan-activity; sid:100001819; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.131.158",nocase; classtype:trojan-activity; sid:100001820; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.134.66",nocase; classtype:trojan-activity; sid:100001821; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.19.42",nocase; classtype:trojan-activity; sid:100001822; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.197.254",nocase; classtype:trojan-activity; sid:100001823; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.215.149",nocase; classtype:trojan-activity; sid:100001824; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.232.68",nocase; classtype:trojan-activity; sid:100001825; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.234.195",nocase; classtype:trojan-activity; sid:100001826; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.246.96",nocase; classtype:trojan-activity; sid:100001827; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.28.57",nocase; classtype:trojan-activity; sid:100001828; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.4.57",nocase; classtype:trojan-activity; sid:100001829; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.55.84",nocase; classtype:trojan-activity; sid:100001830; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.73.245",nocase; classtype:trojan-activity; sid:100001831; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.98.51",nocase; classtype:trojan-activity; sid:100001832; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.165.237.163",nocase; classtype:trojan-activity; sid:100001833; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.234.147.99",nocase; classtype:trojan-activity; sid:100001834; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.234.218.42",nocase; classtype:trojan-activity; sid:100001835; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.242.253.154",nocase; classtype:trojan-activity; sid:100001836; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.252.9.37",nocase; classtype:trojan-activity; sid:100001837; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.210.219.213",nocase; classtype:trojan-activity; sid:100001838; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.228.50.118",nocase; classtype:trojan-activity; sid:100001839; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.228.95.204",nocase; classtype:trojan-activity; sid:100001840; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.238.24.35",nocase; classtype:trojan-activity; sid:100001841; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.247.83.74",nocase; classtype:trojan-activity; sid:100001842; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.254.39.129",nocase; classtype:trojan-activity; sid:100001843; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.33.111.227",nocase; classtype:trojan-activity; sid:100001844; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.40.127.242",nocase; classtype:trojan-activity; sid:100001845; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.42.20.217",nocase; classtype:trojan-activity; sid:100001846; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com",nocase; classtype:trojan-activity; sid:100001847; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.123.251",nocase; classtype:trojan-activity; sid:100001848; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.135.187",nocase; classtype:trojan-activity; sid:100001849; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.180.33",nocase; classtype:trojan-activity; sid:100001850; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.208.25",nocase; classtype:trojan-activity; sid:100001851; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.224.141",nocase; classtype:trojan-activity; sid:100001852; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.241.2",nocase; classtype:trojan-activity; sid:100001853; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.214.149.236",nocase; classtype:trojan-activity; sid:100001854; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.241.39.182",nocase; classtype:trojan-activity; sid:100001855; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.64.181.50",nocase; classtype:trojan-activity; sid:100001856; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.74.215.180",nocase; classtype:trojan-activity; sid:100001857; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.97.130.227",nocase; classtype:trojan-activity; sid:100001858; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"86.35.43.220",nocase; classtype:trojan-activity; sid:100001859; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"87.110.105.250",nocase; classtype:trojan-activity; sid:100001860; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"87.172.19.130",nocase; classtype:trojan-activity; sid:100001861; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"87.61.89.40",nocase; classtype:trojan-activity; sid:100001862; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"87du.vip",nocase; classtype:trojan-activity; sid:100001863; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.119.171.253",nocase; classtype:trojan-activity; sid:100001864; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.2.208.71",nocase; classtype:trojan-activity; sid:100001865; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.2.219.179",nocase; classtype:trojan-activity; sid:100001866; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.218.17.149",nocase; classtype:trojan-activity; sid:100001867; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.225.222.128",nocase; classtype:trojan-activity; sid:100001868; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.247.96.19",nocase; classtype:trojan-activity; sid:100001869; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.248.136.231",nocase; classtype:trojan-activity; sid:100001870; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.248.51.139",nocase; classtype:trojan-activity; sid:100001871; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.249.244.180",nocase; classtype:trojan-activity; sid:100001872; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.250.204.12",nocase; classtype:trojan-activity; sid:100001873; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.250.226.26",nocase; classtype:trojan-activity; sid:100001874; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.250.254.90",nocase; classtype:trojan-activity; sid:100001875; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.122.183.130",nocase; classtype:trojan-activity; sid:100001876; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.136.197.170",nocase; classtype:trojan-activity; sid:100001877; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.22.152.244",nocase; classtype:trojan-activity; sid:100001878; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.29.213.33",nocase; classtype:trojan-activity; sid:100001879; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.40.85.166",nocase; classtype:trojan-activity; sid:100001880; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"8poieq.bn.files.1drv.com",nocase; classtype:trojan-activity; sid:100001881; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"90.152.144.139",nocase; classtype:trojan-activity; sid:100001882; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"90.63.176.144",nocase; classtype:trojan-activity; sid:100001883; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.124.126.133",nocase; classtype:trojan-activity; sid:100001884; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.132.197.39",nocase; classtype:trojan-activity; sid:100001885; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.138.215.5",nocase; classtype:trojan-activity; sid:100001886; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.177.139.132",nocase; classtype:trojan-activity; sid:100001887; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.187.103.32",nocase; classtype:trojan-activity; sid:100001888; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.212.150.241",nocase; classtype:trojan-activity; sid:100001889; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.214.124.141",nocase; classtype:trojan-activity; sid:100001890; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.217.104.185",nocase; classtype:trojan-activity; sid:100001891; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.233.112.188",nocase; classtype:trojan-activity; sid:100001892; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.234.60.94",nocase; classtype:trojan-activity; sid:100001893; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.244.169.139",nocase; classtype:trojan-activity; sid:100001894; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.92.16.244",nocase; classtype:trojan-activity; sid:100001895; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.114.191.82",nocase; classtype:trojan-activity; sid:100001896; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.241.78.114",nocase; classtype:trojan-activity; sid:100001897; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.27.246.202",nocase; classtype:trojan-activity; sid:100001898; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.83.62.139",nocase; classtype:trojan-activity; sid:100001899; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.85.18.138",nocase; classtype:trojan-activity; sid:100001900; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.157.63.244",nocase; classtype:trojan-activity; sid:100001901; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.159.169.190",nocase; classtype:trojan-activity; sid:100001902; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.21.224.154",nocase; classtype:trojan-activity; sid:100001903; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.39.115.176",nocase; classtype:trojan-activity; sid:100001904; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.39.79.41",nocase; classtype:trojan-activity; sid:100001905; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.41.137.16",nocase; classtype:trojan-activity; sid:100001906; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.41.182.249",nocase; classtype:trojan-activity; sid:100001907; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.41.206.56",nocase; classtype:trojan-activity; sid:100001908; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.57.43.233",nocase; classtype:trojan-activity; sid:100001909; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.73.99.102",nocase; classtype:trojan-activity; sid:100001910; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.136.69.199",nocase; classtype:trojan-activity; sid:100001911; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.143.53.34",nocase; classtype:trojan-activity; sid:100001912; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.154.17.170",nocase; classtype:trojan-activity; sid:100001913; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.200.16.22",nocase; classtype:trojan-activity; sid:100001914; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.224.83.208",nocase; classtype:trojan-activity; sid:100001915; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.53.120.109",nocase; classtype:trojan-activity; sid:100001916; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.85.0.3",nocase; classtype:trojan-activity; sid:100001917; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.132.129.250",nocase; classtype:trojan-activity; sid:100001918; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.133.158.20",nocase; classtype:trojan-activity; sid:100001919; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.154.20.231",nocase; classtype:trojan-activity; sid:100001920; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.158.19.130",nocase; classtype:trojan-activity; sid:100001921; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.170.113.227",nocase; classtype:trojan-activity; sid:100001922; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.170.113.52",nocase; classtype:trojan-activity; sid:100001923; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.170.201.34",nocase; classtype:trojan-activity; sid:100001924; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.60.146.134",nocase; classtype:trojan-activity; sid:100001925; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.66.196.63",nocase; classtype:trojan-activity; sid:100001926; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.9.120.40",nocase; classtype:trojan-activity; sid:100001927; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"96.239.73.246",nocase; classtype:trojan-activity; sid:100001928; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"96.47.147.169",nocase; classtype:trojan-activity; sid:100001929; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"97.68.140.254",nocase; classtype:trojan-activity; sid:100001930; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"97.96.199.75",nocase; classtype:trojan-activity; sid:100001931; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.0.210.218",nocase; classtype:trojan-activity; sid:100001932; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.0.239.142",nocase; classtype:trojan-activity; sid:100001933; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.113.239.207",nocase; classtype:trojan-activity; sid:100001934; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.116.72.119",nocase; classtype:trojan-activity; sid:100001935; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.128.147.115",nocase; classtype:trojan-activity; sid:100001936; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.178.207.205",nocase; classtype:trojan-activity; sid:100001937; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.178.242.44",nocase; classtype:trojan-activity; sid:100001938; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.30.24.54",nocase; classtype:trojan-activity; sid:100001939; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"99.150.245.203",nocase; classtype:trojan-activity; sid:100001940; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"99.33.195.164",nocase; classtype:trojan-activity; sid:100001941; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aatreefelling.co.za",nocase; classtype:trojan-activity; sid:100001942; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"abcd.bg",nocase; classtype:trojan-activity; sid:100001943; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"abissnet.net",nocase; classtype:trojan-activity; sid:100001944; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aboveandbelow.com.au",nocase; classtype:trojan-activity; sid:100001945; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"absoftechworld.com",nocase; classtype:trojan-activity; sid:100001946; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"abyssos.eu",nocase; classtype:trojan-activity; sid:100001947; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"academyshademani.com",nocase; classtype:trojan-activity; sid:100001948; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"acbick.com",nocase; classtype:trojan-activity; sid:100001949; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"accesslinksgroup.com",nocase; classtype:trojan-activity; sid:100001950; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aceeprc.com.aceeprc.com",nocase; classtype:trojan-activity; sid:100001951; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"acellr.co.uk",nocase; classtype:trojan-activity; sid:100001952; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"acteon.com.ar",nocase; classtype:trojan-activity; sid:100001953; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"activecost.com.au",nocase; classtype:trojan-activity; sid:100001954; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"addahealingmusic.com",nocase; classtype:trojan-activity; sid:100001955; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"adithimedia.com",nocase; classtype:trojan-activity; sid:100001956; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"adithimedia.memengers.com",nocase; classtype:trojan-activity; sid:100001957; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"admin.erapor.smk-alasror.net",nocase; classtype:trojan-activity; sid:100001958; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"admin.gentbcn.org",nocase; classtype:trojan-activity; sid:100001959; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"admin.grandoceanvilla.com",nocase; classtype:trojan-activity; sid:100001960; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"admission.kmctartskuttippuram.org",nocase; classtype:trojan-activity; sid:100001961; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"adventureexplorer.in",nocase; classtype:trojan-activity; sid:100001962; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aeropilates.cl",nocase; classtype:trojan-activity; sid:100001963; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"afnan-amc.com",nocase; classtype:trojan-activity; sid:100001964; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"afrimedspecialist.com",nocase; classtype:trojan-activity; sid:100001965; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"agemn.co.za",nocase; classtype:trojan-activity; sid:100001966; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"agenciadigitalwdys.com",nocase; classtype:trojan-activity; sid:100001967; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"agenda.gmelloinformatica.com.br",nocase; classtype:trojan-activity; sid:100001968; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"agile8studio.com",nocase; classtype:trojan-activity; sid:100001969; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aiecons.com",nocase; classtype:trojan-activity; sid:100001970; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aimnaukri.com",nocase; classtype:trojan-activity; sid:100001971; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aiqtest.com",nocase; classtype:trojan-activity; sid:100001972; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ajpharmaholding.com",nocase; classtype:trojan-activity; sid:100001973; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"akdvidyalaya.com",nocase; classtype:trojan-activity; sid:100001974; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"al-wahd.com",nocase; classtype:trojan-activity; sid:100001975; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alasdemariposas.org",nocase; classtype:trojan-activity; sid:100001976; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alberts.diamondrelationscrm.us",nocase; classtype:trojan-activity; sid:100001977; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alemelektronik.com",nocase; classtype:trojan-activity; sid:100001978; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alena1971.es",nocase; classtype:trojan-activity; sid:100001979; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alexdubai.com.aldiabsteel.com",nocase; classtype:trojan-activity; sid:100001980; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alka.institute",nocase; classtype:trojan-activity; sid:100001981; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"allforcreative.com.au",nocase; classtype:trojan-activity; sid:100001982; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alltheway.travel",nocase; classtype:trojan-activity; sid:100001983; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alpaylar.com.tr",nocase; classtype:trojan-activity; sid:100001984; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alumni.hildred.ibbott@46.249.33.79",nocase; classtype:trojan-activity; sid:100001985; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"am-concepts.ca",nocase; classtype:trojan-activity; sid:100001986; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amamontajes.com",nocase; classtype:trojan-activity; sid:100001987; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amarresdeamorymaestroshechiceros.com",nocase; classtype:trojan-activity; sid:100001988; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amarteargentina.com.ar",nocase; classtype:trojan-activity; sid:100001989; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amos524.org",nocase; classtype:trojan-activity; sid:100001990; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ams.alvinasschools.org.ng",nocase; classtype:trojan-activity; sid:100001991; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anadelgbt.org",nocase; classtype:trojan-activity; sid:100001992; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anantam.net.in",nocase; classtype:trojan-activity; sid:100001993; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"andreelapeyre.com",nocase; classtype:trojan-activity; sid:100001994; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"andremaraisbeleggings.co.za",nocase; classtype:trojan-activity; sid:100001995; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"andreshconcejal.solucioneslink.com",nocase; classtype:trojan-activity; sid:100001996; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"angelazgheibld.com",nocase; classtype:trojan-activity; sid:100001997; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"angelsdetour.com",nocase; classtype:trojan-activity; sid:100001998; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anhung1102.vn",nocase; classtype:trojan-activity; sid:100001999; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anurontv.com",nocase; classtype:trojan-activity; sid:100002000; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anysbergbiltong.co.za",nocase; classtype:trojan-activity; sid:100002001; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"apartamentoscitta.com",nocase; classtype:trojan-activity; sid:100002002; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"api-ms.cobainaja.id",nocase; classtype:trojan-activity; sid:100002003; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"api.cstdevs.com",nocase; classtype:trojan-activity; sid:100002004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"apoolcondo.com",nocase; classtype:trojan-activity; sid:100002005; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"app.adsensearticle.com",nocase; classtype:trojan-activity; sid:100002006; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"app.explicitsurveys.co.uk",nocase; classtype:trojan-activity; sid:100002007; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"app.prerana.info",nocase; classtype:trojan-activity; sid:100002008; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"apps.saintsoporte.com",nocase; classtype:trojan-activity; sid:100002009; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aps-scribe.com",nocase; classtype:trojan-activity; sid:100002010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aps-sv.com",nocase; classtype:trojan-activity; sid:100002011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"artedibujoyarquitectura.com",nocase; classtype:trojan-activity; sid:100002012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"arwenyapi.com",nocase; classtype:trojan-activity; sid:100002013; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ask-regard.call-save.biz",nocase; classtype:trojan-activity; sid:100002014; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"atfile.com",nocase; classtype:trojan-activity; sid:100002015; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"athenacapsg.com",nocase; classtype:trojan-activity; sid:100002016; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"attach.66rpg.com",nocase; classtype:trojan-activity; sid:100002017; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"atteuqpotentialunlimited.com",nocase; classtype:trojan-activity; sid:100002018; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"augustair.com",nocase; classtype:trojan-activity; sid:100002019; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"automaticrefreshments.com",nocase; classtype:trojan-activity; sid:100002020; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"avadhanagames.com",nocase; classtype:trojan-activity; sid:100002021; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ayahuascasp.com.br",nocase; classtype:trojan-activity; sid:100002022; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ayamallah.com",nocase; classtype:trojan-activity; sid:100002023; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aycconsultoriaempresarial.com",nocase; classtype:trojan-activity; sid:100002024; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"azmeasurement.com",nocase; classtype:trojan-activity; sid:100002025; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"azraktours.com",nocase; classtype:trojan-activity; sid:100002026; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"b2b.toptanakaryakit.com.tr",nocase; classtype:trojan-activity; sid:100002027; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"badeggdesign.com",nocase; classtype:trojan-activity; sid:100002028; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"balealgodon.mx",nocase; classtype:trojan-activity; sid:100002029; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bangkok-orchids.com",nocase; classtype:trojan-activity; sid:100002030; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bangladeshunbound.com",nocase; classtype:trojan-activity; sid:100002031; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bary.sz4h.com",nocase; classtype:trojan-activity; sid:100002032; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bash.givemexyz.in",nocase; classtype:trojan-activity; sid:100002033; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bausch.kr-atlas.monaxikoslykos@zytrox.tk",nocase; classtype:trojan-activity; sid:100002034; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bbia.co.uk",nocase; classtype:trojan-activity; sid:100002035; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bcmt.elin.co.za",nocase; classtype:trojan-activity; sid:100002036; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bcrg.co.za",nocase; classtype:trojan-activity; sid:100002037; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bdnextrend.xyz",nocase; classtype:trojan-activity; sid:100002038; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beanx88.xyz",nocase; classtype:trojan-activity; sid:100002039; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bearcatpumps.com.cn",nocase; classtype:trojan-activity; sid:100002040; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beautincollagen.rs",nocase; classtype:trojan-activity; sid:100002041; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beautymomentsgt.de",nocase; classtype:trojan-activity; sid:100002042; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bekape.co.id",nocase; classtype:trojan-activity; sid:100002043; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beor360.com",nocase; classtype:trojan-activity; sid:100002044; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bespokeweddings.ie",nocase; classtype:trojan-activity; sid:100002045; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bestcarenepal.com",nocase; classtype:trojan-activity; sid:100002046; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"betone.co.kr",nocase; classtype:trojan-activity; sid:100002047; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"betycopaints.com",nocase; classtype:trojan-activity; sid:100002048; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beveragesmiami.solucioneslink.com",nocase; classtype:trojan-activity; sid:100002049; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bhavaniengineering.com",nocase; classtype:trojan-activity; sid:100002050; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bigmikesupplies.co.za",nocase; classtype:trojan-activity; sid:100002051; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bilhen.co.za",nocase; classtype:trojan-activity; sid:100002052; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"billing.rahitechnosoft.com",nocase; classtype:trojan-activity; sid:100002053; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"binoy.stalphonsamissionva.org",nocase; classtype:trojan-activity; sid:100002054; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"biometrico.gpotecnosystems.com",nocase; classtype:trojan-activity; sid:100002055; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bioskey.com",nocase; classtype:trojan-activity; sid:100002056; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"birdi.elin.co.za",nocase; classtype:trojan-activity; sid:100002057; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"birminghamlink.org",nocase; classtype:trojan-activity; sid:100002058; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bizztradingbot.nl",nocase; classtype:trojan-activity; sid:100002059; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bl4n3.zadns.co.za",nocase; classtype:trojan-activity; sid:100002060; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"blog.callensaxen.com",nocase; classtype:trojan-activity; sid:100002061; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"blog.difusodesign.com",nocase; classtype:trojan-activity; sid:100002062; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"blog.oyinblogs.com",nocase; classtype:trojan-activity; sid:100002063; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"blog.takbelit.com",nocase; classtype:trojan-activity; sid:100002064; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bmlifestyle.co.uk",nocase; classtype:trojan-activity; sid:100002065; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"boatpecas.com.br",nocase; classtype:trojan-activity; sid:100002066; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bodenstein.co.za",nocase; classtype:trojan-activity; sid:100002067; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bodylanguage.santulan.co.in",nocase; classtype:trojan-activity; sid:100002068; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"booksearch.com",nocase; classtype:trojan-activity; sid:100002069; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bophelocare.co.za",nocase; classtype:trojan-activity; sid:100002070; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bounces.mi-fs.com",nocase; classtype:trojan-activity; sid:100002071; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"boutiqueofferte.com",nocase; classtype:trojan-activity; sid:100002072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bpo.correct.go.th",nocase; classtype:trojan-activity; sid:100002073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bradleyinstitute.co.za",nocase; classtype:trojan-activity; sid:100002074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brandtrust.com.pk",nocase; classtype:trojan-activity; sid:100002075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"braunfinancial.com.au",nocase; classtype:trojan-activity; sid:100002076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brendanquine.com",nocase; classtype:trojan-activity; sid:100002077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brideofmessiah.com",nocase; classtype:trojan-activity; sid:100002078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brightaffiliatesales.org",nocase; classtype:trojan-activity; sid:100002079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brightmega.com",nocase; classtype:trojan-activity; sid:100002080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brightstarshop.com",nocase; classtype:trojan-activity; sid:100002081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"browardinsurancemiami.solucioneslink.com",nocase; classtype:trojan-activity; sid:100002082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bt2.elin.co.za",nocase; classtype:trojan-activity; sid:100002083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"btdapi.robotake.com",nocase; classtype:trojan-activity; sid:100002084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"buigiaphat.com.vn",nocase; classtype:trojan-activity; sid:100002085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bulkyfoodja.com",nocase; classtype:trojan-activity; sid:100002086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bullseyemedia.in",nocase; classtype:trojan-activity; sid:100002087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"busandvanrentalmalaysia.com",nocase; classtype:trojan-activity; sid:100002088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"buscascolegios.diit.cl",nocase; classtype:trojan-activity; sid:100002089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"business.softberg.ro",nocase; classtype:trojan-activity; sid:100002090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"business2.softberg.ro",nocase; classtype:trojan-activity; sid:100002091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bydspa.cl",nocase; classtype:trojan-activity; sid:100002092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"c.oooooooooo.ga",nocase; classtype:trojan-activity; sid:100002093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"c0140529.ferozo.com",nocase; classtype:trojan-activity; sid:100002094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"caballo.com.au",nocase; classtype:trojan-activity; sid:100002095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cacaoprojects.com",nocase; classtype:trojan-activity; sid:100002096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"calgaryautorepairservice.com",nocase; classtype:trojan-activity; sid:100002097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"callbury.in",nocase; classtype:trojan-activity; sid:100002098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"camminachetipassa.it",nocase; classtype:trojan-activity; sid:100002099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"canadianwork.cc",nocase; classtype:trojan-activity; sid:100002100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"capitalgroup-kw.com",nocase; classtype:trojan-activity; sid:100002101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"capoeiraventrelivre.com",nocase; classtype:trojan-activity; sid:100002102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"carlsbadre.com",nocase; classtype:trojan-activity; sid:100002103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"carsidecor.com",nocase; classtype:trojan-activity; sid:100002104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cashyinvestment.org",nocase; classtype:trojan-activity; sid:100002105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"catchperch.com",nocase; classtype:trojan-activity; sid:100002106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"catchpoolshetlands.co.uk",nocase; classtype:trojan-activity; sid:100002107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cazyacustomfurniture.com",nocase; classtype:trojan-activity; sid:100002108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cbn.hypervoizd.com",nocase; classtype:trojan-activity; sid:100002109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ccauthority.net",nocase; classtype:trojan-activity; sid:100002110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdaonline.com.ar",nocase; classtype:trojan-activity; sid:100002111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cec.asso.ac-amiens.fr",nocase; classtype:trojan-activity; sid:100002112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cecra.cl",nocase; classtype:trojan-activity; sid:100002113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cellas.sk",nocase; classtype:trojan-activity; sid:100002114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cendekiabinaaksara.com",nocase; classtype:trojan-activity; sid:100002115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cfs5.tistory.com",nocase; classtype:trojan-activity; sid:100002116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ch.rmu.ac.th",nocase; classtype:trojan-activity; sid:100002117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"changematterscounselling.com",nocase; classtype:trojan-activity; sid:100002118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chardhamdodham.com",nocase; classtype:trojan-activity; sid:100002119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chezalice.co.za",nocase; classtype:trojan-activity; sid:100002120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"childselect.com",nocase; classtype:trojan-activity; sid:100002121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chinhdropfile.myvnc.com",nocase; classtype:trojan-activity; sid:100002122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chinhdropfile80.myvnc.com",nocase; classtype:trojan-activity; sid:100002123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cible-energy.com",nocase; classtype:trojan-activity; sid:100002124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cifeer.net",nocase; classtype:trojan-activity; sid:100002125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"citiconstructioncorp.com",nocase; classtype:trojan-activity; sid:100002126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"citihits.lk",nocase; classtype:trojan-activity; sid:100002127; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"citssolutions.co.za",nocase; classtype:trojan-activity; sid:100002128; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"citycapproperty.ru",nocase; classtype:trojan-activity; sid:100002129; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cityglobalgospel.com",nocase; classtype:trojan-activity; sid:100002130; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"civi.istmejia.com",nocase; classtype:trojan-activity; sid:100002131; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cleanbydesignllc.com",nocase; classtype:trojan-activity; sid:100002132; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cloud.fc.co.mz",nocase; classtype:trojan-activity; sid:100002133; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cm-arquitetos.com",nocase; classtype:trojan-activity; sid:100002134; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cnc.tacobelllover.tk",nocase; classtype:trojan-activity; sid:100002135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"codsambal.com",nocase; classtype:trojan-activity; sid:100002136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"colinde.pricesne.com",nocase; classtype:trojan-activity; sid:100002137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"colorpak.pl",nocase; classtype:trojan-activity; sid:100002138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"columbia.aula-web.net",nocase; classtype:trojan-activity; sid:100002139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"community.reimclub.com",nocase; classtype:trojan-activity; sid:100002140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"comosairdoburaco.com.br",nocase; classtype:trojan-activity; sid:100002141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"competancy.indigoconsult.net",nocase; classtype:trojan-activity; sid:100002142; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"conceptimagine.ro",nocase; classtype:trojan-activity; sid:100002143; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"config.cqhbkjzx.com",nocase; classtype:trojan-activity; sid:100002144; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"connectcapital.com.br",nocase; classtype:trojan-activity; sid:100002145; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"constructoralyon.com",nocase; classtype:trojan-activity; sid:100002146; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"consulateins.solucioneslink.com",nocase; classtype:trojan-activity; sid:100002147; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"contributeindustry.com",nocase; classtype:trojan-activity; sid:100002148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"copelandscapes.com",nocase; classtype:trojan-activity; sid:100002149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"coulsongraphics.com",nocase; classtype:trojan-activity; sid:100002150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"count.mail.163.com.impactmedfoundation.com",nocase; classtype:trojan-activity; sid:100002151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"covid19.cyberschool.or.id",nocase; classtype:trojan-activity; sid:100002152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cpanel.shivay.net",nocase; classtype:trojan-activity; sid:100002153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cr-sq.com",nocase; classtype:trojan-activity; sid:100002154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"craftech.nxtnet.ga",nocase; classtype:trojan-activity; sid:100002155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"creationskateboards.com",nocase; classtype:trojan-activity; sid:100002156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crecerco.com",nocase; classtype:trojan-activity; sid:100002157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crittersbythebay.com",nocase; classtype:trojan-activity; sid:100002158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crm.notariavieitoyvelamazan.com",nocase; classtype:trojan-activity; sid:100002159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crmfarko.manivelasst.com",nocase; classtype:trojan-activity; sid:100002160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crmroche.manivelasst.com",nocase; classtype:trojan-activity; sid:100002161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crscorretordeimoveis.com.br",nocase; classtype:trojan-activity; sid:100002162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cse-engineer.com",nocase; classtype:trojan-activity; sid:100002163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"csnserver.com",nocase; classtype:trojan-activity; sid:100002164; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cubescargoexpress.com",nocase; classtype:trojan-activity; sid:100002165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"curasoles.co.za",nocase; classtype:trojan-activity; sid:100002166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"currantmedia.com",nocase; classtype:trojan-activity; sid:100002167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cwa.mx",nocase; classtype:trojan-activity; sid:100002168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cyclomove.com",nocase; classtype:trojan-activity; sid:100002169; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cynkon.kairoscs.net",nocase; classtype:trojan-activity; sid:100002170; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"czsl.91756.cn",nocase; classtype:trojan-activity; sid:100002171; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"d.powerofwish.com",nocase; classtype:trojan-activity; sid:100002172; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"d9.99ddd.com",nocase; classtype:trojan-activity; sid:100002173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"da.alibuf.com",nocase; classtype:trojan-activity; sid:100002174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"danaevara.com",nocase; classtype:trojan-activity; sid:100002175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dartoonpictures.com",nocase; classtype:trojan-activity; sid:100002176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"data.cdevelop.org",nocase; classtype:trojan-activity; sid:100002177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"data.over-blog-kiwi.com",nocase; classtype:trojan-activity; sid:100002178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"datapolish.com",nocase; classtype:trojan-activity; sid:100002179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dating.khokhas.co.za",nocase; classtype:trojan-activity; sid:100002180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"datsom.vn",nocase; classtype:trojan-activity; sid:100002181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"davethompson.me.uk",nocase; classtype:trojan-activity; sid:100002182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"davidmcguinness.info",nocase; classtype:trojan-activity; sid:100002183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dayspringdaisies.com",nocase; classtype:trojan-activity; sid:100002184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dd.qiyuea.cn",nocase; classtype:trojan-activity; sid:100002185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ddns.cyberium.cc",nocase; classtype:trojan-activity; sid:100002186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"de.gsearch.com.de",nocase; classtype:trojan-activity; sid:100002187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"decifrar.com.br",nocase; classtype:trojan-activity; sid:100002188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"deigratia2.elin.co.za",nocase; classtype:trojan-activity; sid:100002189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dekovizyon.com",nocase; classtype:trojan-activity; sid:100002190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"demo-cliente.mindcreative.com.br",nocase; classtype:trojan-activity; sid:100002191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"demo.glassforcars.com.au",nocase; classtype:trojan-activity; sid:100002192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"demo6.hiites.com",nocase; classtype:trojan-activity; sid:100002193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dent-estet.com",nocase; classtype:trojan-activity; sid:100002194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dental.xiaoxiao.media",nocase; classtype:trojan-activity; sid:100002195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dentalalliance.se",nocase; classtype:trojan-activity; sid:100002196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"desertlandtrd.com",nocase; classtype:trojan-activity; sid:100002197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"designerliving.co.za",nocase; classtype:trojan-activity; sid:100002198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"despertaresi.com.br",nocase; classtype:trojan-activity; sid:100002199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"destinymc.co.za",nocase; classtype:trojan-activity; sid:100002200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"detorre.es",nocase; classtype:trojan-activity; sid:100002201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dev.sebpo.net",nocase; classtype:trojan-activity; sid:100002202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dev.watch-store.eu",nocase; classtype:trojan-activity; sid:100002203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dezcom.com",nocase; classtype:trojan-activity; sid:100002204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dfcf.91756.cn",nocase; classtype:trojan-activity; sid:100002205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"diamantenegro.mi-fs.com",nocase; classtype:trojan-activity; sid:100002206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dienmayminhhung.com",nocase; classtype:trojan-activity; sid:100002207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"digilib.dianhusada.ac.id",nocase; classtype:trojan-activity; sid:100002208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"digisails.org",nocase; classtype:trojan-activity; sid:100002209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"disinfection-cleaning.co.za",nocase; classtype:trojan-activity; sid:100002210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"djking.f3322.net",nocase; classtype:trojan-activity; sid:100002211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.1003b.56a.com",nocase; classtype:trojan-activity; sid:100002212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.198424.com",nocase; classtype:trojan-activity; sid:100002213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.installcdn-aws.com",nocase; classtype:trojan-activity; sid:100002214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.packetstormsecurity.net",nocase; classtype:trojan-activity; sid:100002215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.rina-roleplay.com",nocase; classtype:trojan-activity; sid:100002216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dnn.alibuf.com",nocase; classtype:trojan-activity; sid:100002217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dns.alibuf.com",nocase; classtype:trojan-activity; sid:100002218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dockerupdate.anondns.net",nocase; classtype:trojan-activity; sid:100002219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"docman.orientalservices.in",nocase; classtype:trojan-activity; sid:100002220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dodsonimaging.com",nocase; classtype:trojan-activity; sid:100002221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"doitunlimited.com",nocase; classtype:trojan-activity; sid:100002222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dokan.blueberrytec.com",nocase; classtype:trojan-activity; sid:100002223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dom-chel74.ru",nocase; classtype:trojan-activity; sid:100002224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dom.daf.free.fr",nocase; classtype:trojan-activity; sid:100002225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"doncedyhall.com",nocase; classtype:trojan-activity; sid:100002226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"donghobinhminh.com",nocase; classtype:trojan-activity; sid:100002227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dongphuctop.com",nocase; classtype:trojan-activity; sid:100002228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"donwnloasecury.ath.cx",nocase; classtype:trojan-activity; sid:100002229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dosame.com",nocase; classtype:trojan-activity; sid:100002230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dosman.pl",nocase; classtype:trojan-activity; sid:100002231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dovberger.com",nocase; classtype:trojan-activity; sid:100002232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"down.pcclear.com",nocase; classtype:trojan-activity; sid:100002233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"down.webbora.com",nocase; classtype:trojan-activity; sid:100002234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"down1.arpun.com",nocase; classtype:trojan-activity; sid:100002235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.caihong.com",nocase; classtype:trojan-activity; sid:100002236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.doumaibiji.cn",nocase; classtype:trojan-activity; sid:100002237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.exrnybuf.cn",nocase; classtype:trojan-activity; sid:100002238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.kaobeitu.com",nocase; classtype:trojan-activity; sid:100002239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.pdf00.cn",nocase; classtype:trojan-activity; sid:100002240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.rising.com.cn",nocase; classtype:trojan-activity; sid:100002241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.skycn.com",nocase; classtype:trojan-activity; sid:100002242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.zjsyawqj.cn",nocase; classtype:trojan-activity; sid:100002243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dragonsknot.com",nocase; classtype:trojan-activity; sid:100002244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drbaby.com.sa",nocase; classtype:trojan-activity; sid:100002245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dream.pics",nocase; classtype:trojan-activity; sid:100002246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drgroup.co.za",nocase; classtype:trojan-activity; sid:100002247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drools-moved.46999.n3.nabble.com",nocase; classtype:trojan-activity; sid:100002248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drsha.innovativesolutions.mobi",nocase; classtype:trojan-activity; sid:100002249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dsenterprize.co.za",nocase; classtype:trojan-activity; sid:100002250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dsspainting.com",nocase; classtype:trojan-activity; sid:100002251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"du-wizards.com",nocase; classtype:trojan-activity; sid:100002252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"duque.guantanameratravel.com",nocase; classtype:trojan-activity; sid:100002253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dutapp.wisolve.co.za",nocase; classtype:trojan-activity; sid:100002254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"duvalcharter.dekitout.com",nocase; classtype:trojan-activity; sid:100002255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dw2.co.id",nocase; classtype:trojan-activity; sid:100002256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dx.qqyewu.com",nocase; classtype:trojan-activity; sid:100002257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dzinestudio87.co.uk",nocase; classtype:trojan-activity; sid:100002258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"e-commerce.saleensuporte.com.br",nocase; classtype:trojan-activity; sid:100002259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"e.sldov.ru",nocase; classtype:trojan-activity; sid:100002260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"eandgdesign.com.ng",nocase; classtype:trojan-activity; sid:100002261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"eastsheen-glaziers.co.uk",nocase; classtype:trojan-activity; sid:100002262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ebruyatkin.com",nocase; classtype:trojan-activity; sid:100002263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"eedo.ee",nocase; classtype:trojan-activity; sid:100002264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"efficientegroup.com",nocase; classtype:trojan-activity; sid:100002265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"elbauldenora.com",nocase; classtype:trojan-activity; sid:100002266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"emaids.co.za",nocase; classtype:trojan-activity; sid:100002267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"emaz.pk",nocase; classtype:trojan-activity; sid:100002268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"en.baoend.com",nocase; classtype:trojan-activity; sid:100002269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"enc-tech.com",nocase; classtype:trojan-activity; sid:100002270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"endurotanzania.co.tz",nocase; classtype:trojan-activity; sid:100002271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ennovate.elin.co.za",nocase; classtype:trojan-activity; sid:100002272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"equimination.ee",nocase; classtype:trojan-activity; sid:100002273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"erp.nanotechproautocare.com",nocase; classtype:trojan-activity; sid:100002274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"erp.zilymax.com",nocase; classtype:trojan-activity; sid:100002275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"escola.probommar.org.br",nocase; classtype:trojan-activity; sid:100002276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"esnconsultants.com",nocase; classtype:trojan-activity; sid:100002277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"esrhf04.top",nocase; classtype:trojan-activity; sid:100002278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"essentia.org.br",nocase; classtype:trojan-activity; sid:100002279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ethereality.info",nocase; classtype:trojan-activity; sid:100002280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"eubanks7.com",nocase; classtype:trojan-activity; sid:100002281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"europeanzonexxi.com",nocase; classtype:trojan-activity; sid:100002282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exilum.com",nocase; classtype:trojan-activity; sid:100002283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exitoalfaomega.co",nocase; classtype:trojan-activity; sid:100002284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"extrovertoffers.com",nocase; classtype:trojan-activity; sid:100002285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"f1sol.com",nocase; classtype:trojan-activity; sid:100002286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"familydentist.site",nocase; classtype:trojan-activity; sid:100002287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"faveraprojects.com",nocase; classtype:trojan-activity; sid:100002288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fc.co.mz",nocase; classtype:trojan-activity; sid:100002289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"felicienne.nl",nocase; classtype:trojan-activity; sid:100002290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"files.martellexpress.us",nocase; classtype:trojan-activity; sid:100002291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"files6.uludagbilisim.com",nocase; classtype:trojan-activity; sid:100002292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"final.makkahkmcc.com",nocase; classtype:trojan-activity; sid:100002293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fineartgallerym.com",nocase; classtype:trojan-activity; sid:100002294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fisconline.bar",nocase; classtype:trojan-activity; sid:100002295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fisconline.casa",nocase; classtype:trojan-activity; sid:100002296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fix-america-now.org",nocase; classtype:trojan-activity; sid:100002297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fixauto.illumetechnology.com",nocase; classtype:trojan-activity; sid:100002298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fixturegovernment.com",nocase; classtype:trojan-activity; sid:100002299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fkd.derpcity.ru",nocase; classtype:trojan-activity; sid:100002300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"flexypay.dsquaregroup.com",nocase; classtype:trojan-activity; sid:100002301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"flintspin.com",nocase; classtype:trojan-activity; sid:100002302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"flyingbuddhadesign.com",nocase; classtype:trojan-activity; sid:100002303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fmjplastering.co.uk",nocase; classtype:trojan-activity; sid:100002304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"follower.instantcashback.in",nocase; classtype:trojan-activity; sid:100002305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"foothills.com.br",nocase; classtype:trojan-activity; sid:100002306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"footweardirect.elin.co.za",nocase; classtype:trojan-activity; sid:100002307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"forum.mdb.nu",nocase; classtype:trojan-activity; sid:100002308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fotoobjetivo.com",nocase; classtype:trojan-activity; sid:100002309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"foundationrepairhoustontx.net",nocase; classtype:trojan-activity; sid:100002310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"foxeps.com.br",nocase; classtype:trojan-activity; sid:100002311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"freecnetdownload.com",nocase; classtype:trojan-activity; sid:100002312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"freisites.com.br",nocase; classtype:trojan-activity; sid:100002313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ftp.n3twork30cm.ml",nocase; classtype:trojan-activity; sid:100002314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fullelectronica.com.ar",nocase; classtype:trojan-activity; sid:100002315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"funletters.net",nocase; classtype:trojan-activity; sid:100002316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fusionfiresolutions.com",nocase; classtype:trojan-activity; sid:100002317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"futbolpr.com",nocase; classtype:trojan-activity; sid:100002318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"futuregraphics.com.ar",nocase; classtype:trojan-activity; sid:100002319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"g.pinmonkey.xyz",nocase; classtype:trojan-activity; sid:100002320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gaditastour.com",nocase; classtype:trojan-activity; sid:100002321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gametwogame.com",nocase; classtype:trojan-activity; sid:100002322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"garciadogshow.com",nocase; classtype:trojan-activity; sid:100002323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"garenanow.myvnc.com",nocase; classtype:trojan-activity; sid:100002324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"garenanow4.myvnc.com",nocase; classtype:trojan-activity; sid:100002325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gastoudergonny.nl",nocase; classtype:trojan-activity; sid:100002326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gbbulls.co.uk",nocase; classtype:trojan-activity; sid:100002327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gcpc.co.id.chronoscurtain.com",nocase; classtype:trojan-activity; sid:100002328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"generaldeviales.com",nocase; classtype:trojan-activity; sid:100002329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gfmodd1.webselffiles01.com",nocase; classtype:trojan-activity; sid:100002330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gfold1.webselffiles01.com",nocase; classtype:trojan-activity; sid:100002331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ghettohub.co.za",nocase; classtype:trojan-activity; sid:100002332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ghislain.dartois.pagesperso-orange.fr",nocase; classtype:trojan-activity; sid:100002333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"giadungg7.com",nocase; classtype:trojan-activity; sid:100002334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"giddos.ga",nocase; classtype:trojan-activity; sid:100002335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"giteletropical.com",nocase; classtype:trojan-activity; sid:100002336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"glowinmedia.co.ke",nocase; classtype:trojan-activity; sid:100002337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gmtransformationacademy.com",nocase; classtype:trojan-activity; sid:100002338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gmvadmission.org",nocase; classtype:trojan-activity; sid:100002339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gnimelf.net",nocase; classtype:trojan-activity; sid:100002340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gnscrew.ro",nocase; classtype:trojan-activity; sid:100002341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gold.investforex.id",nocase; classtype:trojan-activity; sid:100002342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldcake.co.id",nocase; classtype:trojan-activity; sid:100002343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldcoastoffice365.com",nocase; classtype:trojan-activity; sid:100002344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldcoastoffice365.com.au",nocase; classtype:trojan-activity; sid:100002345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"golden-memories-funerals.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldenasiacapital.com",nocase; classtype:trojan-activity; sid:100002347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gpotecnosystems.com",nocase; classtype:trojan-activity; sid:100002348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gracejukes.com",nocase; classtype:trojan-activity; sid:100002349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"grupoinmare.com",nocase; classtype:trojan-activity; sid:100002350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gs.monerorx.com",nocase; classtype:trojan-activity; sid:100002351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"guide-to-cell-phones.com",nocase; classtype:trojan-activity; sid:100002352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gulfac-house.com",nocase; classtype:trojan-activity; sid:100002353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gvpcdpgc.edu.in",nocase; classtype:trojan-activity; sid:100002354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"habbotips.free.fr",nocase; classtype:trojan-activity; sid:100002355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hagebakken.no",nocase; classtype:trojan-activity; sid:100002356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hamptonpartyoffive.com",nocase; classtype:trojan-activity; sid:100002357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hashmati.com",nocase; classtype:trojan-activity; sid:100002358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hassanproduct.com",nocase; classtype:trojan-activity; sid:100002359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hchfug.org",nocase; classtype:trojan-activity; sid:100002360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hd11315.com",nocase; classtype:trojan-activity; sid:100002361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hdkamera2003.hu",nocase; classtype:trojan-activity; sid:100002362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hds.sz4h.com",nocase; classtype:trojan-activity; sid:100002363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"heavymaq.cl",nocase; classtype:trojan-activity; sid:100002364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hellogorgeous.com.au",nocase; classtype:trojan-activity; sid:100002365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"help.hizuko.com",nocase; classtype:trojan-activity; sid:100002366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"herchinfitout.com.sg",nocase; classtype:trojan-activity; sid:100002367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hhaward.org",nocase; classtype:trojan-activity; sid:100002368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"highlandroadcoc.com",nocase; classtype:trojan-activity; sid:100002369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"highlandslasvegas.atakdev.com",nocase; classtype:trojan-activity; sid:100002370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hindi.factsriver.com",nocase; classtype:trojan-activity; sid:100002371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hiptool.net",nocase; classtype:trojan-activity; sid:100002372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hitpe.com",nocase; classtype:trojan-activity; sid:100002373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hitstation.nl",nocase; classtype:trojan-activity; sid:100002374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hmpmall.co.kr",nocase; classtype:trojan-activity; sid:100002375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hoagietesting10.com",nocase; classtype:trojan-activity; sid:100002376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hoayeuthuong-my.sharepoint.com",nocase; classtype:trojan-activity; sid:100002377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"homefindersolutions.com",nocase; classtype:trojan-activity; sid:100002378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hongluosi.com",nocase; classtype:trojan-activity; sid:100002379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hookedupboatclub.com",nocase; classtype:trojan-activity; sid:100002380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hostingparacolombia.com",nocase; classtype:trojan-activity; sid:100002381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hostzaa.com",nocase; classtype:trojan-activity; sid:100002382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"houstonshutters.site",nocase; classtype:trojan-activity; sid:100002383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hr2019.vrcom7.com",nocase; classtype:trojan-activity; sid:100002384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hseda.com",nocase; classtype:trojan-activity; sid:100002385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hsmwebapp.com",nocase; classtype:trojan-activity; sid:100002386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"htownbars.com",nocase; classtype:trojan-activity; sid:100002387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hubtech.co.za",nocase; classtype:trojan-activity; sid:100002388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"huellacero.cl",nocase; classtype:trojan-activity; sid:100002389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hunggiang.vn",nocase; classtype:trojan-activity; sid:100002390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"husamiyahschool.com",nocase; classtype:trojan-activity; sid:100002391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iabmixx2020.rayadigital.online",nocase; classtype:trojan-activity; sid:100002392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iam313.com",nocase; classtype:trojan-activity; sid:100002393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"icon.shatangmu.cn",nocase; classtype:trojan-activity; sid:100002394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"idea-secure-login.com",nocase; classtype:trojan-activity; sid:100002395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"idilsoft.com",nocase; classtype:trojan-activity; sid:100002396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"idj.no",nocase; classtype:trojan-activity; sid:100002397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"idvindia.com",nocase; classtype:trojan-activity; sid:100002398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ieclb.com.br",nocase; classtype:trojan-activity; sid:100002399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ikexpert.com",nocase; classtype:trojan-activity; sid:100002400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ilrafrica.com",nocase; classtype:trojan-activity; sid:100002401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"images.jermiau.com",nocase; classtype:trojan-activity; sid:100002402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"imbueautoworx.co.za",nocase; classtype:trojan-activity; sid:100002403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"in-tune2016.com",nocase; classtype:trojan-activity; sid:100002404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"incrediblepixels.com",nocase; classtype:trojan-activity; sid:100002405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"incredicole.com",nocase; classtype:trojan-activity; sid:100002406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"indrasbikaner.com",nocase; classtype:trojan-activity; sid:100002407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"infair.vn",nocase; classtype:trojan-activity; sid:100002408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"infovator.com",nocase; classtype:trojan-activity; sid:100002409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"initialnetworks.com",nocase; classtype:trojan-activity; sid:100002410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"inodesthetotaldesigners.com",nocase; classtype:trojan-activity; sid:100002411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"inrajahmundry.co.in",nocase; classtype:trojan-activity; sid:100002412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"instantindialoan.com",nocase; classtype:trojan-activity; sid:100002413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"intellectsmart.in",nocase; classtype:trojan-activity; sid:100002414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"intersel-idf.org",nocase; classtype:trojan-activity; sid:100002415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"intuitiveideas.com.my",nocase; classtype:trojan-activity; sid:100002416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"inversiones.arrayanfinanciero.cl",nocase; classtype:trojan-activity; sid:100002417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"invest.xpcorporative.com.br",nocase; classtype:trojan-activity; sid:100002418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ipmes.ma",nocase; classtype:trojan-activity; sid:100002419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iremart.es",nocase; classtype:trojan-activity; sid:100002420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iris101.co.uk",nocase; classtype:trojan-activity; sid:100002421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"isaac.mikhailmotoringschool.com",nocase; classtype:trojan-activity; sid:100002422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iscamenabe.com",nocase; classtype:trojan-activity; sid:100002423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"isiphephelocon.co.za",nocase; classtype:trojan-activity; sid:100002424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ismf.com.ng",nocase; classtype:trojan-activity; sid:100002425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iso-dubai.net",nocase; classtype:trojan-activity; sid:100002426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"israrulhaq.me",nocase; classtype:trojan-activity; sid:100002427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"isrorg.com",nocase; classtype:trojan-activity; sid:100002428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"isso.ps",nocase; classtype:trojan-activity; sid:100002429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ist-security.com",nocase; classtype:trojan-activity; sid:100002430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"it123.ru",nocase; classtype:trojan-activity; sid:100002431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"italiandirezione.casa",nocase; classtype:trojan-activity; sid:100002432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"itc-demo.softgig.co.ke",nocase; classtype:trojan-activity; sid:100002433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"itmotasaciones.com",nocase; classtype:trojan-activity; sid:100002434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jamiekaylive.com",nocase; classtype:trojan-activity; sid:100002435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jansen-heesch.nl",nocase; classtype:trojan-activity; sid:100002436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jathra.co.uk",nocase; classtype:trojan-activity; sid:100002437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jay.diamondrelationscrm.us",nocase; classtype:trojan-activity; sid:100002438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jebs.net.au",nocase; classtype:trojan-activity; sid:100002439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jeffdahlke.com",nocase; classtype:trojan-activity; sid:100002440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jhayesconsulting.com",nocase; classtype:trojan-activity; sid:100002441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jiaoyuzixun.cn",nocase; classtype:trojan-activity; sid:100002442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jing-da.com.tw",nocase; classtype:trojan-activity; sid:100002443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jmtc.91756.cn",nocase; classtype:trojan-activity; sid:100002444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jnanbharati.com",nocase; classtype:trojan-activity; sid:100002445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jobs.thebeessolution.com",nocase; classtype:trojan-activity; sid:100002446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"joelbonissilver.com",nocase; classtype:trojan-activity; sid:100002447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"join.cl8movement.co.za",nocase; classtype:trojan-activity; sid:100002448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"josegene.com",nocase; classtype:trojan-activity; sid:100002449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jpwoodfordco.com",nocase; classtype:trojan-activity; sid:100002450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jumpmanualjacobhiller.com",nocase; classtype:trojan-activity; sid:100002451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jupiter.toxsl.in",nocase; classtype:trojan-activity; sid:100002452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"justinscott.com.au",nocase; classtype:trojan-activity; sid:100002453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kadigital.co.uk",nocase; classtype:trojan-activity; sid:100002454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kaizenjanitorial.com",nocase; classtype:trojan-activity; sid:100002455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kalawatihomes.com",nocase; classtype:trojan-activity; sid:100002456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kalogirosfinance.com",nocase; classtype:trojan-activity; sid:100002457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kaptaanchapal.com",nocase; classtype:trojan-activity; sid:100002458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"karer.by",nocase; classtype:trojan-activity; sid:100002459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"katanvetov.co.il",nocase; classtype:trojan-activity; sid:100002460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"katelynn9506a.ru.com",nocase; classtype:trojan-activity; sid:100002461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kensingtondriving.com",nocase; classtype:trojan-activity; sid:100002462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ketofitnessexpert.com",nocase; classtype:trojan-activity; sid:100002463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kevinjewelry.com.co",nocase; classtype:trojan-activity; sid:100002464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"keywatch.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"khmerosja.net",nocase; classtype:trojan-activity; sid:100002466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kingssa.co.za",nocase; classtype:trojan-activity; sid:100002467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kizitox.ga",nocase; classtype:trojan-activity; sid:100002468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kjcpromo.com",nocase; classtype:trojan-activity; sid:100002469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kldatabase.com",nocase; classtype:trojan-activity; sid:100002470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kleinendeli.co.za",nocase; classtype:trojan-activity; sid:100002471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"korrectconceptservices.com",nocase; classtype:trojan-activity; sid:100002472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"krisbadminton.com",nocase; classtype:trojan-activity; sid:100002473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ktb.sch.id",nocase; classtype:trojan-activity; sid:100002474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kubatoglubaklava.com.tr",nocase; classtype:trojan-activity; sid:100002475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kullumanalitours.com",nocase; classtype:trojan-activity; sid:100002476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kwanfromhongkong.com",nocase; classtype:trojan-activity; sid:100002477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kz.sldov.ru",nocase; classtype:trojan-activity; sid:100002478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lacasadelosalebrijes.com",nocase; classtype:trojan-activity; sid:100002479; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ladylabonde.com",nocase; classtype:trojan-activity; sid:100002480; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lameguard.ru",nocase; classtype:trojan-activity; sid:100002481; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"laodongnhat.vn",nocase; classtype:trojan-activity; sid:100002482; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"laravel.pointersoftwares.com.br",nocase; classtype:trojan-activity; sid:100002483; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lasermobilesounds.co.uk",nocase; classtype:trojan-activity; sid:100002484; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"laura9630fr.com",nocase; classtype:trojan-activity; sid:100002485; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lauratomismith.com",nocase; classtype:trojan-activity; sid:100002486; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lautarosanmiguel.com",nocase; classtype:trojan-activity; sid:100002487; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lawforall.edu.lk",nocase; classtype:trojan-activity; sid:100002488; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lawschoolideas.xyz",nocase; classtype:trojan-activity; sid:100002489; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lceventos.net",nocase; classtype:trojan-activity; sid:100002490; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ld.mediaget.com",nocase; classtype:trojan-activity; sid:100002491; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ldgcorp.com",nocase; classtype:trojan-activity; sid:100002492; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"learning.real-academy.net",nocase; classtype:trojan-activity; sid:100002493; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"leasiacherise.com",nocase; classtype:trojan-activity; sid:100002494; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"leczkregoslup.acelero.pl",nocase; classtype:trojan-activity; sid:100002495; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"legend.nu",nocase; classtype:trojan-activity; sid:100002496; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"leluibuffet.com.br",nocase; classtype:trojan-activity; sid:100002497; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lestesteux.ca",nocase; classtype:trojan-activity; sid:100002498; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"library.arihantmbainstitute.ac.in",nocase; classtype:trojan-activity; sid:100002499; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"library.uib.ac.id",nocase; classtype:trojan-activity; sid:100002500; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lidoraggiodisole.it",nocase; classtype:trojan-activity; sid:100002501; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lifebeam.elin.co.za",nocase; classtype:trojan-activity; sid:100002502; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lindnerelektroanlagen.de",nocase; classtype:trojan-activity; sid:100002503; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"linkintec.cn",nocase; classtype:trojan-activity; sid:100002504; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"liquidaz.casa",nocase; classtype:trojan-activity; sid:100002505; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"livetrack.in",nocase; classtype:trojan-activity; sid:100002506; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lloydsindian.co.uk",nocase; classtype:trojan-activity; sid:100002507; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lm.stagingarea.co.za",nocase; classtype:trojan-activity; sid:100002508; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lmaancha.co.il",nocase; classtype:trojan-activity; sid:100002509; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lms.cstdevs.com",nocase; classtype:trojan-activity; sid:100002510; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lms.login2.in",nocase; classtype:trojan-activity; sid:100002511; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"location-voitures.ma",nocase; classtype:trojan-activity; sid:100002512; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"login.trezor.com.stockfootagesindia.com",nocase; classtype:trojan-activity; sid:100002513; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"logotypfabriken.se",nocase; classtype:trojan-activity; sid:100002514; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lotix.de",nocase; classtype:trojan-activity; sid:100002515; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lotusanddragonfly.com",nocase; classtype:trojan-activity; sid:100002516; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lp.definerisco.com",nocase; classtype:trojan-activity; sid:100002517; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lp.difusodesign.com",nocase; classtype:trojan-activity; sid:100002518; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ltc.typoten.com",nocase; classtype:trojan-activity; sid:100002519; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"luckybrownie.com",nocase; classtype:trojan-activity; sid:100002520; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"luminouspneuma.com",nocase; classtype:trojan-activity; sid:100002521; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"luxomodels.com",nocase; classtype:trojan-activity; sid:100002522; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"m-technics.kz",nocase; classtype:trojan-activity; sid:100002523; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"m.estudiomoros.com.ar",nocase; classtype:trojan-activity; sid:100002524; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"m.softsharks.com",nocase; classtype:trojan-activity; sid:100002525; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"madicon.co.za",nocase; classtype:trojan-activity; sid:100002526; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"magianegramagiablancayamarres.com",nocase; classtype:trojan-activity; sid:100002527; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mail.bs-eiendomme.co.za",nocase; classtype:trojan-activity; sid:100002528; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mail.golimoapp.com",nocase; classtype:trojan-activity; sid:100002529; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mail.jeffsono.org",nocase; classtype:trojan-activity; sid:100002530; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"maksi.feb.unib.ac.id",nocase; classtype:trojan-activity; sid:100002531; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"malaya.tv",nocase; classtype:trojan-activity; sid:100002532; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"malwarecoding.github.io",nocase; classtype:trojan-activity; sid:100002533; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"managed.oss-cn-beijing.aliyuncs.com",nocase; classtype:trojan-activity; sid:100002534; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"managemysalon.in",nocase; classtype:trojan-activity; sid:100002535; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"manantialesdelnorte.uy",nocase; classtype:trojan-activity; sid:100002536; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"manhtien.net",nocase; classtype:trojan-activity; sid:100002537; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mario-sunjic.com",nocase; classtype:trojan-activity; sid:100002538; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mariobrown.net",nocase; classtype:trojan-activity; sid:100002539; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mariotessarollo.com",nocase; classtype:trojan-activity; sid:100002540; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"marketinfosales.com",nocase; classtype:trojan-activity; sid:100002541; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"marketing.enexusgroup.com.au",nocase; classtype:trojan-activity; sid:100002542; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"marksidfgs.ug",nocase; classtype:trojan-activity; sid:100002543; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"masjidhabeebiyarazviya.mysunni.com",nocase; classtype:trojan-activity; sid:100002544; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mastersofclientretention.com.au",nocase; classtype:trojan-activity; sid:100002545; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"materialescantu.com",nocase; classtype:trojan-activity; sid:100002546; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"matruchhaya.co.in",nocase; classtype:trojan-activity; sid:100002547; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"maxiquim.cl",nocase; classtype:trojan-activity; sid:100002548; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"maxtox.com.pk",nocase; classtype:trojan-activity; sid:100002549; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mbgrm.com",nocase; classtype:trojan-activity; sid:100002550; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mbjtimes.com",nocase; classtype:trojan-activity; sid:100002551; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mbsolutions.ge",nocase; classtype:trojan-activity; sid:100002552; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mbx.com.au",nocase; classtype:trojan-activity; sid:100002553; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mdasa.elin.co.za",nocase; classtype:trojan-activity; sid:100002554; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"medevlb.org",nocase; classtype:trojan-activity; sid:100002555; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"media-server.skyinternet.com.pk",nocase; classtype:trojan-activity; sid:100002556; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"medianews.ge",nocase; classtype:trojan-activity; sid:100002557; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mediawaysnews.com",nocase; classtype:trojan-activity; sid:100002558; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"medistaffconsulting.com",nocase; classtype:trojan-activity; sid:100002559; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"meeweb.com",nocase; classtype:trojan-activity; sid:100002560; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"megagynreformas.com.br",nocase; classtype:trojan-activity; sid:100002561; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"megamart.afnan-amc.com",nocase; classtype:trojan-activity; sid:100002562; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mehainteriors.com",nocase; classtype:trojan-activity; sid:100002563; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mercabits.com",nocase; classtype:trojan-activity; sid:100002564; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"merkathink.com",nocase; classtype:trojan-activity; sid:100002565; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mertlog.com",nocase; classtype:trojan-activity; sid:100002566; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"metalin-cr.com",nocase; classtype:trojan-activity; sid:100002567; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mettaanand.org",nocase; classtype:trojan-activity; sid:100002568; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"meuoculosnanet.com.br",nocase; classtype:trojan-activity; sid:100002569; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mfevr.com",nocase; classtype:trojan-activity; sid:100002570; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mhkdhotbot.myvnc.com",nocase; classtype:trojan-activity; sid:100002571; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mhkdhotbot80.myvnc.com",nocase; classtype:trojan-activity; sid:100002572; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"micalle.com.au",nocase; classtype:trojan-activity; sid:100002573; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"michaelphilip.com",nocase; classtype:trojan-activity; sid:100002574; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"michimal2.000webhostapp.com",nocase; classtype:trojan-activity; sid:100002575; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"microblading.mirliandias.com.br",nocase; classtype:trojan-activity; sid:100002576; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"microcomm-group.com",nocase; classtype:trojan-activity; sid:100002577; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mikhailmotoringschool.com",nocase; classtype:trojan-activity; sid:100002578; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mills-skyla30ec.com",nocase; classtype:trojan-activity; sid:100002579; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mingguanwms.com",nocase; classtype:trojan-activity; sid:100002580; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"minuevavida.org",nocase; classtype:trojan-activity; sid:100002581; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mirror.mypage.sk",nocase; classtype:trojan-activity; sid:100002582; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mis.nbcc.ac.th",nocase; classtype:trojan-activity; sid:100002583; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"misterson.com",nocase; classtype:trojan-activity; sid:100002584; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mkontakt.az",nocase; classtype:trojan-activity; sid:100002585; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mktf.mx",nocase; classtype:trojan-activity; sid:100002586; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mmdx.com",nocase; classtype:trojan-activity; sid:100002587; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mmogollon.com.mx",nocase; classtype:trojan-activity; sid:100002588; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mncarteam.com",nocase; classtype:trojan-activity; sid:100002589; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"modelhouseturkey.com",nocase; classtype:trojan-activity; sid:100002590; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"modernmanna.org",nocase; classtype:trojan-activity; sid:100002591; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"monetization.business",nocase; classtype:trojan-activity; sid:100002592; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"moninediy.com",nocase; classtype:trojan-activity; sid:100002593; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mopai.sg",nocase; classtype:trojan-activity; sid:100002594; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.31.126.33",nocase; classtype:trojan-activity; sid:100001673; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.38.149.66",nocase; classtype:trojan-activity; sid:100001674; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.38.222.98",nocase; classtype:trojan-activity; sid:100001675; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.43.207.148",nocase; classtype:trojan-activity; sid:100001676; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"62.90.165.236",nocase; classtype:trojan-activity; sid:100001677; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"63.245.122.93",nocase; classtype:trojan-activity; sid:100001678; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"64.233.154.99",nocase; classtype:trojan-activity; sid:100001679; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.0.168.152",nocase; classtype:trojan-activity; sid:100001680; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.125.128.196",nocase; classtype:trojan-activity; sid:100001681; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.21.58.252",nocase; classtype:trojan-activity; sid:100001682; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.26.155.131",nocase; classtype:trojan-activity; sid:100001683; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"65.35.61.255",nocase; classtype:trojan-activity; sid:100001684; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.108.199.144",nocase; classtype:trojan-activity; sid:100001685; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.229.214.115",nocase; classtype:trojan-activity; sid:100001686; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.57.55.210",nocase; classtype:trojan-activity; sid:100001687; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.74.7.197",nocase; classtype:trojan-activity; sid:100001688; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"66.97.181.196",nocase; classtype:trojan-activity; sid:100001689; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"67.245.151.203",nocase; classtype:trojan-activity; sid:100001690; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"67.8.138.101",nocase; classtype:trojan-activity; sid:100001691; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"67.83.49.234",nocase; classtype:trojan-activity; sid:100001692; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"67.84.138.165",nocase; classtype:trojan-activity; sid:100001693; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.148.103.248",nocase; classtype:trojan-activity; sid:100001694; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.174.182.226",nocase; classtype:trojan-activity; sid:100001695; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.175.107.153",nocase; classtype:trojan-activity; sid:100001696; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.188.144.143",nocase; classtype:trojan-activity; sid:100001697; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.204.88.29",nocase; classtype:trojan-activity; sid:100001698; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.205.106.84",nocase; classtype:trojan-activity; sid:100001699; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.205.119.241",nocase; classtype:trojan-activity; sid:100001700; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"68.78.33.33",nocase; classtype:trojan-activity; sid:100001701; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.115.37.205",nocase; classtype:trojan-activity; sid:100001702; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.120.237.255",nocase; classtype:trojan-activity; sid:100001703; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.123.245.151",nocase; classtype:trojan-activity; sid:100001704; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.124.231.110",nocase; classtype:trojan-activity; sid:100001705; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.127.214.47",nocase; classtype:trojan-activity; sid:100001706; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.146.232.34",nocase; classtype:trojan-activity; sid:100001707; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.165.173.49",nocase; classtype:trojan-activity; sid:100001708; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.196.158.227",nocase; classtype:trojan-activity; sid:100001709; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.222.157.166",nocase; classtype:trojan-activity; sid:100001710; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.229.0.133",nocase; classtype:trojan-activity; sid:100001711; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.63.73.234",nocase; classtype:trojan-activity; sid:100001712; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.75.115.194",nocase; classtype:trojan-activity; sid:100001713; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.75.227.186",nocase; classtype:trojan-activity; sid:100001714; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"69.76.240.206",nocase; classtype:trojan-activity; sid:100001715; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.115.31.30",nocase; classtype:trojan-activity; sid:100001716; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.118.240.88",nocase; classtype:trojan-activity; sid:100001717; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.167.10.180",nocase; classtype:trojan-activity; sid:100001718; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.236.190.250",nocase; classtype:trojan-activity; sid:100001719; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.25.5.105",nocase; classtype:trojan-activity; sid:100001720; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"70.93.129.118",nocase; classtype:trojan-activity; sid:100001721; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.127.148.69",nocase; classtype:trojan-activity; sid:100001722; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.146.190.91",nocase; classtype:trojan-activity; sid:100001723; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.204.63.239",nocase; classtype:trojan-activity; sid:100001724; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.29.48.164",nocase; classtype:trojan-activity; sid:100001725; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.34.191.213",nocase; classtype:trojan-activity; sid:100001726; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.40.234.166",nocase; classtype:trojan-activity; sid:100001727; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.43.106.142",nocase; classtype:trojan-activity; sid:100001728; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.43.2.122",nocase; classtype:trojan-activity; sid:100001729; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.43.235.106",nocase; classtype:trojan-activity; sid:100001730; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.47.133.58",nocase; classtype:trojan-activity; sid:100001731; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.71.60.69",nocase; classtype:trojan-activity; sid:100001732; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"71.85.106.211",nocase; classtype:trojan-activity; sid:100001733; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.17.22.30",nocase; classtype:trojan-activity; sid:100001734; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.189.180.98",nocase; classtype:trojan-activity; sid:100001735; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.189.200.62",nocase; classtype:trojan-activity; sid:100001736; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.202.249.109",nocase; classtype:trojan-activity; sid:100001737; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.214.69.226",nocase; classtype:trojan-activity; sid:100001738; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.229.230.118",nocase; classtype:trojan-activity; sid:100001739; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"72.31.40.122",nocase; classtype:trojan-activity; sid:100001740; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"73.112.123.203",nocase; classtype:trojan-activity; sid:100001741; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"73.204.216.103",nocase; classtype:trojan-activity; sid:100001742; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"73.70.164.42",nocase; classtype:trojan-activity; sid:100001743; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.101.1.159",nocase; classtype:trojan-activity; sid:100001744; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.108.224.112",nocase; classtype:trojan-activity; sid:100001745; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.194.117.165",nocase; classtype:trojan-activity; sid:100001746; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.195.115.176",nocase; classtype:trojan-activity; sid:100001747; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.199.84.77",nocase; classtype:trojan-activity; sid:100001748; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.64.139.223",nocase; classtype:trojan-activity; sid:100001749; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"74.75.165.81",nocase; classtype:trojan-activity; sid:100001750; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"75.127.141.52",nocase; classtype:trojan-activity; sid:100001751; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"75.83.102.27",nocase; classtype:trojan-activity; sid:100001752; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"75.99.213.61",nocase; classtype:trojan-activity; sid:100001753; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.170.11.82",nocase; classtype:trojan-activity; sid:100001754; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.178.22.145",nocase; classtype:trojan-activity; sid:100001755; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.217.92.231",nocase; classtype:trojan-activity; sid:100001756; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.250.199.133",nocase; classtype:trojan-activity; sid:100001757; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.254.129.227",nocase; classtype:trojan-activity; sid:100001758; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.84.134.33",nocase; classtype:trojan-activity; sid:100001759; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"76.95.12.137",nocase; classtype:trojan-activity; sid:100001760; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.111.182.31",nocase; classtype:trojan-activity; sid:100001761; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.237.25.210",nocase; classtype:trojan-activity; sid:100001762; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.71.50.153",nocase; classtype:trojan-activity; sid:100001763; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.71.52.220",nocase; classtype:trojan-activity; sid:100001764; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77.89.203.238",nocase; classtype:trojan-activity; sid:100001765; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"77st.net",nocase; classtype:trojan-activity; sid:100001766; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.145.224.45",nocase; classtype:trojan-activity; sid:100001767; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.187.141.144",nocase; classtype:trojan-activity; sid:100001768; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.187.240.125",nocase; classtype:trojan-activity; sid:100001769; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.187.41.200",nocase; classtype:trojan-activity; sid:100001770; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.188.106.235",nocase; classtype:trojan-activity; sid:100001771; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.188.168.64",nocase; classtype:trojan-activity; sid:100001772; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.188.188.141",nocase; classtype:trojan-activity; sid:100001773; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.189.104.157",nocase; classtype:trojan-activity; sid:100001774; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.189.176.163",nocase; classtype:trojan-activity; sid:100001775; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.23.172.81",nocase; classtype:trojan-activity; sid:100001776; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"78.8.225.77",nocase; classtype:trojan-activity; sid:100001777; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.11.195.121",nocase; classtype:trojan-activity; sid:100001778; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.130.253.13",nocase; classtype:trojan-activity; sid:100001779; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.147.123.48",nocase; classtype:trojan-activity; sid:100001780; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.167.189.236",nocase; classtype:trojan-activity; sid:100001781; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.175.42.244",nocase; classtype:trojan-activity; sid:100001782; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.21.84.63",nocase; classtype:trojan-activity; sid:100001783; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.7.170.58",nocase; classtype:trojan-activity; sid:100001784; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.79.58.94",nocase; classtype:trojan-activity; sid:100001785; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.8.70.162",nocase; classtype:trojan-activity; sid:100001786; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"79.9.88.185",nocase; classtype:trojan-activity; sid:100001787; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.107.89.207",nocase; classtype:trojan-activity; sid:100001788; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.19.101.218",nocase; classtype:trojan-activity; sid:100001789; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.211.181.77",nocase; classtype:trojan-activity; sid:100001790; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.217.12.7",nocase; classtype:trojan-activity; sid:100001791; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"80.99.128.61",nocase; classtype:trojan-activity; sid:100001792; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.136.146.213",nocase; classtype:trojan-activity; sid:100001793; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.165.44.109",nocase; classtype:trojan-activity; sid:100001794; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.191.40.58",nocase; classtype:trojan-activity; sid:100001795; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.213.141.184",nocase; classtype:trojan-activity; sid:100001796; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.215.199.29",nocase; classtype:trojan-activity; sid:100001797; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.218.187.113",nocase; classtype:trojan-activity; sid:100001798; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.218.195.216",nocase; classtype:trojan-activity; sid:100001799; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.237.128.200",nocase; classtype:trojan-activity; sid:100001800; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.244.219.41",nocase; classtype:trojan-activity; sid:100001801; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.246.225.203",nocase; classtype:trojan-activity; sid:100001802; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"81.92.36.96",nocase; classtype:trojan-activity; sid:100001803; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.103.108.72",nocase; classtype:trojan-activity; sid:100001804; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.135.196.130",nocase; classtype:trojan-activity; sid:100001805; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.166.212.178",nocase; classtype:trojan-activity; sid:100001806; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.166.85.112",nocase; classtype:trojan-activity; sid:100001807; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.207.61.194",nocase; classtype:trojan-activity; sid:100001808; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.209.250.155",nocase; classtype:trojan-activity; sid:100001809; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.211.156.38",nocase; classtype:trojan-activity; sid:100001810; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.59.31.181",nocase; classtype:trojan-activity; sid:100001811; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.62.110.252",nocase; classtype:trojan-activity; sid:100001812; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.62.53.77",nocase; classtype:trojan-activity; sid:100001813; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.80.138.72",nocase; classtype:trojan-activity; sid:100001814; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.80.139.92",nocase; classtype:trojan-activity; sid:100001815; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.80.154.214",nocase; classtype:trojan-activity; sid:100001816; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.80.187.109",nocase; classtype:trojan-activity; sid:100001817; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.100.54",nocase; classtype:trojan-activity; sid:100001818; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.106.65",nocase; classtype:trojan-activity; sid:100001819; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.108.172",nocase; classtype:trojan-activity; sid:100001820; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.131.158",nocase; classtype:trojan-activity; sid:100001821; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.134.66",nocase; classtype:trojan-activity; sid:100001822; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.19.42",nocase; classtype:trojan-activity; sid:100001823; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.197.254",nocase; classtype:trojan-activity; sid:100001824; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.215.149",nocase; classtype:trojan-activity; sid:100001825; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.232.68",nocase; classtype:trojan-activity; sid:100001826; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.234.195",nocase; classtype:trojan-activity; sid:100001827; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.246.96",nocase; classtype:trojan-activity; sid:100001828; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.28.57",nocase; classtype:trojan-activity; sid:100001829; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.4.57",nocase; classtype:trojan-activity; sid:100001830; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.55.84",nocase; classtype:trojan-activity; sid:100001831; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.73.245",nocase; classtype:trojan-activity; sid:100001832; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"82.81.98.51",nocase; classtype:trojan-activity; sid:100001833; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.165.237.163",nocase; classtype:trojan-activity; sid:100001834; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.234.147.99",nocase; classtype:trojan-activity; sid:100001835; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.234.218.42",nocase; classtype:trojan-activity; sid:100001836; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.242.253.154",nocase; classtype:trojan-activity; sid:100001837; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"83.252.9.37",nocase; classtype:trojan-activity; sid:100001838; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.210.219.213",nocase; classtype:trojan-activity; sid:100001839; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.228.50.118",nocase; classtype:trojan-activity; sid:100001840; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.228.95.204",nocase; classtype:trojan-activity; sid:100001841; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.238.24.35",nocase; classtype:trojan-activity; sid:100001842; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.247.83.74",nocase; classtype:trojan-activity; sid:100001843; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.254.39.129",nocase; classtype:trojan-activity; sid:100001844; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.33.111.227",nocase; classtype:trojan-activity; sid:100001845; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.40.127.242",nocase; classtype:trojan-activity; sid:100001846; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"84.42.20.217",nocase; classtype:trojan-activity; sid:100001847; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com",nocase; classtype:trojan-activity; sid:100001848; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.11.216",nocase; classtype:trojan-activity; sid:100001849; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.123.251",nocase; classtype:trojan-activity; sid:100001850; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.135.187",nocase; classtype:trojan-activity; sid:100001851; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.180.33",nocase; classtype:trojan-activity; sid:100001852; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.208.25",nocase; classtype:trojan-activity; sid:100001853; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.224.141",nocase; classtype:trojan-activity; sid:100001854; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.105.241.2",nocase; classtype:trojan-activity; sid:100001855; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.214.149.236",nocase; classtype:trojan-activity; sid:100001856; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.241.39.182",nocase; classtype:trojan-activity; sid:100001857; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.64.181.50",nocase; classtype:trojan-activity; sid:100001858; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.74.215.180",nocase; classtype:trojan-activity; sid:100001859; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"85.97.130.227",nocase; classtype:trojan-activity; sid:100001860; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"86.35.43.220",nocase; classtype:trojan-activity; sid:100001861; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"87.117.11.46",nocase; classtype:trojan-activity; sid:100001862; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"87.172.19.130",nocase; classtype:trojan-activity; sid:100001863; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"87.61.89.40",nocase; classtype:trojan-activity; sid:100001864; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.119.171.253",nocase; classtype:trojan-activity; sid:100001865; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.2.208.71",nocase; classtype:trojan-activity; sid:100001866; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.2.219.179",nocase; classtype:trojan-activity; sid:100001867; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.218.17.110",nocase; classtype:trojan-activity; sid:100001868; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.218.17.149",nocase; classtype:trojan-activity; sid:100001869; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.225.222.128",nocase; classtype:trojan-activity; sid:100001870; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.247.96.19",nocase; classtype:trojan-activity; sid:100001871; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.248.136.231",nocase; classtype:trojan-activity; sid:100001872; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.248.51.139",nocase; classtype:trojan-activity; sid:100001873; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.249.244.180",nocase; classtype:trojan-activity; sid:100001874; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.250.204.12",nocase; classtype:trojan-activity; sid:100001875; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.250.226.26",nocase; classtype:trojan-activity; sid:100001876; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.250.240.245",nocase; classtype:trojan-activity; sid:100001877; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"88.250.254.90",nocase; classtype:trojan-activity; sid:100001878; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.122.183.130",nocase; classtype:trojan-activity; sid:100001879; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.136.197.170",nocase; classtype:trojan-activity; sid:100001880; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.22.152.244",nocase; classtype:trojan-activity; sid:100001881; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.248.112.202",nocase; classtype:trojan-activity; sid:100001882; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.29.213.33",nocase; classtype:trojan-activity; sid:100001883; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"89.40.85.166",nocase; classtype:trojan-activity; sid:100001884; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"8poieq.bn.files.1drv.com",nocase; classtype:trojan-activity; sid:100001885; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"90.152.144.139",nocase; classtype:trojan-activity; sid:100001886; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"90.63.176.144",nocase; classtype:trojan-activity; sid:100001887; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.124.126.133",nocase; classtype:trojan-activity; sid:100001888; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.132.197.39",nocase; classtype:trojan-activity; sid:100001889; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.138.215.5",nocase; classtype:trojan-activity; sid:100001890; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.177.139.132",nocase; classtype:trojan-activity; sid:100001891; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.187.103.32",nocase; classtype:trojan-activity; sid:100001892; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.212.150.241",nocase; classtype:trojan-activity; sid:100001893; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.214.124.141",nocase; classtype:trojan-activity; sid:100001894; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.217.104.185",nocase; classtype:trojan-activity; sid:100001895; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.233.112.188",nocase; classtype:trojan-activity; sid:100001896; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.234.60.94",nocase; classtype:trojan-activity; sid:100001897; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.244.169.139",nocase; classtype:trojan-activity; sid:100001898; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"91.92.16.244",nocase; classtype:trojan-activity; sid:100001899; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.114.191.82",nocase; classtype:trojan-activity; sid:100001900; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.241.78.114",nocase; classtype:trojan-activity; sid:100001901; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.27.246.202",nocase; classtype:trojan-activity; sid:100001902; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.83.62.139",nocase; classtype:trojan-activity; sid:100001903; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"92.85.18.138",nocase; classtype:trojan-activity; sid:100001904; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.157.63.244",nocase; classtype:trojan-activity; sid:100001905; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.159.169.190",nocase; classtype:trojan-activity; sid:100001906; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.21.224.154",nocase; classtype:trojan-activity; sid:100001907; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.39.115.176",nocase; classtype:trojan-activity; sid:100001908; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.39.79.41",nocase; classtype:trojan-activity; sid:100001909; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.41.137.16",nocase; classtype:trojan-activity; sid:100001910; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.41.182.249",nocase; classtype:trojan-activity; sid:100001911; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.41.206.56",nocase; classtype:trojan-activity; sid:100001912; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.57.43.233",nocase; classtype:trojan-activity; sid:100001913; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"93.73.99.102",nocase; classtype:trojan-activity; sid:100001914; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.136.69.199",nocase; classtype:trojan-activity; sid:100001915; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.143.53.34",nocase; classtype:trojan-activity; sid:100001916; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.154.17.170",nocase; classtype:trojan-activity; sid:100001917; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.200.16.22",nocase; classtype:trojan-activity; sid:100001918; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.224.83.208",nocase; classtype:trojan-activity; sid:100001919; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.53.120.109",nocase; classtype:trojan-activity; sid:100001920; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"94.85.0.3",nocase; classtype:trojan-activity; sid:100001921; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.132.129.250",nocase; classtype:trojan-activity; sid:100001922; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.133.158.20",nocase; classtype:trojan-activity; sid:100001923; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.154.20.231",nocase; classtype:trojan-activity; sid:100001924; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.158.19.130",nocase; classtype:trojan-activity; sid:100001925; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.170.113.227",nocase; classtype:trojan-activity; sid:100001926; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.170.113.52",nocase; classtype:trojan-activity; sid:100001927; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.170.201.34",nocase; classtype:trojan-activity; sid:100001928; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.60.146.134",nocase; classtype:trojan-activity; sid:100001929; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.66.196.63",nocase; classtype:trojan-activity; sid:100001930; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"95.9.120.40",nocase; classtype:trojan-activity; sid:100001931; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"96.239.73.246",nocase; classtype:trojan-activity; sid:100001932; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"96.47.147.169",nocase; classtype:trojan-activity; sid:100001933; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"97.68.140.254",nocase; classtype:trojan-activity; sid:100001934; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"97.96.199.75",nocase; classtype:trojan-activity; sid:100001935; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.0.210.218",nocase; classtype:trojan-activity; sid:100001936; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.0.239.142",nocase; classtype:trojan-activity; sid:100001937; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.113.239.207",nocase; classtype:trojan-activity; sid:100001938; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.116.72.119",nocase; classtype:trojan-activity; sid:100001939; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.128.147.115",nocase; classtype:trojan-activity; sid:100001940; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.178.207.205",nocase; classtype:trojan-activity; sid:100001941; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.178.242.44",nocase; classtype:trojan-activity; sid:100001942; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"98.30.24.54",nocase; classtype:trojan-activity; sid:100001943; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"99.150.245.203",nocase; classtype:trojan-activity; sid:100001944; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"99.33.195.164",nocase; classtype:trojan-activity; sid:100001945; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aatreefelling.co.za",nocase; classtype:trojan-activity; sid:100001946; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"abcd.bg",nocase; classtype:trojan-activity; sid:100001947; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"abissnet.net",nocase; classtype:trojan-activity; sid:100001948; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aboveandbelow.com.au",nocase; classtype:trojan-activity; sid:100001949; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"absoftechworld.com",nocase; classtype:trojan-activity; sid:100001950; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"abyssos.eu",nocase; classtype:trojan-activity; sid:100001951; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"academyshademani.com",nocase; classtype:trojan-activity; sid:100001952; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"acbick.com",nocase; classtype:trojan-activity; sid:100001953; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"accesslinksgroup.com",nocase; classtype:trojan-activity; sid:100001954; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aceeprc.com.aceeprc.com",nocase; classtype:trojan-activity; sid:100001955; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"acellr.co.uk",nocase; classtype:trojan-activity; sid:100001956; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"acteon.com.ar",nocase; classtype:trojan-activity; sid:100001957; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"addahealingmusic.com",nocase; classtype:trojan-activity; sid:100001958; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"adithimedia.com",nocase; classtype:trojan-activity; sid:100001959; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"adithimedia.memengers.com",nocase; classtype:trojan-activity; sid:100001960; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"admin.erapor.smk-alasror.net",nocase; classtype:trojan-activity; sid:100001961; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"admin.gentbcn.org",nocase; classtype:trojan-activity; sid:100001962; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"admin.grandoceanvilla.com",nocase; classtype:trojan-activity; sid:100001963; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"admission.kmctartskuttippuram.org",nocase; classtype:trojan-activity; sid:100001964; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"adventureexplorer.in",nocase; classtype:trojan-activity; sid:100001965; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aeropilates.cl",nocase; classtype:trojan-activity; sid:100001966; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"afnan-amc.com",nocase; classtype:trojan-activity; sid:100001967; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"afrimedspecialist.com",nocase; classtype:trojan-activity; sid:100001968; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"agemn.co.za",nocase; classtype:trojan-activity; sid:100001969; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"agenciadigitalwdys.com",nocase; classtype:trojan-activity; sid:100001970; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"agenda.gmelloinformatica.com.br",nocase; classtype:trojan-activity; sid:100001971; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"agile8studio.com",nocase; classtype:trojan-activity; sid:100001972; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aiecons.com",nocase; classtype:trojan-activity; sid:100001973; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aimnaukri.com",nocase; classtype:trojan-activity; sid:100001974; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aiqtest.com",nocase; classtype:trojan-activity; sid:100001975; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ajpharmaholding.com",nocase; classtype:trojan-activity; sid:100001976; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"akdvidyalaya.com",nocase; classtype:trojan-activity; sid:100001977; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"al-wahd.com",nocase; classtype:trojan-activity; sid:100001978; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alasdemariposas.org",nocase; classtype:trojan-activity; sid:100001979; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alberts.diamondrelationscrm.us",nocase; classtype:trojan-activity; sid:100001980; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alemelektronik.com",nocase; classtype:trojan-activity; sid:100001981; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alena1971.es",nocase; classtype:trojan-activity; sid:100001982; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alexdubai.com.aldiabsteel.com",nocase; classtype:trojan-activity; sid:100001983; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alka.institute",nocase; classtype:trojan-activity; sid:100001984; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"allforcreative.com.au",nocase; classtype:trojan-activity; sid:100001985; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alltheway.travel",nocase; classtype:trojan-activity; sid:100001986; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alpaylar.com.tr",nocase; classtype:trojan-activity; sid:100001987; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"alumni.hildred.ibbott@46.249.33.79",nocase; classtype:trojan-activity; sid:100001988; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"am-concepts.ca",nocase; classtype:trojan-activity; sid:100001989; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amamontajes.com",nocase; classtype:trojan-activity; sid:100001990; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amarresdeamorymaestroshechiceros.com",nocase; classtype:trojan-activity; sid:100001991; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amarteargentina.com.ar",nocase; classtype:trojan-activity; sid:100001992; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amos524.org",nocase; classtype:trojan-activity; sid:100001993; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ams.alvinasschools.org.ng",nocase; classtype:trojan-activity; sid:100001994; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anadelgbt.org",nocase; classtype:trojan-activity; sid:100001995; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anantam.net.in",nocase; classtype:trojan-activity; sid:100001996; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"andreelapeyre.com",nocase; classtype:trojan-activity; sid:100001997; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"andremaraisbeleggings.co.za",nocase; classtype:trojan-activity; sid:100001998; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"andreshconcejal.solucioneslink.com",nocase; classtype:trojan-activity; sid:100001999; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"angelazgheibld.com",nocase; classtype:trojan-activity; sid:100002000; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"angelsdetour.com",nocase; classtype:trojan-activity; sid:100002001; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anhung1102.vn",nocase; classtype:trojan-activity; sid:100002002; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anurontv.com",nocase; classtype:trojan-activity; sid:100002003; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"anysbergbiltong.co.za",nocase; classtype:trojan-activity; sid:100002004; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"apartamentoscitta.com",nocase; classtype:trojan-activity; sid:100002005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"api-ms.cobainaja.id",nocase; classtype:trojan-activity; sid:100002006; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"api.cstdevs.com",nocase; classtype:trojan-activity; sid:100002007; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"apoolcondo.com",nocase; classtype:trojan-activity; sid:100002008; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"app.adsensearticle.com",nocase; classtype:trojan-activity; sid:100002009; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"app.explicitsurveys.co.uk",nocase; classtype:trojan-activity; sid:100002010; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"app.prerana.info",nocase; classtype:trojan-activity; sid:100002011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"apps.saintsoporte.com",nocase; classtype:trojan-activity; sid:100002012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aps-scribe.com",nocase; classtype:trojan-activity; sid:100002013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aps-sv.com",nocase; classtype:trojan-activity; sid:100002014; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"artedibujoyarquitectura.com",nocase; classtype:trojan-activity; sid:100002015; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"arwenyapi.com",nocase; classtype:trojan-activity; sid:100002016; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ask-regard.call-save.biz",nocase; classtype:trojan-activity; sid:100002017; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"asucssa.live",nocase; classtype:trojan-activity; sid:100002018; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"atfile.com",nocase; classtype:trojan-activity; sid:100002019; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"athenacapsg.com",nocase; classtype:trojan-activity; sid:100002020; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"atlasconcreteworks.com",nocase; classtype:trojan-activity; sid:100002021; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"attach.66rpg.com",nocase; classtype:trojan-activity; sid:100002022; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"atteuqpotentialunlimited.com",nocase; classtype:trojan-activity; sid:100002023; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"augustair.com",nocase; classtype:trojan-activity; sid:100002024; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aulist.com",nocase; classtype:trojan-activity; sid:100002025; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"automaticrefreshments.com",nocase; classtype:trojan-activity; sid:100002026; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"avadhanagames.com",nocase; classtype:trojan-activity; sid:100002027; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ayahuascasp.com.br",nocase; classtype:trojan-activity; sid:100002028; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ayamallah.com",nocase; classtype:trojan-activity; sid:100002029; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"aycconsultoriaempresarial.com",nocase; classtype:trojan-activity; sid:100002030; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"azmeasurement.com",nocase; classtype:trojan-activity; sid:100002031; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"azraktours.com",nocase; classtype:trojan-activity; sid:100002032; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"b2b.toptanakaryakit.com.tr",nocase; classtype:trojan-activity; sid:100002033; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"badeggdesign.com",nocase; classtype:trojan-activity; sid:100002034; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"balealgodon.mx",nocase; classtype:trojan-activity; sid:100002035; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bangkok-orchids.com",nocase; classtype:trojan-activity; sid:100002036; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bangladeshunbound.com",nocase; classtype:trojan-activity; sid:100002037; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bary.sz4h.com",nocase; classtype:trojan-activity; sid:100002038; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bash.givemexyz.in",nocase; classtype:trojan-activity; sid:100002039; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bausch.kr-atlas.monaxikoslykos@zytrox.tk",nocase; classtype:trojan-activity; sid:100002040; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bavhome.com",nocase; classtype:trojan-activity; sid:100002041; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bbia.co.uk",nocase; classtype:trojan-activity; sid:100002042; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bcmt.elin.co.za",nocase; classtype:trojan-activity; sid:100002043; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bcrg.co.za",nocase; classtype:trojan-activity; sid:100002044; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bdnextrend.xyz",nocase; classtype:trojan-activity; sid:100002045; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beanx88.xyz",nocase; classtype:trojan-activity; sid:100002046; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bearcatpumps.com.cn",nocase; classtype:trojan-activity; sid:100002047; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beautincollagen.rs",nocase; classtype:trojan-activity; sid:100002048; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beautymomentsgt.de",nocase; classtype:trojan-activity; sid:100002049; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bekape.co.id",nocase; classtype:trojan-activity; sid:100002050; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beor360.com",nocase; classtype:trojan-activity; sid:100002051; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bespokeweddings.ie",nocase; classtype:trojan-activity; sid:100002052; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bestcarenepal.com",nocase; classtype:trojan-activity; sid:100002053; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"betone.co.kr",nocase; classtype:trojan-activity; sid:100002054; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"betycopaints.com",nocase; classtype:trojan-activity; sid:100002055; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"beveragesmiami.solucioneslink.com",nocase; classtype:trojan-activity; sid:100002056; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bhavaniengineering.com",nocase; classtype:trojan-activity; sid:100002057; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bigmikesupplies.co.za",nocase; classtype:trojan-activity; sid:100002058; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bilhen.co.za",nocase; classtype:trojan-activity; sid:100002059; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"billing.rahitechnosoft.com",nocase; classtype:trojan-activity; sid:100002060; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"binoy.stalphonsamissionva.org",nocase; classtype:trojan-activity; sid:100002061; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"biometrico.gpotecnosystems.com",nocase; classtype:trojan-activity; sid:100002062; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bioskey.com",nocase; classtype:trojan-activity; sid:100002063; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"birdi.elin.co.za",nocase; classtype:trojan-activity; sid:100002064; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"birminghamlink.org",nocase; classtype:trojan-activity; sid:100002065; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bizztradingbot.nl",nocase; classtype:trojan-activity; sid:100002066; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bl4n3.zadns.co.za",nocase; classtype:trojan-activity; sid:100002067; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"blog.callensaxen.com",nocase; classtype:trojan-activity; sid:100002068; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"blog.difusodesign.com",nocase; classtype:trojan-activity; sid:100002069; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"blog.oyinblogs.com",nocase; classtype:trojan-activity; sid:100002070; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"blog.takbelit.com",nocase; classtype:trojan-activity; sid:100002071; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bmlifestyle.co.uk",nocase; classtype:trojan-activity; sid:100002072; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"boatpecas.com.br",nocase; classtype:trojan-activity; sid:100002073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bodenstein.co.za",nocase; classtype:trojan-activity; sid:100002074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bodylanguage.santulan.co.in",nocase; classtype:trojan-activity; sid:100002075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"booksearch.com",nocase; classtype:trojan-activity; sid:100002076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bophelocare.co.za",nocase; classtype:trojan-activity; sid:100002077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bounces.mi-fs.com",nocase; classtype:trojan-activity; sid:100002078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"boutiqueofferte.com",nocase; classtype:trojan-activity; sid:100002079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bpo.correct.go.th",nocase; classtype:trojan-activity; sid:100002080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bradleyinstitute.co.za",nocase; classtype:trojan-activity; sid:100002081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brandtrust.com.pk",nocase; classtype:trojan-activity; sid:100002082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"braunfinancial.com.au",nocase; classtype:trojan-activity; sid:100002083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brendanquine.com",nocase; classtype:trojan-activity; sid:100002084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brideofmessiah.com",nocase; classtype:trojan-activity; sid:100002085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brightaffiliatesales.org",nocase; classtype:trojan-activity; sid:100002086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brightmega.com",nocase; classtype:trojan-activity; sid:100002087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"brightstarshop.com",nocase; classtype:trojan-activity; sid:100002088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"browardinsurancemiami.solucioneslink.com",nocase; classtype:trojan-activity; sid:100002089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bt2.elin.co.za",nocase; classtype:trojan-activity; sid:100002090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"btdapi.robotake.com",nocase; classtype:trojan-activity; sid:100002091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"buigiaphat.com.vn",nocase; classtype:trojan-activity; sid:100002092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bullseyemedia.in",nocase; classtype:trojan-activity; sid:100002093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"busandvanrentalmalaysia.com",nocase; classtype:trojan-activity; sid:100002094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"buscascolegios.diit.cl",nocase; classtype:trojan-activity; sid:100002095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"business.softberg.ro",nocase; classtype:trojan-activity; sid:100002096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"business2.softberg.ro",nocase; classtype:trojan-activity; sid:100002097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bydspa.cl",nocase; classtype:trojan-activity; sid:100002098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"c.oooooooooo.ga",nocase; classtype:trojan-activity; sid:100002099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"c0140529.ferozo.com",nocase; classtype:trojan-activity; sid:100002100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"caballo.com.au",nocase; classtype:trojan-activity; sid:100002101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cacaoprojects.com",nocase; classtype:trojan-activity; sid:100002102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"calgaryautorepairservice.com",nocase; classtype:trojan-activity; sid:100002103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"callbury.in",nocase; classtype:trojan-activity; sid:100002104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"camminachetipassa.it",nocase; classtype:trojan-activity; sid:100002105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"capitalgroup-kw.com",nocase; classtype:trojan-activity; sid:100002106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"capoeiraventrelivre.com",nocase; classtype:trojan-activity; sid:100002107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cashyinvestment.org",nocase; classtype:trojan-activity; sid:100002108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"catchperch.com",nocase; classtype:trojan-activity; sid:100002109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"catchpoolshetlands.co.uk",nocase; classtype:trojan-activity; sid:100002110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cazyacustomfurniture.com",nocase; classtype:trojan-activity; sid:100002111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cbn.hypervoizd.com",nocase; classtype:trojan-activity; sid:100002112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ccauthority.net",nocase; classtype:trojan-activity; sid:100002113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdaonline.com.ar",nocase; classtype:trojan-activity; sid:100002114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cec.asso.ac-amiens.fr",nocase; classtype:trojan-activity; sid:100002115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cecra.cl",nocase; classtype:trojan-activity; sid:100002116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cellas.sk",nocase; classtype:trojan-activity; sid:100002117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cendekiabinaaksara.com",nocase; classtype:trojan-activity; sid:100002118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cfs5.tistory.com",nocase; classtype:trojan-activity; sid:100002119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ch.rmu.ac.th",nocase; classtype:trojan-activity; sid:100002120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"changematterscounselling.com",nocase; classtype:trojan-activity; sid:100002121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chardhamdodham.com",nocase; classtype:trojan-activity; sid:100002122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chezalice.co.za",nocase; classtype:trojan-activity; sid:100002123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"childselect.com",nocase; classtype:trojan-activity; sid:100002124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chinhdropfile.myvnc.com",nocase; classtype:trojan-activity; sid:100002125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chinhdropfile80.myvnc.com",nocase; classtype:trojan-activity; sid:100002126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cible-energy.com",nocase; classtype:trojan-activity; sid:100002127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cifeer.net",nocase; classtype:trojan-activity; sid:100002128; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"citiconstructioncorp.com",nocase; classtype:trojan-activity; sid:100002129; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"citihits.lk",nocase; classtype:trojan-activity; sid:100002130; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"citssolutions.co.za",nocase; classtype:trojan-activity; sid:100002131; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"citycapproperty.ru",nocase; classtype:trojan-activity; sid:100002132; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cityglobalgospel.com",nocase; classtype:trojan-activity; sid:100002133; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"civi.istmejia.com",nocase; classtype:trojan-activity; sid:100002134; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cleanbydesignllc.com",nocase; classtype:trojan-activity; sid:100002135; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cloud.fc.co.mz",nocase; classtype:trojan-activity; sid:100002136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cm-arquitetos.com",nocase; classtype:trojan-activity; sid:100002137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cnc.tacobelllover.tk",nocase; classtype:trojan-activity; sid:100002138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"codsambal.com",nocase; classtype:trojan-activity; sid:100002139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"colinde.pricesne.com",nocase; classtype:trojan-activity; sid:100002140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"colorpak.pl",nocase; classtype:trojan-activity; sid:100002141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"columbia.aula-web.net",nocase; classtype:trojan-activity; sid:100002142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"community.reimclub.com",nocase; classtype:trojan-activity; sid:100002143; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"competancy.indigoconsult.net",nocase; classtype:trojan-activity; sid:100002144; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"conceptimagine.ro",nocase; classtype:trojan-activity; sid:100002145; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"config.cqhbkjzx.com",nocase; classtype:trojan-activity; sid:100002146; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"connectcapital.com.br",nocase; classtype:trojan-activity; sid:100002147; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"constructoralyon.com",nocase; classtype:trojan-activity; sid:100002148; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"consulateins.solucioneslink.com",nocase; classtype:trojan-activity; sid:100002149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"contributeindustry.com",nocase; classtype:trojan-activity; sid:100002150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"copelandscapes.com",nocase; classtype:trojan-activity; sid:100002151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"corwin-tommie06f.ru.com",nocase; classtype:trojan-activity; sid:100002152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"coulsongraphics.com",nocase; classtype:trojan-activity; sid:100002153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"count.mail.163.com.impactmedfoundation.com",nocase; classtype:trojan-activity; sid:100002154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"covid19.cyberschool.or.id",nocase; classtype:trojan-activity; sid:100002155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cpanel.shivay.net",nocase; classtype:trojan-activity; sid:100002156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cr-sq.com",nocase; classtype:trojan-activity; sid:100002157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"craftech.nxtnet.ga",nocase; classtype:trojan-activity; sid:100002158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crearechile.cl",nocase; classtype:trojan-activity; sid:100002159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"creationskateboards.com",nocase; classtype:trojan-activity; sid:100002160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crecerco.com",nocase; classtype:trojan-activity; sid:100002161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crittersbythebay.com",nocase; classtype:trojan-activity; sid:100002162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crm.notariavieitoyvelamazan.com",nocase; classtype:trojan-activity; sid:100002163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crmfarko.manivelasst.com",nocase; classtype:trojan-activity; sid:100002164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crmroche.manivelasst.com",nocase; classtype:trojan-activity; sid:100002165; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"crscorretordeimoveis.com.br",nocase; classtype:trojan-activity; sid:100002166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cse-engineer.com",nocase; classtype:trojan-activity; sid:100002167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"csnserver.com",nocase; classtype:trojan-activity; sid:100002168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ctracknxt.in",nocase; classtype:trojan-activity; sid:100002169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cubescargoexpress.com",nocase; classtype:trojan-activity; sid:100002170; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"curasoles.co.za",nocase; classtype:trojan-activity; sid:100002171; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"currantmedia.com",nocase; classtype:trojan-activity; sid:100002172; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cwa.mx",nocase; classtype:trojan-activity; sid:100002173; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cyclomove.com",nocase; classtype:trojan-activity; sid:100002174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cynkon.kairoscs.net",nocase; classtype:trojan-activity; sid:100002175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"czsl.91756.cn",nocase; classtype:trojan-activity; sid:100002176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"d.powerofwish.com",nocase; classtype:trojan-activity; sid:100002177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"d9.99ddd.com",nocase; classtype:trojan-activity; sid:100002178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"da.alibuf.com",nocase; classtype:trojan-activity; sid:100002179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"danaevara.com",nocase; classtype:trojan-activity; sid:100002180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dartoonpictures.com",nocase; classtype:trojan-activity; sid:100002181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"data.cdevelop.org",nocase; classtype:trojan-activity; sid:100002182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"data.over-blog-kiwi.com",nocase; classtype:trojan-activity; sid:100002183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"datapolish.com",nocase; classtype:trojan-activity; sid:100002184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dating.khokhas.co.za",nocase; classtype:trojan-activity; sid:100002185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"datsom.vn",nocase; classtype:trojan-activity; sid:100002186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"davethompson.me.uk",nocase; classtype:trojan-activity; sid:100002187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dayspringdaisies.com",nocase; classtype:trojan-activity; sid:100002188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dd.qiyuea.cn",nocase; classtype:trojan-activity; sid:100002189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ddns.cyberium.cc",nocase; classtype:trojan-activity; sid:100002190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"de.gsearch.com.de",nocase; classtype:trojan-activity; sid:100002191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"decifrar.com.br",nocase; classtype:trojan-activity; sid:100002192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"deigratia2.elin.co.za",nocase; classtype:trojan-activity; sid:100002193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dekovizyon.com",nocase; classtype:trojan-activity; sid:100002194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"demo-cliente.mindcreative.com.br",nocase; classtype:trojan-activity; sid:100002195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"demo.glassforcars.com.au",nocase; classtype:trojan-activity; sid:100002196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"demo6.hiites.com",nocase; classtype:trojan-activity; sid:100002197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dent-estet.com",nocase; classtype:trojan-activity; sid:100002198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dental.xiaoxiao.media",nocase; classtype:trojan-activity; sid:100002199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dentalalliance.se",nocase; classtype:trojan-activity; sid:100002200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"desertlandtrd.com",nocase; classtype:trojan-activity; sid:100002201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"designerliving.co.za",nocase; classtype:trojan-activity; sid:100002202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"despertaresi.com.br",nocase; classtype:trojan-activity; sid:100002203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"destinymc.co.za",nocase; classtype:trojan-activity; sid:100002204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"detorre.es",nocase; classtype:trojan-activity; sid:100002205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dev.sebpo.net",nocase; classtype:trojan-activity; sid:100002206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dev.watch-store.eu",nocase; classtype:trojan-activity; sid:100002207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dezcom.com",nocase; classtype:trojan-activity; sid:100002208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dfcf.91756.cn",nocase; classtype:trojan-activity; sid:100002209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"diamantenegro.mi-fs.com",nocase; classtype:trojan-activity; sid:100002210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dienmayminhhung.com",nocase; classtype:trojan-activity; sid:100002211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"digilib.dianhusada.ac.id",nocase; classtype:trojan-activity; sid:100002212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"digisails.org",nocase; classtype:trojan-activity; sid:100002213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"disinfection-cleaning.co.za",nocase; classtype:trojan-activity; sid:100002214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"djking.f3322.net",nocase; classtype:trojan-activity; sid:100002215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.1003b.56a.com",nocase; classtype:trojan-activity; sid:100002216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.198424.com",nocase; classtype:trojan-activity; sid:100002217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.installcdn-aws.com",nocase; classtype:trojan-activity; sid:100002218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.packetstormsecurity.net",nocase; classtype:trojan-activity; sid:100002219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dl.rina-roleplay.com",nocase; classtype:trojan-activity; sid:100002220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dockerupdate.anondns.net",nocase; classtype:trojan-activity; sid:100002221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"docman.orientalservices.in",nocase; classtype:trojan-activity; sid:100002222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dodsonimaging.com",nocase; classtype:trojan-activity; sid:100002223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"doitunlimited.com",nocase; classtype:trojan-activity; sid:100002224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dokan.blueberrytec.com",nocase; classtype:trojan-activity; sid:100002225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dom.daf.free.fr",nocase; classtype:trojan-activity; sid:100002226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"doncedyhall.com",nocase; classtype:trojan-activity; sid:100002227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"donghobinhminh.com",nocase; classtype:trojan-activity; sid:100002228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dongphuctop.com",nocase; classtype:trojan-activity; sid:100002229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"donwnloasecury.ath.cx",nocase; classtype:trojan-activity; sid:100002230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dosame.com",nocase; classtype:trojan-activity; sid:100002231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dosman.pl",nocase; classtype:trojan-activity; sid:100002232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dovberger.com",nocase; classtype:trojan-activity; sid:100002233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"down.pcclear.com",nocase; classtype:trojan-activity; sid:100002234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"down.udashi.com",nocase; classtype:trojan-activity; sid:100002235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"down.webbora.com",nocase; classtype:trojan-activity; sid:100002236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"down1.arpun.com",nocase; classtype:trojan-activity; sid:100002237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.caihong.com",nocase; classtype:trojan-activity; sid:100002238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.doumaibiji.cn",nocase; classtype:trojan-activity; sid:100002239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.exrnybuf.cn",nocase; classtype:trojan-activity; sid:100002240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.kaobeitu.com",nocase; classtype:trojan-activity; sid:100002241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.pdf00.cn",nocase; classtype:trojan-activity; sid:100002242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.rising.com.cn",nocase; classtype:trojan-activity; sid:100002243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.skycn.com",nocase; classtype:trojan-activity; sid:100002244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"download.zjsyawqj.cn",nocase; classtype:trojan-activity; sid:100002245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dragonsknot.com",nocase; classtype:trojan-activity; sid:100002246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drbaby.com.sa",nocase; classtype:trojan-activity; sid:100002247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dream.pics",nocase; classtype:trojan-activity; sid:100002248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drgroup.co.za",nocase; classtype:trojan-activity; sid:100002249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drools-moved.46999.n3.nabble.com",nocase; classtype:trojan-activity; sid:100002250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drsha.innovativesolutions.mobi",nocase; classtype:trojan-activity; sid:100002251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dsenterprize.co.za",nocase; classtype:trojan-activity; sid:100002252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dsspainting.com",nocase; classtype:trojan-activity; sid:100002253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"du-wizards.com",nocase; classtype:trojan-activity; sid:100002254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"duque.guantanameratravel.com",nocase; classtype:trojan-activity; sid:100002255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dutapp.wisolve.co.za",nocase; classtype:trojan-activity; sid:100002256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"duvalcharter.dekitout.com",nocase; classtype:trojan-activity; sid:100002257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dw2.co.id",nocase; classtype:trojan-activity; sid:100002258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dx.qqyewu.com",nocase; classtype:trojan-activity; sid:100002259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"dzinestudio87.co.uk",nocase; classtype:trojan-activity; sid:100002260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"e-commerce.saleensuporte.com.br",nocase; classtype:trojan-activity; sid:100002261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"e.sldov.ru",nocase; classtype:trojan-activity; sid:100002262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"eandgdesign.com.ng",nocase; classtype:trojan-activity; sid:100002263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"eastsheen-glaziers.co.uk",nocase; classtype:trojan-activity; sid:100002264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ebruyatkin.com",nocase; classtype:trojan-activity; sid:100002265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"edu.saicraftsman.com",nocase; classtype:trojan-activity; sid:100002266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"eedo.ee",nocase; classtype:trojan-activity; sid:100002267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"efficientegroup.com",nocase; classtype:trojan-activity; sid:100002268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"elbauldenora.com",nocase; classtype:trojan-activity; sid:100002269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"emaids.co.za",nocase; classtype:trojan-activity; sid:100002270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"emaz.pk",nocase; classtype:trojan-activity; sid:100002271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"en.baoend.com",nocase; classtype:trojan-activity; sid:100002272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"enc-tech.com",nocase; classtype:trojan-activity; sid:100002273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"endurotanzania.co.tz",nocase; classtype:trojan-activity; sid:100002274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ennovate.elin.co.za",nocase; classtype:trojan-activity; sid:100002275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"equimination.ee",nocase; classtype:trojan-activity; sid:100002276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"erp.nanotechproautocare.com",nocase; classtype:trojan-activity; sid:100002277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"erp.zilymax.com",nocase; classtype:trojan-activity; sid:100002278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"escola.probommar.org.br",nocase; classtype:trojan-activity; sid:100002279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"esnconsultants.com",nocase; classtype:trojan-activity; sid:100002280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"essentia.org.br",nocase; classtype:trojan-activity; sid:100002281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"estjh05.top",nocase; classtype:trojan-activity; sid:100002282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ethereality.info",nocase; classtype:trojan-activity; sid:100002283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"eubanks7.com",nocase; classtype:trojan-activity; sid:100002284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"europeanzonexxi.com",nocase; classtype:trojan-activity; sid:100002285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exilum.com",nocase; classtype:trojan-activity; sid:100002286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exitoalfaomega.co",nocase; classtype:trojan-activity; sid:100002287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"extrovertoffers.com",nocase; classtype:trojan-activity; sid:100002288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"f1sol.com",nocase; classtype:trojan-activity; sid:100002289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"familydentist.site",nocase; classtype:trojan-activity; sid:100002290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"faveraprojects.com",nocase; classtype:trojan-activity; sid:100002291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fc.co.mz",nocase; classtype:trojan-activity; sid:100002292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"felicienne.nl",nocase; classtype:trojan-activity; sid:100002293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"files.martellexpress.us",nocase; classtype:trojan-activity; sid:100002294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"files6.uludagbilisim.com",nocase; classtype:trojan-activity; sid:100002295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"final.makkahkmcc.com",nocase; classtype:trojan-activity; sid:100002296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fineartgallerym.com",nocase; classtype:trojan-activity; sid:100002297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fisconline.bar",nocase; classtype:trojan-activity; sid:100002298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fisconline.casa",nocase; classtype:trojan-activity; sid:100002299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fix-america-now.org",nocase; classtype:trojan-activity; sid:100002300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fixauto.illumetechnology.com",nocase; classtype:trojan-activity; sid:100002301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fixturegovernment.com",nocase; classtype:trojan-activity; sid:100002302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fkd.derpcity.ru",nocase; classtype:trojan-activity; sid:100002303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"flexypay.dsquaregroup.com",nocase; classtype:trojan-activity; sid:100002304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"flintspin.com",nocase; classtype:trojan-activity; sid:100002305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"flyingbuddhadesign.com",nocase; classtype:trojan-activity; sid:100002306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fmjplastering.co.uk",nocase; classtype:trojan-activity; sid:100002307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"follower.instantcashback.in",nocase; classtype:trojan-activity; sid:100002308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"foothills.com.br",nocase; classtype:trojan-activity; sid:100002309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"footweardirect.elin.co.za",nocase; classtype:trojan-activity; sid:100002310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"forum.mdb.nu",nocase; classtype:trojan-activity; sid:100002311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fotoobjetivo.com",nocase; classtype:trojan-activity; sid:100002312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"foundationrepairhoustontx.net",nocase; classtype:trojan-activity; sid:100002313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"foxeps.com.br",nocase; classtype:trojan-activity; sid:100002314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"freecnetdownload.com",nocase; classtype:trojan-activity; sid:100002315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"freisites.com.br",nocase; classtype:trojan-activity; sid:100002316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ftp.n3twork30cm.ml",nocase; classtype:trojan-activity; sid:100002317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fullelectronica.com.ar",nocase; classtype:trojan-activity; sid:100002318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"funletters.net",nocase; classtype:trojan-activity; sid:100002319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"fusionfiresolutions.com",nocase; classtype:trojan-activity; sid:100002320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"futbolpr.com",nocase; classtype:trojan-activity; sid:100002321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"futuregraphics.com.ar",nocase; classtype:trojan-activity; sid:100002322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"g.pinmonkey.xyz",nocase; classtype:trojan-activity; sid:100002323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gaditastour.com",nocase; classtype:trojan-activity; sid:100002324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gametwogame.com",nocase; classtype:trojan-activity; sid:100002325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"garciadogshow.com",nocase; classtype:trojan-activity; sid:100002326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"garenanow.myvnc.com",nocase; classtype:trojan-activity; sid:100002327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"garenanow4.myvnc.com",nocase; classtype:trojan-activity; sid:100002328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gastoudergonny.nl",nocase; classtype:trojan-activity; sid:100002329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gbbulls.co.uk",nocase; classtype:trojan-activity; sid:100002330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gcpc.co.id.chronoscurtain.com",nocase; classtype:trojan-activity; sid:100002331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"generaldeviales.com",nocase; classtype:trojan-activity; sid:100002332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gfmodd1.webselffiles01.com",nocase; classtype:trojan-activity; sid:100002333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gfold1.webselffiles01.com",nocase; classtype:trojan-activity; sid:100002334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ghettohub.co.za",nocase; classtype:trojan-activity; sid:100002335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ghislain.dartois.pagesperso-orange.fr",nocase; classtype:trojan-activity; sid:100002336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"giadungg7.com",nocase; classtype:trojan-activity; sid:100002337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"giddos.ga",nocase; classtype:trojan-activity; sid:100002338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"giteletropical.com",nocase; classtype:trojan-activity; sid:100002339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"glowinmedia.co.ke",nocase; classtype:trojan-activity; sid:100002340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gmtransformationacademy.com",nocase; classtype:trojan-activity; sid:100002341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gmvadmission.org",nocase; classtype:trojan-activity; sid:100002342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gnimelf.net",nocase; classtype:trojan-activity; sid:100002343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gnscrew.ro",nocase; classtype:trojan-activity; sid:100002344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gold.investforex.id",nocase; classtype:trojan-activity; sid:100002345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldcake.co.id",nocase; classtype:trojan-activity; sid:100002346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldcoastoffice365.com",nocase; classtype:trojan-activity; sid:100002347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldcoastoffice365.com.au",nocase; classtype:trojan-activity; sid:100002348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"golden-memories-funerals.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldenasiacapital.com",nocase; classtype:trojan-activity; sid:100002350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"goldmen.in",nocase; classtype:trojan-activity; sid:100002351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gpotecnosystems.com",nocase; classtype:trojan-activity; sid:100002352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gracejukes.com",nocase; classtype:trojan-activity; sid:100002353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"grupoinmare.com",nocase; classtype:trojan-activity; sid:100002354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gruposelt.000webhostapp.com",nocase; classtype:trojan-activity; sid:100002355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gs.monerorx.com",nocase; classtype:trojan-activity; sid:100002356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"guide-to-cell-phones.com",nocase; classtype:trojan-activity; sid:100002357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gulfac-house.com",nocase; classtype:trojan-activity; sid:100002358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gvpcdpgc.edu.in",nocase; classtype:trojan-activity; sid:100002359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"habbotips.free.fr",nocase; classtype:trojan-activity; sid:100002360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hagebakken.no",nocase; classtype:trojan-activity; sid:100002361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hamptonpartyoffive.com",nocase; classtype:trojan-activity; sid:100002362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hashmati.com",nocase; classtype:trojan-activity; sid:100002363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hassanproduct.com",nocase; classtype:trojan-activity; sid:100002364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hchfug.org",nocase; classtype:trojan-activity; sid:100002365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hd11315.com",nocase; classtype:trojan-activity; sid:100002366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hdkamera2003.hu",nocase; classtype:trojan-activity; sid:100002367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hds.sz4h.com",nocase; classtype:trojan-activity; sid:100002368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"heavymaq.cl",nocase; classtype:trojan-activity; sid:100002369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hellogorgeous.com.au",nocase; classtype:trojan-activity; sid:100002370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"help.hizuko.com",nocase; classtype:trojan-activity; sid:100002371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"herchinfitout.com.sg",nocase; classtype:trojan-activity; sid:100002372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hhaward.org",nocase; classtype:trojan-activity; sid:100002373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"highlandroadcoc.com",nocase; classtype:trojan-activity; sid:100002374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"highlandslasvegas.atakdev.com",nocase; classtype:trojan-activity; sid:100002375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hindi.factsriver.com",nocase; classtype:trojan-activity; sid:100002376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hiptool.net",nocase; classtype:trojan-activity; sid:100002377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hitpe.com",nocase; classtype:trojan-activity; sid:100002378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hitstation.nl",nocase; classtype:trojan-activity; sid:100002379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hmpmall.co.kr",nocase; classtype:trojan-activity; sid:100002380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hoagietesting10.com",nocase; classtype:trojan-activity; sid:100002381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hoayeuthuong-my.sharepoint.com",nocase; classtype:trojan-activity; sid:100002382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"holmesservices.mobiledevsite.co",nocase; classtype:trojan-activity; sid:100002383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"homefindersolutions.com",nocase; classtype:trojan-activity; sid:100002384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hongluosi.com",nocase; classtype:trojan-activity; sid:100002385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hookedupboatclub.com",nocase; classtype:trojan-activity; sid:100002386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hostingparacolombia.com",nocase; classtype:trojan-activity; sid:100002387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hostzaa.com",nocase; classtype:trojan-activity; sid:100002388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"houstonshutters.site",nocase; classtype:trojan-activity; sid:100002389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hr2019.vrcom7.com",nocase; classtype:trojan-activity; sid:100002390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hseda.com",nocase; classtype:trojan-activity; sid:100002391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hsmwebapp.com",nocase; classtype:trojan-activity; sid:100002392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"htownbars.com",nocase; classtype:trojan-activity; sid:100002393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hubtech.co.za",nocase; classtype:trojan-activity; sid:100002394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"huellacero.cl",nocase; classtype:trojan-activity; sid:100002395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hunchomusichub.com",nocase; classtype:trojan-activity; sid:100002396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hunggiang.vn",nocase; classtype:trojan-activity; sid:100002397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"husamiyahschool.com",nocase; classtype:trojan-activity; sid:100002398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iabmixx2020.rayadigital.online",nocase; classtype:trojan-activity; sid:100002399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iam313.com",nocase; classtype:trojan-activity; sid:100002400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"icon.shatangmu.cn",nocase; classtype:trojan-activity; sid:100002401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"idea-secure-login.com",nocase; classtype:trojan-activity; sid:100002402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"idilsoft.com",nocase; classtype:trojan-activity; sid:100002403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"idj.no",nocase; classtype:trojan-activity; sid:100002404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"idvindia.com",nocase; classtype:trojan-activity; sid:100002405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ieclb.com.br",nocase; classtype:trojan-activity; sid:100002406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ikexpert.com",nocase; classtype:trojan-activity; sid:100002407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ilrafrica.com",nocase; classtype:trojan-activity; sid:100002408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"images.jermiau.com",nocase; classtype:trojan-activity; sid:100002409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"imbueautoworx.co.za",nocase; classtype:trojan-activity; sid:100002410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"in-tune2016.com",nocase; classtype:trojan-activity; sid:100002411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"incrediblepixels.com",nocase; classtype:trojan-activity; sid:100002412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"incredicole.com",nocase; classtype:trojan-activity; sid:100002413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"indrasbikaner.com",nocase; classtype:trojan-activity; sid:100002414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"infair.vn",nocase; classtype:trojan-activity; sid:100002415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"infovator.com",nocase; classtype:trojan-activity; sid:100002416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"initialnetworks.com",nocase; classtype:trojan-activity; sid:100002417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"inodesthetotaldesigners.com",nocase; classtype:trojan-activity; sid:100002418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"inrajahmundry.co.in",nocase; classtype:trojan-activity; sid:100002419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"instantindialoan.com",nocase; classtype:trojan-activity; sid:100002420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"intellectsmart.in",nocase; classtype:trojan-activity; sid:100002421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"intersel-idf.org",nocase; classtype:trojan-activity; sid:100002422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"intuitiveideas.com.my",nocase; classtype:trojan-activity; sid:100002423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"inversiones.arrayanfinanciero.cl",nocase; classtype:trojan-activity; sid:100002424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"invest.xpcorporative.com.br",nocase; classtype:trojan-activity; sid:100002425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ipmes.ma",nocase; classtype:trojan-activity; sid:100002426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iremart.es",nocase; classtype:trojan-activity; sid:100002427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iris101.co.uk",nocase; classtype:trojan-activity; sid:100002428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"isaac.mikhailmotoringschool.com",nocase; classtype:trojan-activity; sid:100002429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iscamenabe.com",nocase; classtype:trojan-activity; sid:100002430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"isiphephelocon.co.za",nocase; classtype:trojan-activity; sid:100002431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ismf.com.ng",nocase; classtype:trojan-activity; sid:100002432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"iso-dubai.net",nocase; classtype:trojan-activity; sid:100002433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"israrulhaq.me",nocase; classtype:trojan-activity; sid:100002434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"isrorg.com",nocase; classtype:trojan-activity; sid:100002435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"isso.ps",nocase; classtype:trojan-activity; sid:100002436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ist-security.com",nocase; classtype:trojan-activity; sid:100002437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"it123.ru",nocase; classtype:trojan-activity; sid:100002438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"italiandirezione.casa",nocase; classtype:trojan-activity; sid:100002439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"itc-demo.softgig.co.ke",nocase; classtype:trojan-activity; sid:100002440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"itmotasaciones.com",nocase; classtype:trojan-activity; sid:100002441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jamiekaylive.com",nocase; classtype:trojan-activity; sid:100002442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jansen-heesch.nl",nocase; classtype:trojan-activity; sid:100002443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jathra.co.uk",nocase; classtype:trojan-activity; sid:100002444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jay.diamondrelationscrm.us",nocase; classtype:trojan-activity; sid:100002445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jebs.net.au",nocase; classtype:trojan-activity; sid:100002446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jeffdahlke.com",nocase; classtype:trojan-activity; sid:100002447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jiaoyuzixun.cn",nocase; classtype:trojan-activity; sid:100002448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jing-da.com.tw",nocase; classtype:trojan-activity; sid:100002449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jmtc.91756.cn",nocase; classtype:trojan-activity; sid:100002450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jnanbharati.com",nocase; classtype:trojan-activity; sid:100002451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jobs.thebeessolution.com",nocase; classtype:trojan-activity; sid:100002452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"joelbonissilver.com",nocase; classtype:trojan-activity; sid:100002453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"join.cl8movement.co.za",nocase; classtype:trojan-activity; sid:100002454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"josegene.com",nocase; classtype:trojan-activity; sid:100002455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jpwoodfordco.com",nocase; classtype:trojan-activity; sid:100002456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jumpmanualjacobhiller.com",nocase; classtype:trojan-activity; sid:100002457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jupiter.toxsl.in",nocase; classtype:trojan-activity; sid:100002458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"justinscott.com.au",nocase; classtype:trojan-activity; sid:100002459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kadigital.co.uk",nocase; classtype:trojan-activity; sid:100002460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kalawatihomes.com",nocase; classtype:trojan-activity; sid:100002461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kalogirosfinance.com",nocase; classtype:trojan-activity; sid:100002462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kaptaanchapal.com",nocase; classtype:trojan-activity; sid:100002463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"karer.by",nocase; classtype:trojan-activity; sid:100002464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"katanvetov.co.il",nocase; classtype:trojan-activity; sid:100002465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"katelynn9506a.ru.com",nocase; classtype:trojan-activity; sid:100002466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kensingtondriving.com",nocase; classtype:trojan-activity; sid:100002467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ketofitnessexpert.com",nocase; classtype:trojan-activity; sid:100002468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kevinjewelry.com.co",nocase; classtype:trojan-activity; sid:100002469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"keywatch.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kingssa.co.za",nocase; classtype:trojan-activity; sid:100002471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kizitox.ga",nocase; classtype:trojan-activity; sid:100002472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kjcpromo.com",nocase; classtype:trojan-activity; sid:100002473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kleinendeli.co.za",nocase; classtype:trojan-activity; sid:100002474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"korrectconceptservices.com",nocase; classtype:trojan-activity; sid:100002475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"krisbadminton.com",nocase; classtype:trojan-activity; sid:100002476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ktb.sch.id",nocase; classtype:trojan-activity; sid:100002477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kubatoglubaklava.com.tr",nocase; classtype:trojan-activity; sid:100002478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kumaralok.in",nocase; classtype:trojan-activity; sid:100002479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kwanfromhongkong.com",nocase; classtype:trojan-activity; sid:100002480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kz.sldov.ru",nocase; classtype:trojan-activity; sid:100002481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lacasadelosalebrijes.com",nocase; classtype:trojan-activity; sid:100002482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ladylabonde.com",nocase; classtype:trojan-activity; sid:100002483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lameguard.ru",nocase; classtype:trojan-activity; sid:100002484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"laodongnhat.vn",nocase; classtype:trojan-activity; sid:100002485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"laravel.pointersoftwares.com.br",nocase; classtype:trojan-activity; sid:100002486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lasermobilesounds.co.uk",nocase; classtype:trojan-activity; sid:100002487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lauratomismith.com",nocase; classtype:trojan-activity; sid:100002488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lautarosanmiguel.com",nocase; classtype:trojan-activity; sid:100002489; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lawforall.edu.lk",nocase; classtype:trojan-activity; sid:100002490; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lawschoolideas.xyz",nocase; classtype:trojan-activity; sid:100002491; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lceventos.net",nocase; classtype:trojan-activity; sid:100002492; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ld.mediaget.com",nocase; classtype:trojan-activity; sid:100002493; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ldgcorp.com",nocase; classtype:trojan-activity; sid:100002494; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"learning.real-academy.net",nocase; classtype:trojan-activity; sid:100002495; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"leasiacherise.com",nocase; classtype:trojan-activity; sid:100002496; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"leczkregoslup.acelero.pl",nocase; classtype:trojan-activity; sid:100002497; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"legend.nu",nocase; classtype:trojan-activity; sid:100002498; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"leluibuffet.com.br",nocase; classtype:trojan-activity; sid:100002499; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lestesteux.ca",nocase; classtype:trojan-activity; sid:100002500; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"library.arihantmbainstitute.ac.in",nocase; classtype:trojan-activity; sid:100002501; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"library.uib.ac.id",nocase; classtype:trojan-activity; sid:100002502; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lidoraggiodisole.it",nocase; classtype:trojan-activity; sid:100002503; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lifebeam.elin.co.za",nocase; classtype:trojan-activity; sid:100002504; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lindnerelektroanlagen.de",nocase; classtype:trojan-activity; sid:100002505; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"linkintec.cn",nocase; classtype:trojan-activity; sid:100002506; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"liquidaz.casa",nocase; classtype:trojan-activity; sid:100002507; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"livetrack.in",nocase; classtype:trojan-activity; sid:100002508; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lloydsindian.co.uk",nocase; classtype:trojan-activity; sid:100002509; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lm.stagingarea.co.za",nocase; classtype:trojan-activity; sid:100002510; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lmaancha.co.il",nocase; classtype:trojan-activity; sid:100002511; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lms.cstdevs.com",nocase; classtype:trojan-activity; sid:100002512; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lms.login2.in",nocase; classtype:trojan-activity; sid:100002513; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"location-voitures.ma",nocase; classtype:trojan-activity; sid:100002514; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"login.trezor.com.stockfootagesindia.com",nocase; classtype:trojan-activity; sid:100002515; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"logotypfabriken.se",nocase; classtype:trojan-activity; sid:100002516; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lotix.de",nocase; classtype:trojan-activity; sid:100002517; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lotusanddragonfly.com",nocase; classtype:trojan-activity; sid:100002518; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lp.definerisco.com",nocase; classtype:trojan-activity; sid:100002519; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lp.difusodesign.com",nocase; classtype:trojan-activity; sid:100002520; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ltc.typoten.com",nocase; classtype:trojan-activity; sid:100002521; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"luckybrownie.com",nocase; classtype:trojan-activity; sid:100002522; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"luminouspneuma.com",nocase; classtype:trojan-activity; sid:100002523; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"luxomodels.com",nocase; classtype:trojan-activity; sid:100002524; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"m-technics.kz",nocase; classtype:trojan-activity; sid:100002525; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"m.estudiomoros.com.ar",nocase; classtype:trojan-activity; sid:100002526; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"m.softsharks.com",nocase; classtype:trojan-activity; sid:100002527; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"madicon.co.za",nocase; classtype:trojan-activity; sid:100002528; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"magianegramagiablancayamarres.com",nocase; classtype:trojan-activity; sid:100002529; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mail.bs-eiendomme.co.za",nocase; classtype:trojan-activity; sid:100002530; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mail.golimoapp.com",nocase; classtype:trojan-activity; sid:100002531; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mail.jeffsono.org",nocase; classtype:trojan-activity; sid:100002532; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"maksi.feb.unib.ac.id",nocase; classtype:trojan-activity; sid:100002533; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"malaya.tv",nocase; classtype:trojan-activity; sid:100002534; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"malwarecoding.github.io",nocase; classtype:trojan-activity; sid:100002535; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"managed.oss-cn-beijing.aliyuncs.com",nocase; classtype:trojan-activity; sid:100002536; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"managemysalon.in",nocase; classtype:trojan-activity; sid:100002537; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"manantialesdelnorte.uy",nocase; classtype:trojan-activity; sid:100002538; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"manhtien.net",nocase; classtype:trojan-activity; sid:100002539; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mario-sunjic.com",nocase; classtype:trojan-activity; sid:100002540; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mariobrown.net",nocase; classtype:trojan-activity; sid:100002541; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mariotessarollo.com",nocase; classtype:trojan-activity; sid:100002542; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"marketinfosales.com",nocase; classtype:trojan-activity; sid:100002543; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"marketing.enexusgroup.com.au",nocase; classtype:trojan-activity; sid:100002544; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"marksidfgs.ug",nocase; classtype:trojan-activity; sid:100002545; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"masjidhabeebiyarazviya.mysunni.com",nocase; classtype:trojan-activity; sid:100002546; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mastersofclientretention.com.au",nocase; classtype:trojan-activity; sid:100002547; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"materialescantu.com",nocase; classtype:trojan-activity; sid:100002548; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"matruchhaya.co.in",nocase; classtype:trojan-activity; sid:100002549; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"maxiquim.cl",nocase; classtype:trojan-activity; sid:100002550; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"maxtox.com.pk",nocase; classtype:trojan-activity; sid:100002551; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mbgrm.com",nocase; classtype:trojan-activity; sid:100002552; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mbjtimes.com",nocase; classtype:trojan-activity; sid:100002553; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mbsolutions.ge",nocase; classtype:trojan-activity; sid:100002554; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mbx.com.au",nocase; classtype:trojan-activity; sid:100002555; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mdasa.elin.co.za",nocase; classtype:trojan-activity; sid:100002556; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"medevlb.org",nocase; classtype:trojan-activity; sid:100002557; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"media-server.skyinternet.com.pk",nocase; classtype:trojan-activity; sid:100002558; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"medianews.ge",nocase; classtype:trojan-activity; sid:100002559; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mediawaysnews.com",nocase; classtype:trojan-activity; sid:100002560; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"medistaffconsulting.com",nocase; classtype:trojan-activity; sid:100002561; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"meeweb.com",nocase; classtype:trojan-activity; sid:100002562; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"megagynreformas.com.br",nocase; classtype:trojan-activity; sid:100002563; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"megamart.afnan-amc.com",nocase; classtype:trojan-activity; sid:100002564; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mehainteriors.com",nocase; classtype:trojan-activity; sid:100002565; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mercabits.com",nocase; classtype:trojan-activity; sid:100002566; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"merkathink.com",nocase; classtype:trojan-activity; sid:100002567; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mertlog.com",nocase; classtype:trojan-activity; sid:100002568; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"metalin-cr.com",nocase; classtype:trojan-activity; sid:100002569; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mettaanand.org",nocase; classtype:trojan-activity; sid:100002570; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"meuoculosnanet.com.br",nocase; classtype:trojan-activity; sid:100002571; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mfevr.com",nocase; classtype:trojan-activity; sid:100002572; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mhkdhotbot.myvnc.com",nocase; classtype:trojan-activity; sid:100002573; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mhkdhotbot80.myvnc.com",nocase; classtype:trojan-activity; sid:100002574; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"micalle.com.au",nocase; classtype:trojan-activity; sid:100002575; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"michaelphilip.com",nocase; classtype:trojan-activity; sid:100002576; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"michimal2.000webhostapp.com",nocase; classtype:trojan-activity; sid:100002577; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"microblading.mirliandias.com.br",nocase; classtype:trojan-activity; sid:100002578; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"microcomm-group.com",nocase; classtype:trojan-activity; sid:100002579; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mikhailmotoringschool.com",nocase; classtype:trojan-activity; sid:100002580; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mills-skyla30ec.com",nocase; classtype:trojan-activity; sid:100002581; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mingguanwms.com",nocase; classtype:trojan-activity; sid:100002582; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"minuevavida.org",nocase; classtype:trojan-activity; sid:100002583; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mirror.mypage.sk",nocase; classtype:trojan-activity; sid:100002584; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mis.nbcc.ac.th",nocase; classtype:trojan-activity; sid:100002585; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"misterson.com",nocase; classtype:trojan-activity; sid:100002586; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mkontakt.az",nocase; classtype:trojan-activity; sid:100002587; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mktf.mx",nocase; classtype:trojan-activity; sid:100002588; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mmogollon.com.mx",nocase; classtype:trojan-activity; sid:100002589; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"mncarteam.com",nocase; classtype:trojan-activity; sid:100002590; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"modelhouseturkey.com",nocase; classtype:trojan-activity; sid:100002591; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"modernmanna.org",nocase; classtype:trojan-activity; sid:100002592; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"monetization.business",nocase; classtype:trojan-activity; sid:100002593; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"moninediy.com",nocase; classtype:trojan-activity; sid:100002594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"motorcomunicacion.com",nocase; classtype:trojan-activity; sid:100002595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"moumitas.com",nocase; classtype:trojan-activity; sid:100002596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"msacontabil.com.br",nocase; classtype:trojan-activity; sid:100002597; rev:1;) @@ -2616,7 +2616,7 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nap.mgsservers.com",nocase; classtype:trojan-activity; sid:100002610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"navayurveda.in",nocase; classtype:trojan-activity; sid:100002611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nec-i.com",nocase; classtype:trojan-activity; sid:100002612; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nellaimasthanbiryani.com",nocase; classtype:trojan-activity; sid:100002613; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nelitrianggraeni.000webhostapp.com",nocase; classtype:trojan-activity; sid:100002613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nerve.untergrund.net",nocase; classtype:trojan-activity; sid:100002614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nettube.com.br",nocase; classtype:trojan-activity; sid:100002615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"networkwheels.co.za",nocase; classtype:trojan-activity; sid:100002616; rev:1;) @@ -2635,134 +2635,134 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nilinkeji.com",nocase; classtype:trojan-activity; sid:100002629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nimboohomes.com",nocase; classtype:trojan-activity; sid:100002630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"njtiledesigncenter.com",nocase; classtype:trojan-activity; sid:100002631; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nobius.org",nocase; classtype:trojan-activity; sid:100002632; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nocalnoodle.elin.co.za",nocase; classtype:trojan-activity; sid:100002633; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nomadicbees.com",nocase; classtype:trojan-activity; sid:100002634; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"northnodegroup.com.au",nocase; classtype:trojan-activity; sid:100002635; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"notamuzikaletleri.com",nocase; classtype:trojan-activity; sid:100002636; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ns1.the-widyantos.com",nocase; classtype:trojan-activity; sid:100002637; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nsb.org.uk",nocase; classtype:trojan-activity; sid:100002638; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nurmarkaz.org",nocase; classtype:trojan-activity; sid:100002639; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nxtnet.ga",nocase; classtype:trojan-activity; sid:100002640; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nyasabigbullets.com",nocase; classtype:trojan-activity; sid:100002641; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nyeh2o.com.au",nocase; classtype:trojan-activity; sid:100002642; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"obseques-conseils.com",nocase; classtype:trojan-activity; sid:100002643; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oecteam.com",nocase; classtype:trojan-activity; sid:100002644; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ohsewgorgeous.co.uk",nocase; classtype:trojan-activity; sid:100002645; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oknoplastik.sk",nocase; classtype:trojan-activity; sid:100002646; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oleholeh.memangbeda.website",nocase; classtype:trojan-activity; sid:100002647; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"omaia.org",nocase; classtype:trojan-activity; sid:100002648; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"omaromatic.com",nocase; classtype:trojan-activity; sid:100002649; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"omega.az",nocase; classtype:trojan-activity; sid:100002650; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oms.pappai.com",nocase; classtype:trojan-activity; sid:100002651; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"omscoc.pappai.com",nocase; classtype:trojan-activity; sid:100002652; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedigitalcard.granvizionnecorp.com",nocase; classtype:trojan-activity; sid:100002653; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.listifyapp.co",nocase; classtype:trojan-activity; sid:100002654; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"online.creedglobal.in",nocase; classtype:trojan-activity; sid:100002655; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onlinestatis.bar",nocase; classtype:trojan-activity; sid:100002656; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"open.warehousesaas.co.uk",nocase; classtype:trojan-activity; sid:100002657; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"opolis.io",nocase; classtype:trojan-activity; sid:100002658; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"opticaoptigral.cl",nocase; classtype:trojan-activity; sid:100002659; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"optimus.com.sg",nocase; classtype:trojan-activity; sid:100002660; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"order.bizpeed.com",nocase; classtype:trojan-activity; sid:100002661; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"orientgatewayltd.com",nocase; classtype:trojan-activity; sid:100002662; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"orion445.com",nocase; classtype:trojan-activity; sid:100002663; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oserve.pk",nocase; classtype:trojan-activity; sid:100002664; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ot.weenets.com",nocase; classtype:trojan-activity; sid:100002665; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"outletdosaquecedores.com.br",nocase; classtype:trojan-activity; sid:100002666; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ozemag.com",nocase; classtype:trojan-activity; sid:100002667; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"p1.lingpao8.com",nocase; classtype:trojan-activity; sid:100002668; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"p3.zbjimg.com",nocase; classtype:trojan-activity; sid:100002669; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"p6.zbjimg.com",nocase; classtype:trojan-activity; sid:100002670; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pablobrothel.com.ar",nocase; classtype:trojan-activity; sid:100002671; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pacificgroup.ws",nocase; classtype:trojan-activity; sid:100002672; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pacwebdesigns.com",nocase; classtype:trojan-activity; sid:100002673; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pagos.krayem.com.mx",nocase; classtype:trojan-activity; sid:100002674; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"palbas.cl",nocase; classtype:trojan-activity; sid:100002675; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"palochusvet.szm.com",nocase; classtype:trojan-activity; sid:100002676; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"parallel.rockvideos.at",nocase; classtype:trojan-activity; sid:100002677; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"parejasfelices.mi-fs.com",nocase; classtype:trojan-activity; sid:100002678; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"parkhussion.com",nocase; classtype:trojan-activity; sid:100002679; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pastorpaulocosta.com",nocase; classtype:trojan-activity; sid:100002680; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"patch2.51lg.com",nocase; classtype:trojan-activity; sid:100002681; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"patch2.99ddd.com",nocase; classtype:trojan-activity; sid:100002682; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"patch3.99ddd.com",nocase; classtype:trojan-activity; sid:100002683; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"paths.elin.co.za",nocase; classtype:trojan-activity; sid:100002684; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"patriotsupremehemp.com",nocase; classtype:trojan-activity; sid:100002685; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"paulmercier.biz",nocase; classtype:trojan-activity; sid:100002686; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"payerrealty.com",nocase; classtype:trojan-activity; sid:100002687; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"payments.atifsiddiqui.me",nocase; classtype:trojan-activity; sid:100002688; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pcsoori.com",nocase; classtype:trojan-activity; sid:100002689; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pd.oceaniarp.net",nocase; classtype:trojan-activity; sid:100002690; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pemdodo.com",nocase; classtype:trojan-activity; sid:100002691; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"perfumeriamontes.es",nocase; classtype:trojan-activity; sid:100002692; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"periodiche.bar",nocase; classtype:trojan-activity; sid:100002693; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"perpus.onlineman7-jombang.sch.id",nocase; classtype:trojan-activity; sid:100002694; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"perpustekim.untirta.ac.id",nocase; classtype:trojan-activity; sid:100002695; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pestoclean.co.uk",nocase; classtype:trojan-activity; sid:100002696; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"petercollie.com",nocase; classtype:trojan-activity; sid:100002697; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ph4s.ru",nocase; classtype:trojan-activity; sid:100002698; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"phasdesign.com",nocase; classtype:trojan-activity; sid:100002699; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"phenhuong.sanpham.online",nocase; classtype:trojan-activity; sid:100002700; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"phittc.com",nocase; classtype:trojan-activity; sid:100002701; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"photo360.kubooking.com",nocase; classtype:trojan-activity; sid:100002702; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pink99.com",nocase; classtype:trojan-activity; sid:100002703; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"plasfan.ind.br",nocase; classtype:trojan-activity; sid:100002704; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"playground2.grupoaliadasca.com",nocase; classtype:trojan-activity; sid:100002705; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pmglance.startwriteup.com",nocase; classtype:trojan-activity; sid:100002706; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pokojewewladyslawowie.pl",nocase; classtype:trojan-activity; sid:100002707; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pole.com.vc",nocase; classtype:trojan-activity; sid:100002708; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pool.phxdir.com",nocase; classtype:trojan-activity; sid:100002709; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pooltablemoversdenver.net",nocase; classtype:trojan-activity; sid:100002710; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"posmicrosystems.com",nocase; classtype:trojan-activity; sid:100002711; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"poulman.panagiotopoulos-tours.gr",nocase; classtype:trojan-activity; sid:100002712; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ppdb.smk-ciptaskill.sch.id",nocase; classtype:trojan-activity; sid:100002713; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prestasicash.com.ar",nocase; classtype:trojan-activity; sid:100002714; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prestigehomeautomation.net",nocase; classtype:trojan-activity; sid:100002715; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"preview2.behalen.com",nocase; classtype:trojan-activity; sid:100002716; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prishaartcreations.com",nocase; classtype:trojan-activity; sid:100002717; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"production.sparshims.com",nocase; classtype:trojan-activity; sid:100002718; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"programaoperadoronline.com.br",nocase; classtype:trojan-activity; sid:100002719; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"project.exquitec.com",nocase; classtype:trojan-activity; sid:100002720; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"promotoradescomplica.com.br",nocase; classtype:trojan-activity; sid:100002721; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"promoversdubai.com",nocase; classtype:trojan-activity; sid:100002722; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"propertiq.elin.co.za",nocase; classtype:trojan-activity; sid:100002723; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"propertiq2.elin.co.za",nocase; classtype:trojan-activity; sid:100002724; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prosoc.nl",nocase; classtype:trojan-activity; sid:100002725; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prosupport.cl",nocase; classtype:trojan-activity; sid:100002726; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prosyarmakassar.com",nocase; classtype:trojan-activity; sid:100002727; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"provence.elin.co.za",nocase; classtype:trojan-activity; sid:100002728; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prox.realunix.cc",nocase; classtype:trojan-activity; sid:100002729; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prueba.danielluza.com",nocase; classtype:trojan-activity; sid:100002730; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pujashoppe.in",nocase; classtype:trojan-activity; sid:100002731; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"punchdialogues.com",nocase; classtype:trojan-activity; sid:100002732; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"punjabdevelopersassociation.com.pk",nocase; classtype:trojan-activity; sid:100002733; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pvcprinting.co.uk",nocase; classtype:trojan-activity; sid:100002734; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"qadir.tickfa.ir",nocase; classtype:trojan-activity; sid:100002735; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"qatarglobalconsulting.com",nocase; classtype:trojan-activity; sid:100002736; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"qmsled.com",nocase; classtype:trojan-activity; sid:100002737; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"quartier-midi.be",nocase; classtype:trojan-activity; sid:100002738; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"querocar.com",nocase; classtype:trojan-activity; sid:100002739; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rachmat-assuhaimi.my.id",nocase; classtype:trojan-activity; sid:100002740; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"radioafifense.deploys.live",nocase; classtype:trojan-activity; sid:100002741; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rainbowisp.info",nocase; classtype:trojan-activity; sid:100002742; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rajeshtailang.com",nocase; classtype:trojan-activity; sid:100002743; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rakeshkhatri.in",nocase; classtype:trojan-activity; sid:100002744; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raodigitalmedia.com",nocase; classtype:trojan-activity; sid:100002745; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raquelhelena.com.br",nocase; classtype:trojan-activity; sid:100002746; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rarlabarchiver.ac",nocase; classtype:trojan-activity; sid:100002747; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rasadbar.ir",nocase; classtype:trojan-activity; sid:100002748; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rashika.ascarvalho.co.za",nocase; classtype:trojan-activity; sid:100002749; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ratemyfenancialadvisor.com",nocase; classtype:trojan-activity; sid:100002750; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ravenproductionsltd.com",nocase; classtype:trojan-activity; sid:100002751; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rc.ixiaoyang.cn",nocase; classtype:trojan-activity; sid:100002752; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rcmesilva.charbelsales.com.br",nocase; classtype:trojan-activity; sid:100002753; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"reacredit.com.br",nocase; classtype:trojan-activity; sid:100002754; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"readwrite26.nl",nocase; classtype:trojan-activity; sid:100002755; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"readymmade.com",nocase; classtype:trojan-activity; sid:100002756; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"recyclethesurplus.com",nocase; classtype:trojan-activity; sid:100002757; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"redbats.co.in",nocase; classtype:trojan-activity; sid:100002758; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"redboxmultimedia.com",nocase; classtype:trojan-activity; sid:100002759; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nmxwllwsdyminoragenw.dns.army",nocase; classtype:trojan-activity; sid:100002632; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nobius.org",nocase; classtype:trojan-activity; sid:100002633; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nocalnoodle.elin.co.za",nocase; classtype:trojan-activity; sid:100002634; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nomadicbees.com",nocase; classtype:trojan-activity; sid:100002635; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"northnodegroup.com.au",nocase; classtype:trojan-activity; sid:100002636; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"notamuzikaletleri.com",nocase; classtype:trojan-activity; sid:100002637; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ns1.the-widyantos.com",nocase; classtype:trojan-activity; sid:100002638; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nsb.org.uk",nocase; classtype:trojan-activity; sid:100002639; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nurmarkaz.org",nocase; classtype:trojan-activity; sid:100002640; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nxtnet.ga",nocase; classtype:trojan-activity; sid:100002641; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nyasabigbullets.com",nocase; classtype:trojan-activity; sid:100002642; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nyeh2o.com.au",nocase; classtype:trojan-activity; sid:100002643; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"obseques-conseils.com",nocase; classtype:trojan-activity; sid:100002644; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oecteam.com",nocase; classtype:trojan-activity; sid:100002645; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ohe.ie",nocase; classtype:trojan-activity; sid:100002646; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ohsewgorgeous.co.uk",nocase; classtype:trojan-activity; sid:100002647; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oknoplastik.sk",nocase; classtype:trojan-activity; sid:100002648; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oleholeh.memangbeda.website",nocase; classtype:trojan-activity; sid:100002649; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"omaia.org",nocase; classtype:trojan-activity; sid:100002650; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"omaromatic.com",nocase; classtype:trojan-activity; sid:100002651; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"omega.az",nocase; classtype:trojan-activity; sid:100002652; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oms.pappai.com",nocase; classtype:trojan-activity; sid:100002653; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"omscoc.pappai.com",nocase; classtype:trojan-activity; sid:100002654; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedigitalcard.granvizionnecorp.com",nocase; classtype:trojan-activity; sid:100002655; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.listifyapp.co",nocase; classtype:trojan-activity; sid:100002656; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"online.creedglobal.in",nocase; classtype:trojan-activity; sid:100002657; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onlinestatis.bar",nocase; classtype:trojan-activity; sid:100002658; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"open.warehousesaas.co.uk",nocase; classtype:trojan-activity; sid:100002659; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"opolis.io",nocase; classtype:trojan-activity; sid:100002660; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"opticaoptigral.cl",nocase; classtype:trojan-activity; sid:100002661; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"optimus.com.sg",nocase; classtype:trojan-activity; sid:100002662; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"order.bizpeed.com",nocase; classtype:trojan-activity; sid:100002663; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"orientgatewayltd.com",nocase; classtype:trojan-activity; sid:100002664; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"orion445.com",nocase; classtype:trojan-activity; sid:100002665; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oserve.pk",nocase; classtype:trojan-activity; sid:100002666; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ot.weenets.com",nocase; classtype:trojan-activity; sid:100002667; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"outletdosaquecedores.com.br",nocase; classtype:trojan-activity; sid:100002668; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ozemag.com",nocase; classtype:trojan-activity; sid:100002669; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"p1.lingpao8.com",nocase; classtype:trojan-activity; sid:100002670; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"p3.zbjimg.com",nocase; classtype:trojan-activity; sid:100002671; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"p6.zbjimg.com",nocase; classtype:trojan-activity; sid:100002672; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pablobrothel.com.ar",nocase; classtype:trojan-activity; sid:100002673; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pacificgroup.ws",nocase; classtype:trojan-activity; sid:100002674; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pacwebdesigns.com",nocase; classtype:trojan-activity; sid:100002675; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pagos.krayem.com.mx",nocase; classtype:trojan-activity; sid:100002676; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"palbas.cl",nocase; classtype:trojan-activity; sid:100002677; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"palochusvet.szm.com",nocase; classtype:trojan-activity; sid:100002678; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"panslimiterd.com",nocase; classtype:trojan-activity; sid:100002679; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"parallel.rockvideos.at",nocase; classtype:trojan-activity; sid:100002680; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"parejasfelices.mi-fs.com",nocase; classtype:trojan-activity; sid:100002681; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"parkhussion.com",nocase; classtype:trojan-activity; sid:100002682; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pastorpaulocosta.com",nocase; classtype:trojan-activity; sid:100002683; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"patch2.51lg.com",nocase; classtype:trojan-activity; sid:100002684; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"patch2.99ddd.com",nocase; classtype:trojan-activity; sid:100002685; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"patch3.99ddd.com",nocase; classtype:trojan-activity; sid:100002686; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"paths.elin.co.za",nocase; classtype:trojan-activity; sid:100002687; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"patriotsupremehemp.com",nocase; classtype:trojan-activity; sid:100002688; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"paulmercier.biz",nocase; classtype:trojan-activity; sid:100002689; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"payerrealty.com",nocase; classtype:trojan-activity; sid:100002690; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"payments.atifsiddiqui.me",nocase; classtype:trojan-activity; sid:100002691; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pcsoori.com",nocase; classtype:trojan-activity; sid:100002692; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pd.oceaniarp.net",nocase; classtype:trojan-activity; sid:100002693; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pemdodo.com",nocase; classtype:trojan-activity; sid:100002694; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"perfumeriamontes.es",nocase; classtype:trojan-activity; sid:100002695; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"periodiche.bar",nocase; classtype:trojan-activity; sid:100002696; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"perpus.onlineman7-jombang.sch.id",nocase; classtype:trojan-activity; sid:100002697; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"perpustekim.untirta.ac.id",nocase; classtype:trojan-activity; sid:100002698; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pestoclean.co.uk",nocase; classtype:trojan-activity; sid:100002699; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"petercollie.com",nocase; classtype:trojan-activity; sid:100002700; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ph4s.ru",nocase; classtype:trojan-activity; sid:100002701; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"phasdesign.com",nocase; classtype:trojan-activity; sid:100002702; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"phenhuong.sanpham.online",nocase; classtype:trojan-activity; sid:100002703; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"phittc.com",nocase; classtype:trojan-activity; sid:100002704; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"photo360.kubooking.com",nocase; classtype:trojan-activity; sid:100002705; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pink99.com",nocase; classtype:trojan-activity; sid:100002706; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"plasfan.ind.br",nocase; classtype:trojan-activity; sid:100002707; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"playground2.grupoaliadasca.com",nocase; classtype:trojan-activity; sid:100002708; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pmglance.startwriteup.com",nocase; classtype:trojan-activity; sid:100002709; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pmrimewsdylimtewsogh.dns.army",nocase; classtype:trojan-activity; sid:100002710; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pokojewewladyslawowie.pl",nocase; classtype:trojan-activity; sid:100002711; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pole.com.vc",nocase; classtype:trojan-activity; sid:100002712; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pool.phxdir.com",nocase; classtype:trojan-activity; sid:100002713; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pooltablemoversdenver.net",nocase; classtype:trojan-activity; sid:100002714; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"posmicrosystems.com",nocase; classtype:trojan-activity; sid:100002715; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"poulman.panagiotopoulos-tours.gr",nocase; classtype:trojan-activity; sid:100002716; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ppdb.smk-ciptaskill.sch.id",nocase; classtype:trojan-activity; sid:100002717; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prestasicash.com.ar",nocase; classtype:trojan-activity; sid:100002718; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prestigehomeautomation.net",nocase; classtype:trojan-activity; sid:100002719; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"preview2.behalen.com",nocase; classtype:trojan-activity; sid:100002720; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prishaartcreations.com",nocase; classtype:trojan-activity; sid:100002721; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"production.sparshims.com",nocase; classtype:trojan-activity; sid:100002722; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"programaoperadoronline.com.br",nocase; classtype:trojan-activity; sid:100002723; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"promotoradescomplica.com.br",nocase; classtype:trojan-activity; sid:100002724; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"promoversdubai.com",nocase; classtype:trojan-activity; sid:100002725; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"propertiq.elin.co.za",nocase; classtype:trojan-activity; sid:100002726; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"propertiq2.elin.co.za",nocase; classtype:trojan-activity; sid:100002727; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prosoc.nl",nocase; classtype:trojan-activity; sid:100002728; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prosupport.cl",nocase; classtype:trojan-activity; sid:100002729; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prosyarmakassar.com",nocase; classtype:trojan-activity; sid:100002730; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"provence.elin.co.za",nocase; classtype:trojan-activity; sid:100002731; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"prox.realunix.cc",nocase; classtype:trojan-activity; sid:100002732; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pujashoppe.in",nocase; classtype:trojan-activity; sid:100002733; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"punchdialogues.com",nocase; classtype:trojan-activity; sid:100002734; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"punjabdevelopersassociation.com.pk",nocase; classtype:trojan-activity; sid:100002735; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pvcprinting.co.uk",nocase; classtype:trojan-activity; sid:100002736; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"qadir.tickfa.ir",nocase; classtype:trojan-activity; sid:100002737; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"qatarglobalconsulting.com",nocase; classtype:trojan-activity; sid:100002738; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"qmsled.com",nocase; classtype:trojan-activity; sid:100002739; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"quartier-midi.be",nocase; classtype:trojan-activity; sid:100002740; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"querocar.com",nocase; classtype:trojan-activity; sid:100002741; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rachmat-assuhaimi.my.id",nocase; classtype:trojan-activity; sid:100002742; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"radioafifense.deploys.live",nocase; classtype:trojan-activity; sid:100002743; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rainbowisp.info",nocase; classtype:trojan-activity; sid:100002744; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rajeshtailang.com",nocase; classtype:trojan-activity; sid:100002745; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rakeshkhatri.in",nocase; classtype:trojan-activity; sid:100002746; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raquelhelena.com.br",nocase; classtype:trojan-activity; sid:100002747; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rarlabarchiver.ac",nocase; classtype:trojan-activity; sid:100002748; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rasadbar.ir",nocase; classtype:trojan-activity; sid:100002749; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rashika.ascarvalho.co.za",nocase; classtype:trojan-activity; sid:100002750; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ratemyfenancialadvisor.com",nocase; classtype:trojan-activity; sid:100002751; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ravenproductionsltd.com",nocase; classtype:trojan-activity; sid:100002752; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rc.ixiaoyang.cn",nocase; classtype:trojan-activity; sid:100002753; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"rcmesilva.charbelsales.com.br",nocase; classtype:trojan-activity; sid:100002754; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"reacredit.com.br",nocase; classtype:trojan-activity; sid:100002755; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"readwrite26.nl",nocase; classtype:trojan-activity; sid:100002756; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"readymmade.com",nocase; classtype:trojan-activity; sid:100002757; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"recyclethesurplus.com",nocase; classtype:trojan-activity; sid:100002758; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"redbats.co.in",nocase; classtype:trojan-activity; sid:100002759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"redchillicrackers.com",nocase; classtype:trojan-activity; sid:100002760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"reifenquick.de",nocase; classtype:trojan-activity; sid:100002761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"relaxindulge.co.nz",nocase; classtype:trojan-activity; sid:100002762; rev:1;) @@ -2846,145 +2846,145 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sibernetix.fr",nocase; classtype:trojan-activity; sid:100002840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sigapresschennai.com",nocase; classtype:trojan-activity; sid:100002841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sige.brisainformatica.com.br",nocase; classtype:trojan-activity; sid:100002842; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"signatureads.co.in",nocase; classtype:trojan-activity; sid:100002843; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"siili.net",nocase; classtype:trojan-activity; sid:100002844; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"simoneporzi.it",nocase; classtype:trojan-activity; sid:100002845; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"simorsint.com",nocase; classtype:trojan-activity; sid:100002846; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"simplithy.co.uk",nocase; classtype:trojan-activity; sid:100002847; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sindicato1ucm.cl",nocase; classtype:trojan-activity; sid:100002848; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sindpol.tiejuris.com.br",nocase; classtype:trojan-activity; sid:100002849; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sipahielektrik.com",nocase; classtype:trojan-activity; sid:100002850; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sistelligent.com",nocase; classtype:trojan-activity; sid:100002851; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"skare.net",nocase; classtype:trojan-activity; sid:100002852; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"skyflyfares.com",nocase; classtype:trojan-activity; sid:100002853; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"skyscan.com",nocase; classtype:trojan-activity; sid:100002854; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"slot0.gamoruz.com",nocase; classtype:trojan-activity; sid:100002855; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"smarthouseforum.ru",nocase; classtype:trojan-activity; sid:100002856; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"smartzedu.com",nocase; classtype:trojan-activity; sid:100002857; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"smokesolutionindia.com",nocase; classtype:trojan-activity; sid:100002858; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"smritiphotography.in",nocase; classtype:trojan-activity; sid:100002859; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sobariko.com",nocase; classtype:trojan-activity; sid:100002860; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sobethuacademy.com",nocase; classtype:trojan-activity; sid:100002861; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"soft.110route.com",nocase; classtype:trojan-activity; sid:100002862; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"soft.officelabo.net",nocase; classtype:trojan-activity; sid:100002863; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"softanis.net",nocase; classtype:trojan-activity; sid:100002864; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sogecoenergy.com",nocase; classtype:trojan-activity; sid:100002865; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sohs.conceptechs.info",nocase; classtype:trojan-activity; sid:100002866; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"solar.amazingtribe.lk",nocase; classtype:trojan-activity; sid:100002867; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"somcorbera.cat",nocase; classtype:trojan-activity; sid:100002868; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"somir.com.mx",nocase; classtype:trojan-activity; sid:100002869; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"soralapps.com",nocase; classtype:trojan-activity; sid:100002870; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sota-france.fr",nocase; classtype:trojan-activity; sid:100002871; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"space.proactint.org",nocase; classtype:trojan-activity; sid:100002872; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spaceframe.mobi.space-frame.co.za",nocase; classtype:trojan-activity; sid:100002873; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"special-key.cf",nocase; classtype:trojan-activity; sid:100002874; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spent.com.pl",nocase; classtype:trojan-activity; sid:100002875; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spetsesyachtcharter.gr",nocase; classtype:trojan-activity; sid:100002876; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spititourism.com",nocase; classtype:trojan-activity; sid:100002877; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spittinfire.com",nocase; classtype:trojan-activity; sid:100002878; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"springbedspetroleum.com",nocase; classtype:trojan-activity; sid:100002879; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"src1.minibai.com",nocase; classtype:trojan-activity; sid:100002880; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sreenivasapaintingworks.com",nocase; classtype:trojan-activity; sid:100002881; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sriglobalit.com",nocase; classtype:trojan-activity; sid:100002882; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"srilankamovies.com",nocase; classtype:trojan-activity; sid:100002883; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"srvmanos.no-ip.info",nocase; classtype:trojan-activity; sid:100002884; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ss.monita.co.id",nocase; classtype:trojan-activity; sid:100002885; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"st.devcodin.com",nocase; classtype:trojan-activity; sid:100002886; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"staging.apparelpunch.com",nocase; classtype:trojan-activity; sid:100002887; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"starcountry.net",nocase; classtype:trojan-activity; sid:100002888; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"static.3001.net",nocase; classtype:trojan-activity; sid:100002889; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stiau.iuc.ac",nocase; classtype:trojan-activity; sid:100002890; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sticker.jewsjuice.com",nocase; classtype:trojan-activity; sid:100002891; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stiedemann-alvah30hq.ru.com",nocase; classtype:trojan-activity; sid:100002892; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stiepancasetia.ac.id",nocase; classtype:trojan-activity; sid:100002893; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"store.ericalgarin.com",nocase; classtype:trojan-activity; sid:100002894; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stott-thompson.co.uk",nocase; classtype:trojan-activity; sid:100002895; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stratexec.co.za",nocase; classtype:trojan-activity; sid:100002896; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"streetdemo.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002897; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"suboldesign.com",nocase; classtype:trojan-activity; sid:100002898; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sumerians.org",nocase; classtype:trojan-activity; sid:100002899; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sunaryem.com.tr",nocase; classtype:trojan-activity; sid:100002900; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sunbrero.com.au",nocase; classtype:trojan-activity; sid:100002901; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sunmarkholidays.com",nocase; classtype:trojan-activity; sid:100002902; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"support-4-free.com",nocase; classtype:trojan-activity; sid:100002903; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"support.clz.kr",nocase; classtype:trojan-activity; sid:100002904; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"supportit.online",nocase; classtype:trojan-activity; sid:100002905; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sw.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002906; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sweaty.dk",nocase; classtype:trojan-activity; sid:100002907; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sweet-diet.com",nocase; classtype:trojan-activity; sid:100002908; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"swiftlogisticseg.com",nocase; classtype:trojan-activity; sid:100002909; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"swwbia.com",nocase; classtype:trojan-activity; sid:100002910; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"syracusecoffee.com",nocase; classtype:trojan-activity; sid:100002911; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sytraders.co",nocase; classtype:trojan-activity; sid:100002912; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"t.honker.info",nocase; classtype:trojan-activity; sid:100002913; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"t.netcatkit.com",nocase; classtype:trojan-activity; sid:100002914; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tacticohosting.com",nocase; classtype:trojan-activity; sid:100002915; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tadoo.ca",nocase; classtype:trojan-activity; sid:100002916; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tafsantoursandtravels.com",nocase; classtype:trojan-activity; sid:100002917; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tajushariya.com",nocase; classtype:trojan-activity; sid:100002918; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tallyinvoicecustomization.com",nocase; classtype:trojan-activity; sid:100002919; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"taltus.co.uk",nocase; classtype:trojan-activity; sid:100002920; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tapalkoedacoffee.com",nocase; classtype:trojan-activity; sid:100002921; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tarravalleyfoods.com.au",nocase; classtype:trojan-activity; sid:100002922; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tavo.cl",nocase; classtype:trojan-activity; sid:100002923; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tc.snpsresidential.com",nocase; classtype:trojan-activity; sid:100002924; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tcy.198424.com",nocase; classtype:trojan-activity; sid:100002925; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tdsp.yngw518.com",nocase; classtype:trojan-activity; sid:100002926; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"techgms.com",nocase; classtype:trojan-activity; sid:100002927; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"teduae.com",nocase; classtype:trojan-activity; sid:100002928; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"teleargentina.com",nocase; classtype:trojan-activity; sid:100002929; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"telescopelms.com",nocase; classtype:trojan-activity; sid:100002930; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"temptmag.com",nocase; classtype:trojan-activity; sid:100002931; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tencoconsulting.com",nocase; classtype:trojan-activity; sid:100002932; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"teneth.co.za",nocase; classtype:trojan-activity; sid:100002933; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tentandoserfitness.000webhostapp.com",nocase; classtype:trojan-activity; sid:100002934; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tessrobins.com",nocase; classtype:trojan-activity; sid:100002935; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.adventser.com",nocase; classtype:trojan-activity; sid:100002936; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.letraele.es",nocase; classtype:trojan-activity; sid:100002937; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.lubrico.in",nocase; classtype:trojan-activity; sid:100002938; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.typoten.com",nocase; classtype:trojan-activity; sid:100002939; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.wanepghana.org",nocase; classtype:trojan-activity; sid:100002940; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test1.asistencia247.com",nocase; classtype:trojan-activity; sid:100002941; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test1.milenial.id",nocase; classtype:trojan-activity; sid:100002942; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test1.tenplusone.my",nocase; classtype:trojan-activity; sid:100002943; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test2.basis-web.com",nocase; classtype:trojan-activity; sid:100002944; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test2.marrenconstruction.ie",nocase; classtype:trojan-activity; sid:100002945; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"testing.clickitsolutionsmw.com",nocase; classtype:trojan-activity; sid:100002946; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"testing.thinkingcorp.in",nocase; classtype:trojan-activity; sid:100002947; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"testnew.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002948; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"teteaffiche.stephanebillon.com",nocase; classtype:trojan-activity; sid:100002949; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tewoerd.eu",nocase; classtype:trojan-activity; sid:100002950; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"textile.softberg.ro",nocase; classtype:trojan-activity; sid:100002951; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tharringtonsponsorship.com",nocase; classtype:trojan-activity; sid:100002952; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thecleaningladiespdx.com",nocase; classtype:trojan-activity; sid:100002953; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thecreativecafe.co.uk",nocase; classtype:trojan-activity; sid:100002954; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thedesertship.com",nocase; classtype:trojan-activity; sid:100002955; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thediasporianexperience.com",nocase; classtype:trojan-activity; sid:100002956; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thefamouscurrybazaar.co.uk",nocase; classtype:trojan-activity; sid:100002957; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thefuturelife.in",nocase; classtype:trojan-activity; sid:100002958; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thehighlightinterior.com",nocase; classtype:trojan-activity; sid:100002959; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thekassia.co.uk",nocase; classtype:trojan-activity; sid:100002960; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"themansionkasauli.com",nocase; classtype:trojan-activity; sid:100002961; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"theprofinn.com",nocase; classtype:trojan-activity; sid:100002962; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thesummitpc.net",nocase; classtype:trojan-activity; sid:100002963; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"theurbantutors.com",nocase; classtype:trojan-activity; sid:100002964; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thosewebbs.com",nocase; classtype:trojan-activity; sid:100002965; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thriveink.com",nocase; classtype:trojan-activity; sid:100002966; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tianangdep.com",nocase; classtype:trojan-activity; sid:100002967; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tickfoods.tickme.lk",nocase; classtype:trojan-activity; sid:100002968; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tidymasters.com.au",nocase; classtype:trojan-activity; sid:100002969; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"timegonebuy.com",nocase; classtype:trojan-activity; sid:100002970; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tksb.net",nocase; classtype:trojan-activity; sid:100002971; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tlcc.com.gt",nocase; classtype:trojan-activity; sid:100002972; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"todoapp.cstdevs.com",nocase; classtype:trojan-activity; sid:100002973; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tonydong.com",nocase; classtype:trojan-activity; sid:100002974; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tonyzone.com",nocase; classtype:trojan-activity; sid:100002975; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tooba.tenplusone.my",nocase; classtype:trojan-activity; sid:100002976; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tools.reimclub.com",nocase; classtype:trojan-activity; sid:100002977; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"topcell9.com",nocase; classtype:trojan-activity; sid:100002978; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"toplevel.com.br",nocase; classtype:trojan-activity; sid:100002979; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"topmask.co.za",nocase; classtype:trojan-activity; sid:100002980; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"torresquinterocorp.com",nocase; classtype:trojan-activity; sid:100002981; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"siili.net",nocase; classtype:trojan-activity; sid:100002843; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"simoneporzi.it",nocase; classtype:trojan-activity; sid:100002844; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"simorsint.com",nocase; classtype:trojan-activity; sid:100002845; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"simplithy.co.uk",nocase; classtype:trojan-activity; sid:100002846; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sindicato1ucm.cl",nocase; classtype:trojan-activity; sid:100002847; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sindpol.tiejuris.com.br",nocase; classtype:trojan-activity; sid:100002848; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sipahielektrik.com",nocase; classtype:trojan-activity; sid:100002849; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sistelligent.com",nocase; classtype:trojan-activity; sid:100002850; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"skare.net",nocase; classtype:trojan-activity; sid:100002851; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"skyflyfares.com",nocase; classtype:trojan-activity; sid:100002852; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"skyscan.com",nocase; classtype:trojan-activity; sid:100002853; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"slot0.gamoruz.com",nocase; classtype:trojan-activity; sid:100002854; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"smarthouseforum.ru",nocase; classtype:trojan-activity; sid:100002855; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"smartzedu.com",nocase; classtype:trojan-activity; sid:100002856; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"smokesolutionindia.com",nocase; classtype:trojan-activity; sid:100002857; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"smritiphotography.in",nocase; classtype:trojan-activity; sid:100002858; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sobariko.com",nocase; classtype:trojan-activity; sid:100002859; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sobethuacademy.com",nocase; classtype:trojan-activity; sid:100002860; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"soft.110route.com",nocase; classtype:trojan-activity; sid:100002861; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"soft.officelabo.net",nocase; classtype:trojan-activity; sid:100002862; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"softanis.net",nocase; classtype:trojan-activity; sid:100002863; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sogecoenergy.com",nocase; classtype:trojan-activity; sid:100002864; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sohs.conceptechs.info",nocase; classtype:trojan-activity; sid:100002865; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"solar.amazingtribe.lk",nocase; classtype:trojan-activity; sid:100002866; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"somcorbera.cat",nocase; classtype:trojan-activity; sid:100002867; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"somir.com.mx",nocase; classtype:trojan-activity; sid:100002868; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"soralapps.com",nocase; classtype:trojan-activity; sid:100002869; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sota-france.fr",nocase; classtype:trojan-activity; sid:100002870; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"space.proactint.org",nocase; classtype:trojan-activity; sid:100002871; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spaceframe.mobi.space-frame.co.za",nocase; classtype:trojan-activity; sid:100002872; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"special-key.cf",nocase; classtype:trojan-activity; sid:100002873; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spent.com.pl",nocase; classtype:trojan-activity; sid:100002874; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spetsesyachtcharter.gr",nocase; classtype:trojan-activity; sid:100002875; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spititourism.com",nocase; classtype:trojan-activity; sid:100002876; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"spittinfire.com",nocase; classtype:trojan-activity; sid:100002877; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"src1.minibai.com",nocase; classtype:trojan-activity; sid:100002878; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sreenivasapaintingworks.com",nocase; classtype:trojan-activity; sid:100002879; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sriglobalit.com",nocase; classtype:trojan-activity; sid:100002880; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"srilankamovies.com",nocase; classtype:trojan-activity; sid:100002881; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"srvmanos.no-ip.info",nocase; classtype:trojan-activity; sid:100002882; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ss.monita.co.id",nocase; classtype:trojan-activity; sid:100002883; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"st.devcodin.com",nocase; classtype:trojan-activity; sid:100002884; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"staging.apparelpunch.com",nocase; classtype:trojan-activity; sid:100002885; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"starcountry.net",nocase; classtype:trojan-activity; sid:100002886; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"static.3001.net",nocase; classtype:trojan-activity; sid:100002887; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stiau.iuc.ac",nocase; classtype:trojan-activity; sid:100002888; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sticker.jewsjuice.com",nocase; classtype:trojan-activity; sid:100002889; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stiedemann-alvah30hq.ru.com",nocase; classtype:trojan-activity; sid:100002890; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stiepancasetia.ac.id",nocase; classtype:trojan-activity; sid:100002891; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"store.ericalgarin.com",nocase; classtype:trojan-activity; sid:100002892; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stott-thompson.co.uk",nocase; classtype:trojan-activity; sid:100002893; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"stratexec.co.za",nocase; classtype:trojan-activity; sid:100002894; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"streetdemo.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002895; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"suboldesign.com",nocase; classtype:trojan-activity; sid:100002896; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sumerians.org",nocase; classtype:trojan-activity; sid:100002897; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sunaryem.com.tr",nocase; classtype:trojan-activity; sid:100002898; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sunbrero.com.au",nocase; classtype:trojan-activity; sid:100002899; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sunmarkholidays.com",nocase; classtype:trojan-activity; sid:100002900; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"support-4-free.com",nocase; classtype:trojan-activity; sid:100002901; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"support.clz.kr",nocase; classtype:trojan-activity; sid:100002902; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"supportit.online",nocase; classtype:trojan-activity; sid:100002903; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sw.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002904; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sweaty.dk",nocase; classtype:trojan-activity; sid:100002905; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sweet-diet.com",nocase; classtype:trojan-activity; sid:100002906; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"swiftlogisticseg.com",nocase; classtype:trojan-activity; sid:100002907; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"swwbia.com",nocase; classtype:trojan-activity; sid:100002908; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"syracusecoffee.com",nocase; classtype:trojan-activity; sid:100002909; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sytraders.co",nocase; classtype:trojan-activity; sid:100002910; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"t.honker.info",nocase; classtype:trojan-activity; sid:100002911; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"t.netcatkit.com",nocase; classtype:trojan-activity; sid:100002912; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tacticohosting.com",nocase; classtype:trojan-activity; sid:100002913; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tadoo.ca",nocase; classtype:trojan-activity; sid:100002914; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tafsantoursandtravels.com",nocase; classtype:trojan-activity; sid:100002915; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tajushariya.com",nocase; classtype:trojan-activity; sid:100002916; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tallyinvoicecustomization.com",nocase; classtype:trojan-activity; sid:100002917; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"taltus.co.uk",nocase; classtype:trojan-activity; sid:100002918; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tarravalleyfoods.com.au",nocase; classtype:trojan-activity; sid:100002919; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tavo.cl",nocase; classtype:trojan-activity; sid:100002920; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tc.snpsresidential.com",nocase; classtype:trojan-activity; sid:100002921; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tcy.198424.com",nocase; classtype:trojan-activity; sid:100002922; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tdsp.yngw518.com",nocase; classtype:trojan-activity; sid:100002923; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tech332.synology.me",nocase; classtype:trojan-activity; sid:100002924; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"techgms.com",nocase; classtype:trojan-activity; sid:100002925; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"teduae.com",nocase; classtype:trojan-activity; sid:100002926; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"teleargentina.com",nocase; classtype:trojan-activity; sid:100002927; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"telescopelms.com",nocase; classtype:trojan-activity; sid:100002928; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"temptmag.com",nocase; classtype:trojan-activity; sid:100002929; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tencoconsulting.com",nocase; classtype:trojan-activity; sid:100002930; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"teneth.co.za",nocase; classtype:trojan-activity; sid:100002931; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tentandoserfitness.000webhostapp.com",nocase; classtype:trojan-activity; sid:100002932; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tessrobins.com",nocase; classtype:trojan-activity; sid:100002933; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.adventser.com",nocase; classtype:trojan-activity; sid:100002934; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.letraele.es",nocase; classtype:trojan-activity; sid:100002935; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.lubrico.in",nocase; classtype:trojan-activity; sid:100002936; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.typoten.com",nocase; classtype:trojan-activity; sid:100002937; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test.wanepghana.org",nocase; classtype:trojan-activity; sid:100002938; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test1.asistencia247.com",nocase; classtype:trojan-activity; sid:100002939; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test1.milenial.id",nocase; classtype:trojan-activity; sid:100002940; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test1.tenplusone.my",nocase; classtype:trojan-activity; sid:100002941; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test2.basis-web.com",nocase; classtype:trojan-activity; sid:100002942; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"test2.marrenconstruction.ie",nocase; classtype:trojan-activity; sid:100002943; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"testing.clickitsolutionsmw.com",nocase; classtype:trojan-activity; sid:100002944; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"testing.thinkingcorp.in",nocase; classtype:trojan-activity; sid:100002945; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"testnew.yourpageserver.com",nocase; classtype:trojan-activity; sid:100002946; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"teteaffiche.stephanebillon.com",nocase; classtype:trojan-activity; sid:100002947; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tewoerd.eu",nocase; classtype:trojan-activity; sid:100002948; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"textile.softberg.ro",nocase; classtype:trojan-activity; sid:100002949; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tharringtonsponsorship.com",nocase; classtype:trojan-activity; sid:100002950; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thecleaningladiespdx.com",nocase; classtype:trojan-activity; sid:100002951; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thecreativecafe.co.uk",nocase; classtype:trojan-activity; sid:100002952; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thedesertship.com",nocase; classtype:trojan-activity; sid:100002953; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thediasporianexperience.com",nocase; classtype:trojan-activity; sid:100002954; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thefamouscurrybazaar.co.uk",nocase; classtype:trojan-activity; sid:100002955; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thefuturelife.in",nocase; classtype:trojan-activity; sid:100002956; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thehighlightinterior.com",nocase; classtype:trojan-activity; sid:100002957; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thekassia.co.uk",nocase; classtype:trojan-activity; sid:100002958; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"themansionkasauli.com",nocase; classtype:trojan-activity; sid:100002959; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"theprofinn.com",nocase; classtype:trojan-activity; sid:100002960; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thesummitpc.net",nocase; classtype:trojan-activity; sid:100002961; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"theurbantutors.com",nocase; classtype:trojan-activity; sid:100002962; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"theviewsdyjupcazfeqv.dns.army",nocase; classtype:trojan-activity; sid:100002963; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thosewebbs.com",nocase; classtype:trojan-activity; sid:100002964; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"thriveink.com",nocase; classtype:trojan-activity; sid:100002965; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tianangdep.com",nocase; classtype:trojan-activity; sid:100002966; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tickfoods.tickme.lk",nocase; classtype:trojan-activity; sid:100002967; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tidymasters.com.au",nocase; classtype:trojan-activity; sid:100002968; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"timegonebuy.com",nocase; classtype:trojan-activity; sid:100002969; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tksb.net",nocase; classtype:trojan-activity; sid:100002970; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tlcc.com.gt",nocase; classtype:trojan-activity; sid:100002971; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"todoapp.cstdevs.com",nocase; classtype:trojan-activity; sid:100002972; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tonydong.com",nocase; classtype:trojan-activity; sid:100002973; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tonyzone.com",nocase; classtype:trojan-activity; sid:100002974; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tooba.tenplusone.my",nocase; classtype:trojan-activity; sid:100002975; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tools.reimclub.com",nocase; classtype:trojan-activity; sid:100002976; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"topcell9.com",nocase; classtype:trojan-activity; sid:100002977; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"toplevel.com.br",nocase; classtype:trojan-activity; sid:100002978; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"topmask.co.za",nocase; classtype:trojan-activity; sid:100002979; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"torresquinterocorp.com",nocase; classtype:trojan-activity; sid:100002980; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"towme.services",nocase; classtype:trojan-activity; sid:100002981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"toyotacollege.ac.th",nocase; classtype:trojan-activity; sid:100002982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tpke.hu",nocase; classtype:trojan-activity; sid:100002983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"translaterjemah.com",nocase; classtype:trojan-activity; sid:100002984; rev:1;) @@ -3008,15 +3008,15 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"umwelt-kirchhof.de",nocase; classtype:trojan-activity; sid:100003002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"unicorpbrunei.com",nocase; classtype:trojan-activity; sid:100003003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"uniengrisb.com",nocase; classtype:trojan-activity; sid:100003004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"unisoftcc.com",nocase; classtype:trojan-activity; sid:100003005; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"unityindiversity.in",nocase; classtype:trojan-activity; sid:100003006; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"unyazitelecom.com",nocase; classtype:trojan-activity; sid:100003007; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"upcbpta.com",nocase; classtype:trojan-activity; sid:100003008; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"urbantrapfest.cl",nocase; classtype:trojan-activity; sid:100003009; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"used-jeans.fr",nocase; classtype:trojan-activity; sid:100003010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"useformoney.000webhostapp.com",nocase; classtype:trojan-activity; sid:100003011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"uss.ac.th",nocase; classtype:trojan-activity; sid:100003012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"uzzepay.com.br",nocase; classtype:trojan-activity; sid:100003013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"unitedwsdykesokowskg.dns.army",nocase; classtype:trojan-activity; sid:100003005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"unyazitelecom.com",nocase; classtype:trojan-activity; sid:100003006; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"upcbpta.com",nocase; classtype:trojan-activity; sid:100003007; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"urbantrapfest.cl",nocase; classtype:trojan-activity; sid:100003008; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"used-jeans.fr",nocase; classtype:trojan-activity; sid:100003009; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"useformoney.000webhostapp.com",nocase; classtype:trojan-activity; sid:100003010; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"uss.ac.th",nocase; classtype:trojan-activity; sid:100003011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"uzzepay.com.br",nocase; classtype:trojan-activity; sid:100003012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"v2consultores.com",nocase; classtype:trojan-activity; sid:100003013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"vanzare.cabanabrazi2.ro",nocase; classtype:trojan-activity; sid:100003014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"vbcargo.hu",nocase; classtype:trojan-activity; sid:100003015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"vcah.co.uk",nocase; classtype:trojan-activity; sid:100003016; rev:1;) @@ -3076,841 +3076,864 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"woodsytech.com",nocase; classtype:trojan-activity; sid:100003070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wordpress.saleensuporte.com.br",nocase; classtype:trojan-activity; sid:100003071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"workingsolutionsrome.org",nocase; classtype:trojan-activity; sid:100003072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wozata.000webhostapp.com",nocase; classtype:trojan-activity; sid:100003073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wp.readhere.in",nocase; classtype:trojan-activity; sid:100003074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wpdemo.101clients.com.au",nocase; classtype:trojan-activity; sid:100003075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"writtendeer.com",nocase; classtype:trojan-activity; sid:100003076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ws5588.f3322.net",nocase; classtype:trojan-activity; sid:100003077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wsdysuresbonescagegp.dns.army",nocase; classtype:trojan-activity; sid:100003078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wyklej.pl",nocase; classtype:trojan-activity; sid:100003079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"x2vn.com",nocase; classtype:trojan-activity; sid:100003080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xia.beihaixue.com",nocase; classtype:trojan-activity; sid:100003081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xixaoclothing.com",nocase; classtype:trojan-activity; sid:100003082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xk.996is.com",nocase; classtype:trojan-activity; sid:100003083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xn--80akinnkiib6h.xn--90ais",nocase; classtype:trojan-activity; sid:100003084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xn--polimerbizmimarlk-rvc.com",nocase; classtype:trojan-activity; sid:100003085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ybom.urbanolab.com",nocase; classtype:trojan-activity; sid:100003086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yeichner.com",nocase; classtype:trojan-activity; sid:100003087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ylfpremium.com",nocase; classtype:trojan-activity; sid:100003088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yoast.yourpageserver.com",nocase; classtype:trojan-activity; sid:100003089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"youtubetrainingacademy.com",nocase; classtype:trojan-activity; sid:100003090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yskadvisors.com",nocase; classtype:trojan-activity; sid:100003091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yummyyogaudaipur.com",nocase; classtype:trojan-activity; sid:100003092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yzkzixun.com",nocase; classtype:trojan-activity; sid:100003093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"zmedcoach.com",nocase; classtype:trojan-activity; sid:100003094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"zytrox.tk",nocase; classtype:trojan-activity; sid:100003095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"zz.690tx.com",nocase; classtype:trojan-activity; sid:100003096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.indexsinas.me:811",nocase; http_uri; content:"/64.exe",nocase; classtype:trojan-activity; sid:100003097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.indexsinas.me:811",nocase; http_uri; content:"/86.exe",nocase; classtype:trojan-activity; sid:100003098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.indexsinas.me:811",nocase; http_uri; content:"/c64.exe",nocase; classtype:trojan-activity; sid:100003099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amumufree.weebly.com",nocase; http_uri; content:"/uploads/8/1/2/9/81294208/growtopiastaff_setup1.61.exe",nocase; classtype:trojan-activity; sid:100003100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"analogx.com",nocase; http_uri; content:"/files/proxyi.exe",nocase; classtype:trojan-activity; sid:100003101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/abernathyjorge711/y6788/downloads/bubblebrowserext1.0.exe",nocase; classtype:trojan-activity; sid:100003102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/dvdfv/anjj/downloads/jami.exe",nocase; classtype:trojan-activity; sid:100003103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/heyhoeee/heyhoename1/downloads/1234.exe",nocase; classtype:trojan-activity; sid:100003104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/jpavelski/chpock/downloads/4.exe",nocase; classtype:trojan-activity; sid:100003105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/jpavelski/chpock/downloads/6.exe",nocase; classtype:trojan-activity; sid:100003106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/labesoftware/update/downloads/boost-fps.exe",nocase; classtype:trojan-activity; sid:100003107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/labesoftware/update/downloads/install_plugin_x64_x86.exe",nocase; classtype:trojan-activity; sid:100003108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/labesoftware/update/downloads/vpn_free.exe",nocase; classtype:trojan-activity; sid:100003109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/1.exe",nocase; classtype:trojan-activity; sid:100003110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/clr.exe",nocase; classtype:trojan-activity; sid:100003111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/omar.exe",nocase; classtype:trojan-activity; sid:100003112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/updatev.exe",nocase; classtype:trojan-activity; sid:100003113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/work.exe",nocase; classtype:trojan-activity; sid:100003114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/ya.exe",nocase; classtype:trojan-activity; sid:100003115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/player2012/rumpa1/downloads/component.exe",nocase; classtype:trojan-activity; sid:100003116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/player2012/rumpa1/downloads/nordvpnsetup.exe",nocase; classtype:trojan-activity; sid:100003117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/player2012/rumpa1/downloads/regsvc.exe",nocase; classtype:trojan-activity; sid:100003118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/skygaming/updates/downloads/update.exe",nocase; classtype:trojan-activity; sid:100003119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/001.txt",nocase; classtype:trojan-activity; sid:100003120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/1488.txt",nocase; classtype:trojan-activity; sid:100003121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/1_cr.txt",nocase; classtype:trojan-activity; sid:100003122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/1cr.txt",nocase; classtype:trojan-activity; sid:100003123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/1fc2d.txt",nocase; classtype:trojan-activity; sid:100003124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/26a5.txt",nocase; classtype:trojan-activity; sid:100003125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/6e7_2021-01-19_18-04.txt",nocase; classtype:trojan-activity; sid:100003126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/abjects.txt",nocase; classtype:trojan-activity; sid:100003127; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/attached.txt",nocase; classtype:trojan-activity; sid:100003128; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/b7f2c.exe",nocase; classtype:trojan-activity; sid:100003129; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/battletext.txt",nocase; classtype:trojan-activity; sid:100003130; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/bkghj_nowin.exe",nocase; classtype:trojan-activity; sid:100003131; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/bsdasdasd333.exe",nocase; classtype:trojan-activity; sid:100003132; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/build.txt",nocase; classtype:trojan-activity; sid:100003133; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/build_makros.exe",nocase; classtype:trojan-activity; sid:100003134; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/build_silent.txt",nocase; classtype:trojan-activity; sid:100003135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/build_sup.txt",nocase; classtype:trojan-activity; sid:100003136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/buildcmobiler.exe",nocase; classtype:trojan-activity; sid:100003137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/buildcmobiler.txt",nocase; classtype:trojan-activity; sid:100003138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/buildcr.txt",nocase; classtype:trojan-activity; sid:100003139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/buildss.txt",nocase; classtype:trojan-activity; sid:100003140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/clientnik.txt",nocase; classtype:trojan-activity; sid:100003141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/clientrevers.txt",nocase; classtype:trojan-activity; sid:100003142; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/dcrat.exe",nocase; classtype:trojan-activity; sid:100003143; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/dllservices.exe",nocase; classtype:trojan-activity; sid:100003144; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/dllservices2.exe",nocase; classtype:trojan-activity; sid:100003145; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/exe_morris.mcdermott.exe",nocase; classtype:trojan-activity; sid:100003146; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/hans.txt",nocase; classtype:trojan-activity; sid:100003147; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/hulu.txt",nocase; classtype:trojan-activity; sid:100003148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/intelfive.txt",nocase; classtype:trojan-activity; sid:100003149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/intelfour.txt",nocase; classtype:trojan-activity; sid:100003150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/intelone.txt",nocase; classtype:trojan-activity; sid:100003151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/intelthree.txt",nocase; classtype:trojan-activity; sid:100003152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/inteltwo.txt",nocase; classtype:trojan-activity; sid:100003153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/jjuufksfn.exe",nocase; classtype:trojan-activity; sid:100003154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/kleiman.exe",nocase; classtype:trojan-activity; sid:100003155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/lucky_fixed.exe",nocase; classtype:trojan-activity; sid:100003156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/notepadplus.txt",nocase; classtype:trojan-activity; sid:100003157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/osiris_qqkz_nauto.exe",nocase; classtype:trojan-activity; sid:100003158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/out.exe",nocase; classtype:trojan-activity; sid:100003159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/out.txt",nocase; classtype:trojan-activity; sid:100003160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/pacbe_bin.txt",nocase; classtype:trojan-activity; sid:100003161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/putty.txt",nocase; classtype:trojan-activity; sid:100003162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/rockethcd.txt",nocase; classtype:trojan-activity; sid:100003163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/scvhost900.exe",nocase; classtype:trojan-activity; sid:100003164; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/sessionwin.exe",nocase; classtype:trojan-activity; sid:100003165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/siliculose.txt",nocase; classtype:trojan-activity; sid:100003166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/statemobi.txt",nocase; classtype:trojan-activity; sid:100003167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/stealers.exe",nocase; classtype:trojan-activity; sid:100003168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/stealers2.exe",nocase; classtype:trojan-activity; sid:100003169; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/stgedo.exe",nocase; classtype:trojan-activity; sid:100003170; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/svcperf.txt",nocase; classtype:trojan-activity; sid:100003171; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/symptomaticshon5.exe",nocase; classtype:trojan-activity; sid:100003172; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/taurjok.txt",nocase; classtype:trojan-activity; sid:100003173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/taurusbabac.exe",nocase; classtype:trojan-activity; sid:100003174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/telekiller.exe",nocase; classtype:trojan-activity; sid:100003175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/updateanddr.txt",nocase; classtype:trojan-activity; sid:100003176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/updateandr.txt",nocase; classtype:trojan-activity; sid:100003177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/vhajeja.txt",nocase; classtype:trojan-activity; sid:100003178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/word.txt",nocase; classtype:trojan-activity; sid:100003179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/www.txt",nocase; classtype:trojan-activity; sid:100003180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/xlsd.txt",nocase; classtype:trojan-activity; sid:100003181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/teaserex/tease/downloads/b_kfmhkk172.bin",nocase; classtype:trojan-activity; sid:100003182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/teaserex/tease/downloads/macro_xmprohiq27.bin",nocase; classtype:trojan-activity; sid:100003183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cd.textfiles.com",nocase; http_uri; content:"/hmatrix/data/hack1226.exe",nocase; classtype:trojan-activity; sid:100003184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/775238059083038744/821062129347067924/wxhyhyciuesjdefkxcqddvfbjqrofjq",nocase; classtype:trojan-activity; sid:100003185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/816070119281131570/816070273254162442/all.txt",nocase; classtype:trojan-activity; sid:100003186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/825372018244583454/826848185246023750/loaddd.exe",nocase; classtype:trojan-activity; sid:100003187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/825372018244583454/826848348342059008/zeppelin.exe",nocase; classtype:trojan-activity; sid:100003188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/825372018244583454/826848405258633277/build.exe",nocase; classtype:trojan-activity; sid:100003189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/826198252025675816/826537386485612574/china.png",nocase; classtype:trojan-activity; sid:100003190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/826376903400751108/826431600383361065/remcmcmcm_mjvbsmlrc45.bin",nocase; classtype:trojan-activity; sid:100003191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe",nocase; classtype:trojan-activity; sid:100003192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chiptune.com",nocase; http_uri; content:"/razor/rzr-winner_intro.zip",nocase; classtype:trojan-activity; sid:100003193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cloudme.com",nocase; http_uri; content:"/v1/ws2/:suengpen/:buyerlist.js/buyerlist.js.xz",nocase; classtype:trojan-activity; sid:100003194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cloudme.com",nocase; http_uri; content:"/v1/ws2/:suengpen/:buyerlist1/buyerlist1.rar",nocase; classtype:trojan-activity; sid:100003195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"codeload.github.com",nocase; http_uri; content:"/meteoradminz/hidden-tear/zip/master",nocase; classtype:trojan-activity; sid:100003196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"colfincas.com",nocase; http_uri; content:"/tmp/protected-cek9qz4zvk2n65e-c5d84gi5/security-cloud/kypqw-52kkq0n9ywj9oa/",nocase; classtype:trojan-activity; sid:100003197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq",nocase; classtype:trojan-activity; sid:100003198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com.it-barcelona.com",nocase; http_uri; content:"/frm0reseen/prntscrnofamzorderid.jpg.exe",nocase; classtype:trojan-activity; sid:100003199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm",nocase; classtype:trojan-activity; sid:100003200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss",nocase; classtype:trojan-activity; sid:100003201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch",nocase; classtype:trojan-activity; sid:100003202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g",nocase; classtype:trojan-activity; sid:100003203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=152yoztzpbx_bbpxepfackfklg8c1eao6",nocase; classtype:trojan-activity; sid:100003204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=15hcgek7odccdafzf-9gvibnlgkirj4uo",nocase; classtype:trojan-activity; sid:100003205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox",nocase; classtype:trojan-activity; sid:100003206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w",nocase; classtype:trojan-activity; sid:100003207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=194lqzukzvt-jtdxmihcvhd0yk1sxoybk",nocase; classtype:trojan-activity; sid:100003208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig",nocase; classtype:trojan-activity; sid:100003209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld",nocase; classtype:trojan-activity; sid:100003210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn",nocase; classtype:trojan-activity; sid:100003211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw",nocase; classtype:trojan-activity; sid:100003212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio",nocase; classtype:trojan-activity; sid:100003213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv",nocase; classtype:trojan-activity; sid:100003214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1cos43rmscrescxk3u40qjuqbwr-pydsn",nocase; classtype:trojan-activity; sid:100003215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben",nocase; classtype:trojan-activity; sid:100003216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e",nocase; classtype:trojan-activity; sid:100003217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv",nocase; classtype:trojan-activity; sid:100003218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd",nocase; classtype:trojan-activity; sid:100003219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6",nocase; classtype:trojan-activity; sid:100003220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei",nocase; classtype:trojan-activity; sid:100003221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr",nocase; classtype:trojan-activity; sid:100003222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1jkov2g5s1xkcq4bfb3uvmd6inhadatrg",nocase; classtype:trojan-activity; sid:100003223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd",nocase; classtype:trojan-activity; sid:100003224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1kjcylye1dbmhystyyotz-3pagktkhlhq",nocase; classtype:trojan-activity; sid:100003225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu",nocase; classtype:trojan-activity; sid:100003226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer",nocase; classtype:trojan-activity; sid:100003227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp",nocase; classtype:trojan-activity; sid:100003228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1mwgdd3lxuuk-bnsrm1rpclom0cmx7wob",nocase; classtype:trojan-activity; sid:100003229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y",nocase; classtype:trojan-activity; sid:100003230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd",nocase; classtype:trojan-activity; sid:100003231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1nmf6kty3xsoygjxjhb-bsafvlfy-0lt2",nocase; classtype:trojan-activity; sid:100003232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw",nocase; classtype:trojan-activity; sid:100003233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol",nocase; classtype:trojan-activity; sid:100003234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1p5fvqkxzwoiu_uauzbmrxpklsetculad",nocase; classtype:trojan-activity; sid:100003235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk",nocase; classtype:trojan-activity; sid:100003236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s",nocase; classtype:trojan-activity; sid:100003237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej",nocase; classtype:trojan-activity; sid:100003238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1q1dwckludrpqijtrpw14_60d5nu7n97t",nocase; classtype:trojan-activity; sid:100003239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p",nocase; classtype:trojan-activity; sid:100003240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl",nocase; classtype:trojan-activity; sid:100003241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko",nocase; classtype:trojan-activity; sid:100003242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq",nocase; classtype:trojan-activity; sid:100003243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1sjvkrinuscxqmbkdeusxaezazbiagnv3",nocase; classtype:trojan-activity; sid:100003244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1so1trfuzt5-giahetghfhmd-_ot3rq35",nocase; classtype:trojan-activity; sid:100003245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn",nocase; classtype:trojan-activity; sid:100003246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w",nocase; classtype:trojan-activity; sid:100003247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno",nocase; classtype:trojan-activity; sid:100003248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t",nocase; classtype:trojan-activity; sid:100003249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb",nocase; classtype:trojan-activity; sid:100003250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh",nocase; classtype:trojan-activity; sid:100003251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e",nocase; classtype:trojan-activity; sid:100003252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi",nocase; classtype:trojan-activity; sid:100003253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58",nocase; classtype:trojan-activity; sid:100003254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi",nocase; classtype:trojan-activity; sid:100003255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1yhflwpk3yeyrdhlhanctlind-5j24iwv",nocase; classtype:trojan-activity; sid:100003256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1yqpuxjbnjokc5fjgt-8xzuybr97rtvg2",nocase; classtype:trojan-activity; sid:100003257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy",nocase; classtype:trojan-activity; sid:100003258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr",nocase; classtype:trojan-activity; sid:100003259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0",nocase; classtype:trojan-activity; sid:100003260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drpamelageorge.com",nocase; http_uri; content:"/wp-includes/1zilg/",nocase; classtype:trojan-activity; sid:100003261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drpamelageorge.com",nocase; http_uri; content:"/wp-includes/qcgfmfvh/",nocase; classtype:trojan-activity; sid:100003262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"e-mudhra.com",nocase; http_uri; content:"/downloads/emclick.zip",nocase; classtype:trojan-activity; sid:100003263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"evertkok.nl",nocase; http_uri; content:"/informatica/informatica-actief/hoofdstuk1/extrasoftware/getallen.exe",nocase; classtype:trojan-activity; sid:100003264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"evertkok.nl",nocase; http_uri; content:"/informatica/informatica-actief/hoofdstuk2/software/hksetup.exe",nocase; classtype:trojan-activity; sid:100003265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"expeditionquest.com",nocase; http_uri; content:"/register/phpcaptcha/images/19dnqhg1p/sbhvtqlysxhxn/",nocase; classtype:trojan-activity; sid:100003266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"expeditionquest.com",nocase; http_uri; content:"/register/phpcaptcha/images/35egphpl5uzpvdmz9bncmvon3p/",nocase; classtype:trojan-activity; sid:100003267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"expeditionquest.com",nocase; http_uri; content:"/x/",nocase; classtype:trojan-activity; sid:100003268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exxonabnie.ir",nocase; http_uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf/",nocase; classtype:trojan-activity; sid:100003269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exxonabnie.ir",nocase; http_uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf//",nocase; classtype:trojan-activity; sid:100003270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exxonabnie.ir",nocase; http_uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf///",nocase; classtype:trojan-activity; sid:100003271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exxonabnie.ir",nocase; http_uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf////",nocase; classtype:trojan-activity; sid:100003272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"file.elecfans.com",nocase; http_uri; content:"/web1/m00/8f/36/o4ybafy-2m2aarfzaahkaiik5pi122.exe",nocase; classtype:trojan-activity; sid:100003273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"files.constantcontact.com",nocase; http_uri; content:"/4cb7cebd101/e5fb4174-ab23-48e8-bf05-e80ec5fa2169.xls",nocase; classtype:trojan-activity; sid:100003274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"files.constantcontact.com",nocase; http_uri; content:"/ee304de9001/7e533e73-e272-4a44-9d9e-138cab64bf19.docx",nocase; classtype:trojan-activity; sid:100003275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gist.githubusercontent.com",nocase; http_uri; content:"/zibri/19f9838ffd12349bb2c6c3afddc9388f/raw/01977fd3c7e036c3a38f062f626fd189ba1e1aa3/uefivar.exe",nocase; classtype:trojan-activity; sid:100003276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hqdecig.com",nocase; http_uri; content:"/cgi-bin/sni8w3fssb44iavmzss2nv0od6eiixlq6/",nocase; classtype:trojan-activity; sid:100003277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hsecaravans.co.uk",nocase; http_uri; content:"/wp-admin/suy/",nocase; classtype:trojan-activity; sid:100003278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ia801802.us.archive.org",nocase; http_uri; content:"/19/items/startup_20210219/startup.txt",nocase; classtype:trojan-activity; sid:100003279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ie-best.net",nocase; http_uri; content:"/online-timer-kvhxz/ilxl/",nocase; classtype:trojan-activity; sid:100003280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"indonesias.me:9998",nocase; http_uri; content:"/64.exe",nocase; classtype:trojan-activity; sid:100003281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"indonesias.me:9998",nocase; http_uri; content:"/c64.exe",nocase; classtype:trojan-activity; sid:100003282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"insupportofchildren.co.uk",nocase; http_uri; content:"/v/bnun9t30zqx9t6z944g7o9z9o2plcrswmwuv9/",nocase; classtype:trojan-activity; sid:100003283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jcedu.org",nocase; http_uri; content:"/ebook/cs17.exe",nocase; classtype:trojan-activity; sid:100003284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jointings.org",nocase; http_uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/1",nocase; classtype:trojan-activity; sid:100003285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jointings.org",nocase; http_uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/2",nocase; classtype:trojan-activity; sid:100003286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jointings.org",nocase; http_uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/3",nocase; classtype:trojan-activity; sid:100003287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"karmakoincodes.weebly.com",nocase; http_uri; content:"/uploads/3/2/8/8/3288864/karma_koin_codes.exe",nocase; classtype:trojan-activity; sid:100003288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kotakwarna.co.id",nocase; http_uri; content:"/dg/etrac/nf4emwz/",nocase; classtype:trojan-activity; sid:100003289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ksh.hu",nocase; http_uri; content:"/docs/adatgyujtesek/elektra/csv_to_xml.exe",nocase; classtype:trojan-activity; sid:100003290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kuaizip.com",nocase; http_uri; content:"/down/affiliate/kuaizip_setup_10029.exe",nocase; classtype:trojan-activity; sid:100003291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"linuxforensicsbook.com.s3.amazonaws.com",nocase; http_uri; content:"/linuxforensicscode.zip",nocase; classtype:trojan-activity; sid:100003292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lojavirtual.top",nocase; http_uri; content:"/dl8.exe",nocase; classtype:trojan-activity; sid:100003293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lojavirtual.top",nocase; http_uri; content:"/dl8v2.exe",nocase; classtype:trojan-activity; sid:100003294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"marcostrombetta.com.br",nocase; http_uri; content:"/ds/1802.gif",nocase; classtype:trojan-activity; sid:100003295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"minpic.de",nocase; http_uri; content:"/k/big5/1giof6/",nocase; classtype:trojan-activity; sid:100003296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"miot2.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/order+00843112.ace",nocase; classtype:trojan-activity; sid:100003297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"miot2.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/shipping+docs(ci%2ccoo%2cbl%2cpl).ace",nocase; classtype:trojan-activity; sid:100003298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"morrobaydrugandgift.com",nocase; http_uri; content:"/wp-contentbak/t9m/",nocase; classtype:trojan-activity; sid:100003299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"my.cloudme.com",nocase; http_uri; content:"/v1/ws2/:gianni1962/:ie6setup/ie6setup.exe",nocase; classtype:trojan-activity; sid:100003300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nch.com.au",nocase; http_uri; content:"/components/aacenc.exe",nocase; classtype:trojan-activity; sid:100003301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nch.com.au",nocase; http_uri; content:"/components/doxillionsetup.exe",nocase; classtype:trojan-activity; sid:100003302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"newyarlfm.weebly.com",nocase; http_uri; content:"/uploads/4/1/6/6/4166984/keygen.exe",nocase; classtype:trojan-activity; sid:100003303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nhipcauytevietnhat.com",nocase; http_uri; content:"/efficiency-all-iuehb/bjug3jyhuyilwhcqs3ykssaqqw7tpyvmypb91wtzdbluio1ekope5vrbbcx8zhdar9yt/",nocase; classtype:trojan-activity; sid:100003304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"note.youdao.com",nocase; http_uri; content:"/yws/api/personal/file/web3a243b322cf83ca7cae587a92916bac7?method=download&inline=true&sharekey=649ac0bb5d5b13d15cbf50b2609e193a",nocase; classtype:trojan-activity; sid:100003305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oldschoolvalue.s3.amazonaws.com",nocase; http_uri; content:"/spreadsheets/osv_stock_valuation-sample-dummy.exe",nocase; classtype:trojan-activity; sid:100003306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa",nocase; classtype:trojan-activity; sid:100003307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq",nocase; classtype:trojan-activity; sid:100003308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe",nocase; classtype:trojan-activity; sid:100003309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=b4c15a27928f663b!230&authkey=ancu1eabetiubzg",nocase; classtype:trojan-activity; sid:100003310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=b4c15a27928f663b!231&authkey=ai9h3sk_luxran0",nocase; classtype:trojan-activity; sid:100003311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=c127f9e0fb7cbbea!214&authkey=aat73nvghhjdr9g",nocase; classtype:trojan-activity; sid:100003312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?authkey=!aase4ma0-vo_cls&cid=4df11eda676a355f&resid=4df11eda676a355f!140",nocase; classtype:trojan-activity; sid:100003313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?authkey=!akd6uxvljtlvpxu&cid=4df11eda676a355f&resid=4df11eda676a355f!130",nocase; classtype:trojan-activity; sid:100003314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?authkey=!aomvnemlpgwfuie&cid=4df11eda676a355f&resid=4df11eda676a355f!135",nocase; classtype:trojan-activity; sid:100003315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?authkey=adf5p_kn8rjf29y&cid=34224e3e49966a27&resid=34224e3e49966a27%211732",nocase; classtype:trojan-activity; sid:100003316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=013413cfbbbcfae4&resid=13413cfbbbcfae4%211656&authkey=ai9wpcp_k9okgk4",nocase; classtype:trojan-activity; sid:100003317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c!111&authkey=aemrwamaaaiyyjc",nocase; classtype:trojan-activity; sid:100003318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c%21111&authkey=aemrwamaaaiyyjc",nocase; classtype:trojan-activity; sid:100003319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0175cdbe2d2944c5&resid=175cdbe2d2944c5%21107&authkey=al6uptubjmmugo0",nocase; classtype:trojan-activity; sid:100003320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!157&authkey=aagcsm7chqez6uu",nocase; classtype:trojan-activity; sid:100003321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!158&authkey=amsoii5nr6pomhc",nocase; classtype:trojan-activity; sid:100003322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21157&authkey=aagcsm7chqez6uu",nocase; classtype:trojan-activity; sid:100003323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21158&authkey=amsoii5nr6pomhc",nocase; classtype:trojan-activity; sid:100003324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211177&authkey=am0i98nwgvzgqvq",nocase; classtype:trojan-activity; sid:100003325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211183&authkey=anv33trmzmi5cko",nocase; classtype:trojan-activity; sid:100003326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0319bb40eba80dcc&resid=319bb40eba80dcc%21110&authkey=ag8bs48lq9n-piw",nocase; classtype:trojan-activity; sid:100003327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0412fba39d6c52de&resid=412fba39d6c52de%2122008&authkey=amn2bgbswxwgpma",nocase; classtype:trojan-activity; sid:100003328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=045adcdfe91be4f5&resid=45adcdfe91be4f5%21318&authkey=aa6lutarluhyj48",nocase; classtype:trojan-activity; sid:100003329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0489c74de4facb30&resid=489c74de4facb30!109&authkey=ajo32arrzl_vwdq",nocase; classtype:trojan-activity; sid:100003330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=062a585e433edce3&resid=62a585e433edce3%211618&authkey=ahzfppat_uettfg",nocase; classtype:trojan-activity; sid:100003331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=087f57dcf1bd61bc&resid=87f57dcf1bd61bc!113&authkey=ap0wsc-rsiegllw",nocase; classtype:trojan-activity; sid:100003332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=09eebe7829f6351d&resid=9eebe7829f6351d%21827&authkey=amysfuvfuc5jezq",nocase; classtype:trojan-activity; sid:100003333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d!184&authkey=ackbiiarirejcam",nocase; classtype:trojan-activity; sid:100003334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d%21184&authkey=ackbiiarirejcam",nocase; classtype:trojan-activity; sid:100003335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!273&authkey=ae2m69e5nu3rrea",nocase; classtype:trojan-activity; sid:100003336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!274&authkey=acqg0akutoxdpgo",nocase; classtype:trojan-activity; sid:100003337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21273&authkey=ae2m69e5nu3rrea",nocase; classtype:trojan-activity; sid:100003338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21274&authkey=acqg0akutoxdpgo",nocase; classtype:trojan-activity; sid:100003339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0!1667&authkey=an8otd7jzc7xgho",nocase; classtype:trojan-activity; sid:100003340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0%211667&authkey=an8otd7jzc7xgho",nocase; classtype:trojan-activity; sid:100003341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0e26b39babdbf63c&resid=e26b39babdbf63c%21137&authkey=anshbgxg1_qa2h4",nocase; classtype:trojan-activity; sid:100003342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242!309&authkey=alfe36drai1zmwc",nocase; classtype:trojan-activity; sid:100003343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242%21309&authkey=alfe36drai1zmwc",nocase; classtype:trojan-activity; sid:100003344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21123&authkey=aco5hiwppfq8vrw",nocase; classtype:trojan-activity; sid:100003345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21124&authkey=ai6sfa2z-kqf6x0",nocase; classtype:trojan-activity; sid:100003346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=125290ca4dc682c9&resid=125290ca4dc682c9%21452&authkey=afdp5rurqhdqa2a",nocase; classtype:trojan-activity; sid:100003347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=13b301f1cb48f8cd&resid=13b301f1cb48f8cd%21106&authkey=aiae3olcs4lulz4",nocase; classtype:trojan-activity; sid:100003348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=14f52af71b98dbc5&resid=14f52af71b98dbc5%212449&authkey=anfs_n5cs1noojo",nocase; classtype:trojan-activity; sid:100003349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0",nocase; classtype:trojan-activity; sid:100003350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte",nocase; classtype:trojan-activity; sid:100003351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte",nocase; classtype:trojan-activity; sid:100003352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54",nocase; classtype:trojan-activity; sid:100003353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54",nocase; classtype:trojan-activity; sid:100003354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g",nocase; classtype:trojan-activity; sid:100003355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!129&authkey=apqoonsrce0ari4",nocase; classtype:trojan-activity; sid:100003356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21126&authkey=ad4yflrisq6d82g",nocase; classtype:trojan-activity; sid:100003357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21129&authkey=apqoonsrce0ari4",nocase; classtype:trojan-activity; sid:100003358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=196e83840ef8c152&resid=196e83840ef8c152%21107&authkey=ah2lhjyd0ukjcve",nocase; classtype:trojan-activity; sid:100003359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a162e8fcaaef5fa&resid=1a162e8fcaaef5fa%215495&authkey=aic7rmj1cm3rt2w",nocase; classtype:trojan-activity; sid:100003360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!106&authkey=aklmrzgetlbm5wc",nocase; classtype:trojan-activity; sid:100003361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!107&authkey=albnx4ylxil-nog",nocase; classtype:trojan-activity; sid:100003362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21106&authkey=aklmrzgetlbm5wc",nocase; classtype:trojan-activity; sid:100003363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21107&authkey=albnx4ylxil-nog",nocase; classtype:trojan-activity; sid:100003364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558!8182&authkey=aautw8tvzxr5v3a",nocase; classtype:trojan-activity; sid:100003365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558%218182&authkey=aautw8tvzxr5v3a",nocase; classtype:trojan-activity; sid:100003366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1cbd82dd55d70086&resid=1cbd82dd55d70086%212526&authkey=aogaboensav3jrg",nocase; classtype:trojan-activity; sid:100003367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1dbdf62bc3c2b05b&resid=1dbdf62bc3c2b05b!134&authkey=ape6bhxn7c89z60",nocase; classtype:trojan-activity; sid:100003368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg",nocase; classtype:trojan-activity; sid:100003369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4",nocase; classtype:trojan-activity; sid:100003370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c",nocase; classtype:trojan-activity; sid:100003371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po",nocase; classtype:trojan-activity; sid:100003372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe",nocase; classtype:trojan-activity; sid:100003373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk",nocase; classtype:trojan-activity; sid:100003374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f!191&authkey=ajvumpkzpla_nca",nocase; classtype:trojan-activity; sid:100003375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f%21191&authkey=ajvumpkzpla_nca",nocase; classtype:trojan-activity; sid:100003376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=26bbd7d5ad88dd29&resid=26bbd7d5ad88dd29%21115&authkey=acipfa3gbiqqcvu",nocase; classtype:trojan-activity; sid:100003377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=26f87316a7e32bb5&resid=26f87316a7e32bb5%21106&authkey=aepqo5hlkxn1t1k",nocase; classtype:trojan-activity; sid:100003378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2831401bbac0235e&resid=2831401bbac0235e%211037&authkey=aagnkp6l76yhrlo",nocase; classtype:trojan-activity; sid:100003379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga",nocase; classtype:trojan-activity; sid:100003380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28",nocase; classtype:trojan-activity; sid:100003381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28",nocase; classtype:trojan-activity; sid:100003382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0",nocase; classtype:trojan-activity; sid:100003383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620",nocase; classtype:trojan-activity; sid:100003384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo",nocase; classtype:trojan-activity; sid:100003385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21115&authkey=aglznnsx71tbe9e",nocase; classtype:trojan-activity; sid:100003386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37!183&authkey=akon9i9zzhusiuk",nocase; classtype:trojan-activity; sid:100003387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37%21183&authkey=akon9i9zzhusiuk",nocase; classtype:trojan-activity; sid:100003388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!116&authkey=!abwledjhfsqwap4",nocase; classtype:trojan-activity; sid:100003389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!121&authkey=!aa0qbuuss-wb13w",nocase; classtype:trojan-activity; sid:100003390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1!119&authkey=apmakx2cqb9rimu",nocase; classtype:trojan-activity; sid:100003391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21118&authkey=acrl2iiem-zjer8",nocase; classtype:trojan-activity; sid:100003392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21119&authkey=apmakx2cqb9rimu",nocase; classtype:trojan-activity; sid:100003393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2ffaa48ef4bec51a&resid=2ffaa48ef4bec51a%21107&authkey=aiohrvrc3uuo_cw",nocase; classtype:trojan-activity; sid:100003394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3004cdd743a543f5&resid=3004cdd743a543f5%21170&authkey=ao8vz-4rkwuiyn8",nocase; classtype:trojan-activity; sid:100003395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!320&authkey=aooujzuf408dclw",nocase; classtype:trojan-activity; sid:100003396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!321&authkey=almpxnbtsbzauna",nocase; classtype:trojan-activity; sid:100003397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21320&authkey=aooujzuf408dclw",nocase; classtype:trojan-activity; sid:100003398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21321&authkey=almpxnbtsbzauna",nocase; classtype:trojan-activity; sid:100003399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3164ddeba70d2263&resid=3164ddeba70d2263%21106&authkey=afkvqrm4zoor8qq",nocase; classtype:trojan-activity; sid:100003400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=31771958ea3373a1&resid=31771958ea3373a1%21108&authkey=aiofxduo9rdb_-o",nocase; classtype:trojan-activity; sid:100003401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1!223&authkey=aajr842bzum0yg8",nocase; classtype:trojan-activity; sid:100003402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1%21223&authkey=aajr842bzum0yg8",nocase; classtype:trojan-activity; sid:100003403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=34207675f7506d94&resid=34207675f7506d94%21137&authkey=angxnhqpe2x5koc",nocase; classtype:trojan-activity; sid:100003404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3447601ab357f8c1&resid=3447601ab357f8c1!114&authkey=aitwerxd-t2cxl0",nocase; classtype:trojan-activity; sid:100003405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8",nocase; classtype:trojan-activity; sid:100003406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8,standard,n/a,n/a,urlhaus",nocase; classtype:trojan-activity; sid:100003407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866!107&authkey=af08d9zk1yestqa",nocase; classtype:trojan-activity; sid:100003408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866%21107&authkey=af08d9zk1yestqa",nocase; classtype:trojan-activity; sid:100003409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c!139&authkey=ap4bbakgkikau-a",nocase; classtype:trojan-activity; sid:100003410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c%21139&authkey=ap4bbakgkikau-a",nocase; classtype:trojan-activity; sid:100003411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!152&authkey=am09sv26njxzyn0",nocase; classtype:trojan-activity; sid:100003412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!153&authkey=ajs0jkoeqkqjrze",nocase; classtype:trojan-activity; sid:100003413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21152&authkey=am09sv26njxzyn0",nocase; classtype:trojan-activity; sid:100003414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21153&authkey=ajs0jkoeqkqjrze",nocase; classtype:trojan-activity; sid:100003415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3a1715e2cb964f25&resid=3a1715e2cb964f25%213713&authkey=aortxmfnibnoqkk",nocase; classtype:trojan-activity; sid:100003416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0!119&authkey=adkqcwv8_3k86z4",nocase; classtype:trojan-activity; sid:100003417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0%21119&authkey=adkqcwv8_3k86z4",nocase; classtype:trojan-activity; sid:100003418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21432&authkey=aa_npsupyqb2kge",nocase; classtype:trojan-activity; sid:100003419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21435&authkey=admsjhgpkbtcqzs",nocase; classtype:trojan-activity; sid:100003420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3ee68228c34c236d&resid=3ee68228c34c236d%21129&authkey=apll6hu3-xetzxu",nocase; classtype:trojan-activity; sid:100003421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f!154&authkey=aasj15d0g_p2pog",nocase; classtype:trojan-activity; sid:100003422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f%21154&authkey=aasj15d0g_p2pog",nocase; classtype:trojan-activity; sid:100003423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f!134&authkey=aaipzy8nllirlky",nocase; classtype:trojan-activity; sid:100003424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f%21134&authkey=aaipzy8nllirlky",nocase; classtype:trojan-activity; sid:100003425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm",nocase; classtype:trojan-activity; sid:100003426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm",nocase; classtype:trojan-activity; sid:100003427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik",nocase; classtype:trojan-activity; sid:100003428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy",nocase; classtype:trojan-activity; sid:100003429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0",nocase; classtype:trojan-activity; sid:100003430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw",nocase; classtype:trojan-activity; sid:100003431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw",nocase; classtype:trojan-activity; sid:100003432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y",nocase; classtype:trojan-activity; sid:100003433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13805&authkey=ae-zbfo2uwln_gg",nocase; classtype:trojan-activity; sid:100003434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13806&authkey=aakiq-ymrjjodns",nocase; classtype:trojan-activity; sid:100003435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113805&authkey=ae-zbfo2uwln_gg",nocase; classtype:trojan-activity; sid:100003436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113806&authkey=aakiq-ymrjjodns",nocase; classtype:trojan-activity; sid:100003437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4b676ea3ff139b93&resid=4b676ea3ff139b93!133&authkey=amfix63glytflgo",nocase; classtype:trojan-activity; sid:100003438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21127&authkey=ablg20r-aat_ob4",nocase; classtype:trojan-activity; sid:100003439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21131&authkey=akbwlkrrtso_bqm",nocase; classtype:trojan-activity; sid:100003440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4df11eda676a355f&resid=4df11eda676a355f!130&authkey=!akd6uxvljtlvpxu",nocase; classtype:trojan-activity; sid:100003441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b!108&authkey=anbjpqxg-iwr4g8",nocase; classtype:trojan-activity; sid:100003442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8",nocase; classtype:trojan-activity; sid:100003443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc",nocase; classtype:trojan-activity; sid:100003444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y",nocase; classtype:trojan-activity; sid:100003445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8",nocase; classtype:trojan-activity; sid:100003446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0",nocase; classtype:trojan-activity; sid:100003447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc",nocase; classtype:trojan-activity; sid:100003448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21119&authkey=amrs3-3hsvcmtfs",nocase; classtype:trojan-activity; sid:100003449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21158&authkey=aodderdrnvhruts",nocase; classtype:trojan-activity; sid:100003450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21161&authkey=agdsfxdnre82jjc",nocase; classtype:trojan-activity; sid:100003451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21192&authkey=agn2xvrvup-xvtg",nocase; classtype:trojan-activity; sid:100003452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21206&authkey=ai1r52mhtbdnm2y",nocase; classtype:trojan-activity; sid:100003453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21247&authkey=ae6weny1fa4pday",nocase; classtype:trojan-activity; sid:100003454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21252&authkey=aphl0oi4r6lrty0",nocase; classtype:trojan-activity; sid:100003455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21257&authkey=afnyvqwcghnyoas",nocase; classtype:trojan-activity; sid:100003456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21265&authkey=abxqdhlwiurjvve",nocase; classtype:trojan-activity; sid:100003457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21271&authkey=ae5qwlr5ceeptmy",nocase; classtype:trojan-activity; sid:100003458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21272&authkey=ahrqeoaynibwt14",nocase; classtype:trojan-activity; sid:100003459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21275&authkey=af_sgsaxsmaxg7i",nocase; classtype:trojan-activity; sid:100003460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21289&authkey=angyngbqixtrjaa",nocase; classtype:trojan-activity; sid:100003461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21293&authkey=acvh08asxosbwfu",nocase; classtype:trojan-activity; sid:100003462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21299&authkey=amicxuotubpok2c",nocase; classtype:trojan-activity; sid:100003463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21306&authkey=ahpivoukyerzcjy",nocase; classtype:trojan-activity; sid:100003464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21314&authkey=aex2uv2-eiofr8q",nocase; classtype:trojan-activity; sid:100003465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21332&authkey=ad0jmjxgbaebvbm",nocase; classtype:trojan-activity; sid:100003466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21335&authkey=ah0vupcfbdfa6g4",nocase; classtype:trojan-activity; sid:100003467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21357&authkey=ap8sswuqjjjexho",nocase; classtype:trojan-activity; sid:100003468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21366&authkey=aoblpmbmx7o_v18",nocase; classtype:trojan-activity; sid:100003469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21379&authkey=air-bsjj46et47q",nocase; classtype:trojan-activity; sid:100003470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21389&authkey=aduenohuq_rbyhm",nocase; classtype:trojan-activity; sid:100003471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21391&authkey=aa15sw51njbn_na",nocase; classtype:trojan-activity; sid:100003472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21392&authkey=abp0heeg6ybn0lk",nocase; classtype:trojan-activity; sid:100003473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21393&authkey=aa1pmur8sy8xtwe",nocase; classtype:trojan-activity; sid:100003474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212718&authkey=aie0v1d-cusuabi",nocase; classtype:trojan-activity; sid:100003475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212725&authkey=aanrz9et3bym3lc",nocase; classtype:trojan-activity; sid:100003476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212728&authkey=ahsmbkltfrwgqjc",nocase; classtype:trojan-activity; sid:100003477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!395&authkey=alwvub_yhtogjxw",nocase; classtype:trojan-activity; sid:100003478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!398&authkey=abaa_tjd7ohh4so",nocase; classtype:trojan-activity; sid:100003479; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!406&authkey=aarnp48wumgu6tq",nocase; classtype:trojan-activity; sid:100003480; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!415&authkey=aglzsd6-g0nzj7s",nocase; classtype:trojan-activity; sid:100003481; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!420&authkey=akk5droung_ecww",nocase; classtype:trojan-activity; sid:100003482; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!440&authkey=ai7-dpr11wnzyq8",nocase; classtype:trojan-activity; sid:100003483; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21395&authkey=alwvub_yhtogjxw",nocase; classtype:trojan-activity; sid:100003484; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21398&authkey=abaa_tjd7ohh4so",nocase; classtype:trojan-activity; sid:100003485; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21406&authkey=aarnp48wumgu6tq",nocase; classtype:trojan-activity; sid:100003486; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21415&authkey=aglzsd6-g0nzj7s",nocase; classtype:trojan-activity; sid:100003487; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21420&authkey=akk5droung_ecww",nocase; classtype:trojan-activity; sid:100003488; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21440&authkey=ai7-dpr11wnzyq8",nocase; classtype:trojan-activity; sid:100003489; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211121&authkey=al_fmezwfay4za4",nocase; classtype:trojan-activity; sid:100003490; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211122&authkey=anz_q5njlanv2mu",nocase; classtype:trojan-activity; sid:100003491; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21110&authkey=akars6koxqzdwgi",nocase; classtype:trojan-activity; sid:100003492; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21112&authkey=aadare1gec7nzy8",nocase; classtype:trojan-activity; sid:100003493; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8",nocase; classtype:trojan-activity; sid:100003494; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8&em=2",nocase; classtype:trojan-activity; sid:100003495; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d%21109&authkey=adriswrtwdpbuc8&em=2",nocase; classtype:trojan-activity; sid:100003496; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=53c5e6b8f6893887&resid=53c5e6b8f6893887!802&authkey=aapuufivkn2zwu8",nocase; classtype:trojan-activity; sid:100003497; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!106&authkey=anzlf1ksptbqok8",nocase; classtype:trojan-activity; sid:100003498; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!107&authkey=ag4dr58jrjuxfyq",nocase; classtype:trojan-activity; sid:100003499; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21106&authkey=anzlf1ksptbqok8",nocase; classtype:trojan-activity; sid:100003500; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21107&authkey=ag4dr58jrjuxfyq",nocase; classtype:trojan-activity; sid:100003501; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=547b1e4a6b15bf97&resid=547b1e4a6b15bf97%21106&authkey=akgsmzqhemioz8g",nocase; classtype:trojan-activity; sid:100003502; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=54f92c3a2f5d8033&resid=54f92c3a2f5d8033%21200&authkey=aofadhhfwlm2gum",nocase; classtype:trojan-activity; sid:100003503; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=55381ffd75ef8cda&resid=55381ffd75ef8cda!270&authkey=aev4isgyubiofdi",nocase; classtype:trojan-activity; sid:100003504; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613!157&authkey=an55tjzt-9vbjfy",nocase; classtype:trojan-activity; sid:100003505; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613%21156&authkey=agiuawekkbxb_4o",nocase; classtype:trojan-activity; sid:100003506; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=55c9feaf3907aae5&resid=55c9feaf3907aae5%21208&authkey=adwuyrapfdzkyoa",nocase; classtype:trojan-activity; sid:100003507; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950!280&authkey=advq4p3xhfhinq8",nocase; classtype:trojan-activity; sid:100003508; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950%21280&authkey=advq4p3xhfhinq8",nocase; classtype:trojan-activity; sid:100003509; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5629da828892367d&resid=5629da828892367d!803&authkey=aphjbq-bsg7ohpc",nocase; classtype:trojan-activity; sid:100003510; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21383&authkey=adldpuaya7kj1dk",nocase; classtype:trojan-activity; sid:100003511; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21384&authkey=alsuxvtsof32vea",nocase; classtype:trojan-activity; sid:100003512; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3599&authkey=am4yicme6lrjpki",nocase; classtype:trojan-activity; sid:100003513; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3604&authkey=al6pb71mtq4jr1s",nocase; classtype:trojan-activity; sid:100003514; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213599&authkey=am4yicme6lrjpki",nocase; classtype:trojan-activity; sid:100003515; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213604&authkey=al6pb71mtq4jr1s",nocase; classtype:trojan-activity; sid:100003516; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b!68197&authkey=aowpm7ocl_21-oc",nocase; classtype:trojan-activity; sid:100003517; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b%2168197&authkey=aowpm7ocl_21-oc",nocase; classtype:trojan-activity; sid:100003518; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=59389d626d829e8c&resid=59389d626d829e8c%212940&authkey=anx1ngd27vqeiwo",nocase; classtype:trojan-activity; sid:100003519; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211568&authkey=aemrnwoi75oflva",nocase; classtype:trojan-activity; sid:100003520; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211572&authkey=aelz-gxlrxcwtnc",nocase; classtype:trojan-activity; sid:100003521; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211573&authkey=ahksfdvda0doles",nocase; classtype:trojan-activity; sid:100003522; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5c5404bd403dbdc9&resid=5c5404bd403dbdc9!4464&authkey=ajskjf2hshbudeg",nocase; classtype:trojan-activity; sid:100003523; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!406&authkey=aeyeq5j9zfepgai",nocase; classtype:trojan-activity; sid:100003524; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!407&authkey=adnh8af-rvoxlcc",nocase; classtype:trojan-activity; sid:100003525; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21406&authkey=aeyeq5j9zfepgai",nocase; classtype:trojan-activity; sid:100003526; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21407&authkey=adnh8af-rvoxlcc",nocase; classtype:trojan-activity; sid:100003527; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21892&authkey=apwphufzjdtsedw",nocase; classtype:trojan-activity; sid:100003528; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21897&authkey=aomt6el1av5ruc8",nocase; classtype:trojan-activity; sid:100003529; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21121&authkey=adjzlorvgx_ezhq",nocase; classtype:trojan-activity; sid:100003530; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21123&authkey=ancfnepawtbmnug",nocase; classtype:trojan-activity; sid:100003531; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21124&authkey=ao7bknnuodxtfua",nocase; classtype:trojan-activity; sid:100003532; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe",nocase; classtype:trojan-activity; sid:100003533; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i",nocase; classtype:trojan-activity; sid:100003534; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8",nocase; classtype:trojan-activity; sid:100003535; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa",nocase; classtype:trojan-activity; sid:100003536; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe",nocase; classtype:trojan-activity; sid:100003537; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi",nocase; classtype:trojan-activity; sid:100003538; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e",nocase; classtype:trojan-activity; sid:100003539; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk",nocase; classtype:trojan-activity; sid:100003540; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4",nocase; classtype:trojan-activity; sid:100003541; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo",nocase; classtype:trojan-activity; sid:100003542; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2!517&authkey=akfewcyiwlwomyk",nocase; classtype:trojan-activity; sid:100003543; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21505&authkey=ag7xi3lcnvi_hji",nocase; classtype:trojan-activity; sid:100003544; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21517&authkey=akfewcyiwlwomyk",nocase; classtype:trojan-activity; sid:100003545; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad!1421&authkey=adixg2-asekemjw",nocase; classtype:trojan-activity; sid:100003546; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad%211421&authkey=adixg2-asekemjw",nocase; classtype:trojan-activity; sid:100003547; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213096&authkey=aob-cm9vv6erxqg",nocase; classtype:trojan-activity; sid:100003548; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213097&authkey=abcuevfyu6pdw70",nocase; classtype:trojan-activity; sid:100003549; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=69b503a3f081a183&resid=69b503a3f081a183%21111&authkey=aazm9wlg1rvgzoc",nocase; classtype:trojan-activity; sid:100003550; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!112&authkey=aasndgbcwol3mys",nocase; classtype:trojan-activity; sid:100003551; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!113&authkey=ak3tzu1lg4uuh5m",nocase; classtype:trojan-activity; sid:100003552; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21112&authkey=aasndgbcwol3mys",nocase; classtype:trojan-activity; sid:100003553; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21113&authkey=ak3tzu1lg4uuh5m",nocase; classtype:trojan-activity; sid:100003554; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21108&authkey=ameouv2jdxo5obw",nocase; classtype:trojan-activity; sid:100003555; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21119&authkey=aazzzrl7mv2xbwq",nocase; classtype:trojan-activity; sid:100003556; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a7b40a2bc530c6c&resid=6a7b40a2bc530c6c%21112&authkey=afuov36rbymlvxm",nocase; classtype:trojan-activity; sid:100003557; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3!118&authkey=aepf8f3mfmlsng0",nocase; classtype:trojan-activity; sid:100003558; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3%21118&authkey=aepf8f3mfmlsng0",nocase; classtype:trojan-activity; sid:100003559; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b61e983f930f79f&resid=6b61e983f930f79f!540&authkey=ap2n5w41ifew0i8",nocase; classtype:trojan-activity; sid:100003560; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7!1154&authkey=acnbdscb8-rbmcu",nocase; classtype:trojan-activity; sid:100003561; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7%211154&authkey=acnbdscb8-rbmcu",nocase; classtype:trojan-activity; sid:100003562; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21106&authkey=apvhok6edhtogfu",nocase; classtype:trojan-activity; sid:100003563; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21115&authkey=amc_k1nnlywdc4i",nocase; classtype:trojan-activity; sid:100003564; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=724b5c509337556e&resid=724b5c509337556e%21908&authkey=agcbb3nakpteyam",nocase; classtype:trojan-activity; sid:100003565; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7285f51e65036769&resid=7285f51e65036769%21264&authkey=akyjvrz006qlble",nocase; classtype:trojan-activity; sid:100003566; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21243&authkey=apivjmxivosek60",nocase; classtype:trojan-activity; sid:100003567; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21256&authkey=adljht0ogfq775k",nocase; classtype:trojan-activity; sid:100003568; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21260&authkey=aig6cydr4_e-qj8",nocase; classtype:trojan-activity; sid:100003569; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21262&authkey=ak4fiz1-a1ks8rg",nocase; classtype:trojan-activity; sid:100003570; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21264&authkey=aizkjymvlgqwpte",nocase; classtype:trojan-activity; sid:100003571; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!106&authkey=ahu5s4ttjvxbnxo",nocase; classtype:trojan-activity; sid:100003572; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!107&authkey=abj3eccentbeaqa",nocase; classtype:trojan-activity; sid:100003573; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!108&authkey=amvcygo4prlgt4i",nocase; classtype:trojan-activity; sid:100003574; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!110&authkey=ahzuehvk5nvzo90",nocase; classtype:trojan-activity; sid:100003575; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21106&authkey=ahu5s4ttjvxbnxo",nocase; classtype:trojan-activity; sid:100003576; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21107&authkey=abj3eccentbeaqa",nocase; classtype:trojan-activity; sid:100003577; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21108&authkey=amvcygo4prlgt4i",nocase; classtype:trojan-activity; sid:100003578; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21110&authkey=ahzuehvk5nvzo90",nocase; classtype:trojan-activity; sid:100003579; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=77518d098ad4dfb0&resid=77518d098ad4dfb0%21939&authkey=akzqobxxxn89z34",nocase; classtype:trojan-activity; sid:100003580; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21111&authkey=aggnhgqj6uhxm2w",nocase; classtype:trojan-activity; sid:100003581; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21112&authkey=abser1xtkpb3-ta",nocase; classtype:trojan-activity; sid:100003582; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21117&authkey=aivf1ddcvvu22em",nocase; classtype:trojan-activity; sid:100003583; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!119&authkey=aozjai26izprqto",nocase; classtype:trojan-activity; sid:100003584; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!120&authkey=ajj7ueqjvobgfum",nocase; classtype:trojan-activity; sid:100003585; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21119&authkey=aozjai26izprqto",nocase; classtype:trojan-activity; sid:100003586; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21120&authkey=ajj7ueqjvobgfum",nocase; classtype:trojan-activity; sid:100003587; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c1fc7da38ab958e&resid=7c1fc7da38ab958e!146&authkey=aktmjqz8n4s_sbm",nocase; classtype:trojan-activity; sid:100003588; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5295&authkey=aasceqj1mdodeuo",nocase; classtype:trojan-activity; sid:100003589; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5296&authkey=ank3vz5syaf6bny",nocase; classtype:trojan-activity; sid:100003590; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5298&authkey=albzyizuqczfv9s",nocase; classtype:trojan-activity; sid:100003591; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215295&authkey=aasceqj1mdodeuo",nocase; classtype:trojan-activity; sid:100003592; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215296&authkey=ank3vz5syaf6bny",nocase; classtype:trojan-activity; sid:100003593; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215298&authkey=albzyizuqczfv9s",nocase; classtype:trojan-activity; sid:100003594; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7d109f249b512466&resid=7d109f249b512466!543&authkey=acqc4xjghclmwbs",nocase; classtype:trojan-activity; sid:100003595; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7e81645429ac5a22&resid=7e81645429ac5a22%21105&authkey=aa691jwf5wqi80c",nocase; classtype:trojan-activity; sid:100003596; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7fed4fbea32e3c1e&resid=7fed4fbea32e3c1e%21107&authkey=aeoxfycpolifch0",nocase; classtype:trojan-activity; sid:100003597; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=806bac90dc071edf&resid=806bac90dc071edf!105&authkey=!ao7jyz6-licb8hq",nocase; classtype:trojan-activity; sid:100003598; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=81c2d8b116274e17&resid=81c2d8b116274e17%21107&authkey=aaqw-t4dx2sbvda",nocase; classtype:trojan-activity; sid:100003599; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=82977114b1af209d&resid=82977114b1af209d!220&authkey=abuin5vdedjughm",nocase; classtype:trojan-activity; sid:100003600; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=855b20b0e8399717&resid=855b20b0e8399717%21110&authkey=afhxx21ztsd7hbm",nocase; classtype:trojan-activity; sid:100003601; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=860a0980486c93fa&resid=860a0980486c93fa!303&authkey=!agcmlab4r6syfvk",nocase; classtype:trojan-activity; sid:100003602; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21164&authkey=agbeiinncf8ok_4",nocase; classtype:trojan-activity; sid:100003603; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21165&authkey=aiof8rdvxglnm-c",nocase; classtype:trojan-activity; sid:100003604; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4!2402&authkey=amigiam45mt6jia",nocase; classtype:trojan-activity; sid:100003605; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4%212402&authkey=amigiam45mt6jia",nocase; classtype:trojan-activity; sid:100003606; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4",nocase; classtype:trojan-activity; sid:100003607; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk",nocase; classtype:trojan-activity; sid:100003608; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk",nocase; classtype:trojan-activity; sid:100003609; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0",nocase; classtype:trojan-activity; sid:100003610; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s",nocase; classtype:trojan-activity; sid:100003611; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my",nocase; classtype:trojan-activity; sid:100003612; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25!130&authkey=ais_g9dqoddonsc",nocase; classtype:trojan-activity; sid:100003613; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21106&authkey=ahfgxp0p6nk0eby",nocase; classtype:trojan-activity; sid:100003614; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21109&authkey=akr1n3qxtmnttuo",nocase; classtype:trojan-activity; sid:100003615; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21113&authkey=ajpvf1h89sqstti",nocase; classtype:trojan-activity; sid:100003616; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!112&authkey=af43qpcgl0t2f5o",nocase; classtype:trojan-activity; sid:100003617; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!113&authkey=ag92_wxfvrsuix8",nocase; classtype:trojan-activity; sid:100003618; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21112&authkey=af43qpcgl0t2f5o",nocase; classtype:trojan-activity; sid:100003619; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21113&authkey=ag92_wxfvrsuix8",nocase; classtype:trojan-activity; sid:100003620; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21105&authkey=ah9x7rn0p03kd_m",nocase; classtype:trojan-activity; sid:100003621; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21110&authkey=ammswulpdsjeu4w",nocase; classtype:trojan-activity; sid:100003622; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3!107&authkey=ac-m9dlvo5l7wfk",nocase; classtype:trojan-activity; sid:100003623; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3%21107&authkey=ac-m9dlvo5l7wfk",nocase; classtype:trojan-activity; sid:100003624; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=96a54b19ff5f6bab&resid=96a54b19ff5f6bab%21107&authkey=anxv07ez7s5sh_k",nocase; classtype:trojan-activity; sid:100003625; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli",nocase; classtype:trojan-activity; sid:100003626; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm",nocase; classtype:trojan-activity; sid:100003627; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue",nocase; classtype:trojan-activity; sid:100003628; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935!778&authkey=aaezyk4ypt-elma",nocase; classtype:trojan-activity; sid:100003629; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21772&authkey=akeozmv0aafqlbg",nocase; classtype:trojan-activity; sid:100003630; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21774&authkey=aly_m3fnrvh6dfq",nocase; classtype:trojan-activity; sid:100003631; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21775&authkey=abblpjxi4mwomgs",nocase; classtype:trojan-activity; sid:100003632; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21777&authkey=ahmuwqi4jg8rvho",nocase; classtype:trojan-activity; sid:100003633; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc",nocase; classtype:trojan-activity; sid:100003634; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w",nocase; classtype:trojan-activity; sid:100003635; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm",nocase; classtype:trojan-activity; sid:100003636; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211953&authkey=abdfqiyruwplpo0",nocase; classtype:trojan-activity; sid:100003637; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211954&authkey=aok-srkhxjazccy",nocase; classtype:trojan-activity; sid:100003638; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21172&authkey=ahharhcv0fmn5fm",nocase; classtype:trojan-activity; sid:100003639; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21173&authkey=aecb3qcquacvzhi",nocase; classtype:trojan-activity; sid:100003640; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21174&authkey=afv7cprqwxezgsi",nocase; classtype:trojan-activity; sid:100003641; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21177&authkey=als6_be40lt5jk8",nocase; classtype:trojan-activity; sid:100003642; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2!113&authkey=akeqdnxllfzf8hq",nocase; classtype:trojan-activity; sid:100003643; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2%21113&authkey=akeqdnxllfzf8hq",nocase; classtype:trojan-activity; sid:100003644; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9fb622acb27482ef&resid=9fb622acb27482ef%211197&authkey=aeacibxy2zlyxro",nocase; classtype:trojan-activity; sid:100003645; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9fba865c1fdce17f&resid=9fba865c1fdce17f%211109&authkey=achpeiyvsphyn9o",nocase; classtype:trojan-activity; sid:100003646; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a023fe2d1ac611f2&resid=a023fe2d1ac611f2!514&authkey=alaxh02uycquui4",nocase; classtype:trojan-activity; sid:100003647; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a04a98741fafee2b&resid=a04a98741fafee2b%211857&authkey=af3qhnjtfnffevi",nocase; classtype:trojan-activity; sid:100003648; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340!997&authkey=akw6btyej2zht08",nocase; classtype:trojan-activity; sid:100003649; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340%21997&authkey=akw6btyej2zht08",nocase; classtype:trojan-activity; sid:100003650; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a1c8c8055848b889&resid=a1c8c8055848b889!111&authkey=agzlftsgr4lspvo",nocase; classtype:trojan-activity; sid:100003651; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a2cd2cdb93584d7e&resid=a2cd2cdb93584d7e%21106&authkey=aeifpqbwo1s3dyq",nocase; classtype:trojan-activity; sid:100003652; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e!108&authkey=amcjnb2j1bd4tyu",nocase; classtype:trojan-activity; sid:100003653; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21107&authkey=ab9lanzt1aj_0ws",nocase; classtype:trojan-activity; sid:100003654; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21108&authkey=amcjnb2j1bd4tyu",nocase; classtype:trojan-activity; sid:100003655; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21109&authkey=afhg_ay2_zz0kkg",nocase; classtype:trojan-activity; sid:100003656; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211064&authkey=apebndb6tstxywi",nocase; classtype:trojan-activity; sid:100003657; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211065&authkey=aca4_dggi5gbbfs",nocase; classtype:trojan-activity; sid:100003658; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211067&authkey=ae-3ej9zzj4ibhw",nocase; classtype:trojan-activity; sid:100003659; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211069&authkey=agx6b8qjt_clm-o",nocase; classtype:trojan-activity; sid:100003660; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a502994ea313f5c7&resid=a502994ea313f5c7%21215&authkey=aiydvejv0l8stbs",nocase; classtype:trojan-activity; sid:100003661; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114!256&authkey=aapnly5qifymcvw",nocase; classtype:trojan-activity; sid:100003662; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21251&authkey=ainluv1ppu-8ogu",nocase; classtype:trojan-activity; sid:100003663; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21256&authkey=aapnly5qifymcvw",nocase; classtype:trojan-activity; sid:100003664; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21!6053&authkey=agfh0ahstj7rrki",nocase; classtype:trojan-activity; sid:100003665; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21%216053&authkey=agfh0ahstj7rrki",nocase; classtype:trojan-activity; sid:100003666; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi",nocase; classtype:trojan-activity; sid:100003667; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21414&authkey=akf9uwwkitvhrvc",nocase; classtype:trojan-activity; sid:100003668; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21415&authkey=ag_5kthuezprnoy",nocase; classtype:trojan-activity; sid:100003669; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21416&authkey=airlma-pycgfkyc",nocase; classtype:trojan-activity; sid:100003670; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21419&authkey=ab1-sgyv2gibyey",nocase; classtype:trojan-activity; sid:100003671; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21422&authkey=acphsmdy415izjg",nocase; classtype:trojan-activity; sid:100003672; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21424&authkey=afvfwz5uvde1pui",nocase; classtype:trojan-activity; sid:100003673; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818!129&authkey=aesewk3cf5vbrxw",nocase; classtype:trojan-activity; sid:100003674; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818%21129&authkey=aesewk3cf5vbrxw",nocase; classtype:trojan-activity; sid:100003675; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=aa4e252db942faec&resid=aa4e252db942faec%21168&authkey=anlnjo7xnwtswuk",nocase; classtype:trojan-activity; sid:100003676; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw",nocase; classtype:trojan-activity; sid:100003677; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992!113&authkey=agh9q_zzyjjcspc",nocase; classtype:trojan-activity; sid:100003678; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992%21113&authkey=agh9q_zzyjjcspc",nocase; classtype:trojan-activity; sid:100003679; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=af84ebf13dd5499c&resid=af84ebf13dd5499c!167&authkey=anqr_yvn_hdh2_e",nocase; classtype:trojan-activity; sid:100003680; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308!2152&authkey=abutaac83l5utks",nocase; classtype:trojan-activity; sid:100003681; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308%212152&authkey=abutaac83l5utks",nocase; classtype:trojan-activity; sid:100003682; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21650&authkey=aht-wbxsofyx33u",nocase; classtype:trojan-activity; sid:100003683; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21651&authkey=aebbyk6sevdmzgm",nocase; classtype:trojan-activity; sid:100003684; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21652&authkey=afsw5wahxo5kwjy",nocase; classtype:trojan-activity; sid:100003685; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b1c3a5ef115e135c&resid=b1c3a5ef115e135c%216219&authkey=ahr7bklirbub0pc",nocase; classtype:trojan-activity; sid:100003686; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21120&authkey=aozmspl2dqkgkgy",nocase; classtype:trojan-activity; sid:100003687; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21123&authkey=aj18p0rtfbtwa84",nocase; classtype:trojan-activity; sid:100003688; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21139&authkey=ahwfjvw4zmjukeo",nocase; classtype:trojan-activity; sid:100003689; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21140&authkey=aksvfpmrfqrrggw",nocase; classtype:trojan-activity; sid:100003690; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21141&authkey=acznh6clby0qyww",nocase; classtype:trojan-activity; sid:100003691; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21142&authkey=ajf7j1rr3d7jcxy",nocase; classtype:trojan-activity; sid:100003692; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21143&authkey=ahs21wnsqb_vu9w",nocase; classtype:trojan-activity; sid:100003693; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b50c4248502103d0&resid=b50c4248502103d0%21107&authkey=alf1nley7ja4dbq",nocase; classtype:trojan-activity; sid:100003694; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6!164&authkey=adfsfcdaw3biboy",nocase; classtype:trojan-activity; sid:100003695; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6%21164&authkey=adfsfcdaw3biboy",nocase; classtype:trojan-activity; sid:100003696; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b7cb31db66675eb4&resid=b7cb31db66675eb4%21922&authkey=aghayyucvwey7lg",nocase; classtype:trojan-activity; sid:100003697; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b86046e8cbd4254b&resid=b86046e8cbd4254b%21115&authkey=agwstptwpaquleg",nocase; classtype:trojan-activity; sid:100003698; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b!7521&authkey=ablt9zdyq2d4rb0",nocase; classtype:trojan-activity; sid:100003699; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0",nocase; classtype:trojan-activity; sid:100003700; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m",nocase; classtype:trojan-activity; sid:100003701; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8",nocase; classtype:trojan-activity; sid:100003702; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g",nocase; classtype:trojan-activity; sid:100003703; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g",nocase; classtype:trojan-activity; sid:100003704; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90",nocase; classtype:trojan-activity; sid:100003705; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b%21246&authkey=afyrchdutalpu90",nocase; classtype:trojan-activity; sid:100003706; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=bf83d9247c2329e0&resid=bf83d9247c2329e0%211108&authkey=absaw-bpqrc6mpq",nocase; classtype:trojan-activity; sid:100003707; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm",nocase; classtype:trojan-activity; sid:100003708; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai",nocase; classtype:trojan-activity; sid:100003709; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk",nocase; classtype:trojan-activity; sid:100003710; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa",nocase; classtype:trojan-activity; sid:100003711; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa",nocase; classtype:trojan-activity; sid:100003712; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e",nocase; classtype:trojan-activity; sid:100003713; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1338&authkey=ajngambosws75_c",nocase; classtype:trojan-activity; sid:100003714; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1340&authkey=al1ay3fbtude6d8",nocase; classtype:trojan-activity; sid:100003715; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1342&authkey=acpr_htn2jtaxfu",nocase; classtype:trojan-activity; sid:100003716; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1343&authkey=abodysrxu9l2xxu",nocase; classtype:trojan-activity; sid:100003717; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1344&authkey=aozerppd6mnokwy",nocase; classtype:trojan-activity; sid:100003718; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1345&authkey=aevvyhonxhtcdh0",nocase; classtype:trojan-activity; sid:100003719; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1346&authkey=achrnf5vlov1gf4",nocase; classtype:trojan-activity; sid:100003720; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1347&authkey=al-zge-ttvr921s",nocase; classtype:trojan-activity; sid:100003721; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211337&authkey=afnvu1fsuczht5e",nocase; classtype:trojan-activity; sid:100003722; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211338&authkey=ajngambosws75_c",nocase; classtype:trojan-activity; sid:100003723; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211340&authkey=al1ay3fbtude6d8",nocase; classtype:trojan-activity; sid:100003724; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211342&authkey=acpr_htn2jtaxfu",nocase; classtype:trojan-activity; sid:100003725; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211343&authkey=abodysrxu9l2xxu",nocase; classtype:trojan-activity; sid:100003726; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211344&authkey=aozerppd6mnokwy",nocase; classtype:trojan-activity; sid:100003727; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211345&authkey=aevvyhonxhtcdh0",nocase; classtype:trojan-activity; sid:100003728; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211346&authkey=achrnf5vlov1gf4",nocase; classtype:trojan-activity; sid:100003729; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211347&authkey=al-zge-ttvr921s",nocase; classtype:trojan-activity; sid:100003730; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c701663053a57d59&resid=c701663053a57d59%211009&authkey=ahowgkak7j0p2q8",nocase; classtype:trojan-activity; sid:100003731; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21486&authkey=amy4euf_rrlcykc",nocase; classtype:trojan-activity; sid:100003732; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21489&authkey=ako3anwfnqfohnc",nocase; classtype:trojan-activity; sid:100003733; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c80630c4d385fb9d&resid=c80630c4d385fb9d%21286&authkey=amgaucv8bld_5qs",nocase; classtype:trojan-activity; sid:100003734; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21546&authkey=aa6q-ryiifnet5m",nocase; classtype:trojan-activity; sid:100003735; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21547&authkey=aipm8qnwbgo4yga",nocase; classtype:trojan-activity; sid:100003736; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!355&authkey=aajjwf_sm4xdqdk",nocase; classtype:trojan-activity; sid:100003737; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!357&authkey=alw3vqqxz6myrle",nocase; classtype:trojan-activity; sid:100003738; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!362&authkey=alycl9izrvfl7oc",nocase; classtype:trojan-activity; sid:100003739; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21354&authkey=aa_ukeour7rex1s",nocase; classtype:trojan-activity; sid:100003740; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21355&authkey=aajjwf_sm4xdqdk",nocase; classtype:trojan-activity; sid:100003741; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21357&authkey=alw3vqqxz6myrle",nocase; classtype:trojan-activity; sid:100003742; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21362&authkey=alycl9izrvfl7oc",nocase; classtype:trojan-activity; sid:100003743; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca897bdd16fc7940&resid=ca897bdd16fc7940%21106&authkey=aniklpt8vtlahbg",nocase; classtype:trojan-activity; sid:100003744; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2!109&authkey=ac4gxwjoopafr9a",nocase; classtype:trojan-activity; sid:100003745; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2%21109&authkey=ac4gxwjoopafr9a",nocase; classtype:trojan-activity; sid:100003746; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cbb66cac420484bc&resid=cbb66cac420484bc!10968&authkey=aj9bjkobu-rlnaw",nocase; classtype:trojan-activity; sid:100003747; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c!44331&authkey=afohia-wo-alwiy",nocase; classtype:trojan-activity; sid:100003748; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c%2144331&authkey=afohia-wo-alwiy",nocase; classtype:trojan-activity; sid:100003749; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!742&authkey=akbxju17f8g0r2s",nocase; classtype:trojan-activity; sid:100003750; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!744&authkey=adak4zftd0yhhhs",nocase; classtype:trojan-activity; sid:100003751; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21742&authkey=akbxju17f8g0r2s",nocase; classtype:trojan-activity; sid:100003752; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21744&authkey=adak4zftd0yhhhs",nocase; classtype:trojan-activity; sid:100003753; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!872&authkey=ap9hchztywo8zuo",nocase; classtype:trojan-activity; sid:100003754; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!874&authkey=alkzcbxz-dscgum",nocase; classtype:trojan-activity; sid:100003755; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!875&authkey=aka55ybdhqnoc6c",nocase; classtype:trojan-activity; sid:100003756; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21872&authkey=ap9hchztywo8zuo",nocase; classtype:trojan-activity; sid:100003757; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21874&authkey=alkzcbxz-dscgum",nocase; classtype:trojan-activity; sid:100003758; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21875&authkey=aka55ybdhqnoc6c",nocase; classtype:trojan-activity; sid:100003759; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!499&authkey=adegfbfx54fy3qu",nocase; classtype:trojan-activity; sid:100003760; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!510&authkey=aamxlkp3spxmvxc",nocase; classtype:trojan-activity; sid:100003761; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb%21510&authkey=aamxlkp3spxmvxc",nocase; classtype:trojan-activity; sid:100003762; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d2f3748954f6f8a8&resid=d2f3748954f6f8a8%21119&authkey=aex5s9uoun2zps0",nocase; classtype:trojan-activity; sid:100003763; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d4d413b6e7cf7088&resid=d4d413b6e7cf7088%211271&authkey=akz65bxpgvdxjb8",nocase; classtype:trojan-activity; sid:100003764; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!191&authkey=ajl2uegqunsgc3q",nocase; classtype:trojan-activity; sid:100003765; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!192&authkey=acd_hx4bka3z0nw",nocase; classtype:trojan-activity; sid:100003766; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q",nocase; classtype:trojan-activity; sid:100003767; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw",nocase; classtype:trojan-activity; sid:100003768; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy",nocase; classtype:trojan-activity; sid:100003769; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!141&authkey=alya4infudqs53o",nocase; classtype:trojan-activity; sid:100003770; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!142&authkey=aiemnxi-s-5vrz0",nocase; classtype:trojan-activity; sid:100003771; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21141&authkey=alya4infudqs53o",nocase; classtype:trojan-activity; sid:100003772; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0",nocase; classtype:trojan-activity; sid:100003773; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0&c=3ii9gcd&r=5onulz3wldybwlmup37su3&k=7s1&s=kzymn52eroemh1tamvmlsfsn9jtvwguukky5hlxcfgw",nocase; classtype:trojan-activity; sid:100003774; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe",nocase; classtype:trojan-activity; sid:100003775; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq",nocase; classtype:trojan-activity; sid:100003776; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4",nocase; classtype:trojan-activity; sid:100003777; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dcd65237fcd1a1a9&resid=dcd65237fcd1a1a9%21162&authkey=aprqs0hugnfo6uq",nocase; classtype:trojan-activity; sid:100003778; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7527&authkey=aipybipwht56um8",nocase; classtype:trojan-activity; sid:100003779; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7530&authkey=am9p2ic6zdkgfmy",nocase; classtype:trojan-activity; sid:100003780; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7532&authkey=aonjnubquvon_uk",nocase; classtype:trojan-activity; sid:100003781; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217527&authkey=aipybipwht56um8",nocase; classtype:trojan-activity; sid:100003782; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217530&authkey=am9p2ic6zdkgfmy",nocase; classtype:trojan-activity; sid:100003783; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217532&authkey=aonjnubquvon_uk",nocase; classtype:trojan-activity; sid:100003784; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2!1818&authkey=anh2wga7qmhbmuo",nocase; classtype:trojan-activity; sid:100003785; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2%211818&authkey=anh2wga7qmhbmuo",nocase; classtype:trojan-activity; sid:100003786; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21107&authkey=akrabrcroiddkxw",nocase; classtype:trojan-activity; sid:100003787; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21115&authkey=ad1ncwtj_zcjsh0",nocase; classtype:trojan-activity; sid:100003788; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21132&authkey=akpbxohbtjebyn4",nocase; classtype:trojan-activity; sid:100003789; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21150&authkey=aevazjbqnu7cmjs",nocase; classtype:trojan-activity; sid:100003790; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21160&authkey=aiendf-9lyln0x0",nocase; classtype:trojan-activity; sid:100003791; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e1065ab3e86a5fc2&resid=e1065ab3e86a5fc2%211443&authkey=apybkcvf4iwxp_q",nocase; classtype:trojan-activity; sid:100003792; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2!107&authkey=af-bicrg1c6vgck",nocase; classtype:trojan-activity; sid:100003793; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2%21107&authkey=af-bicrg1c6vgck",nocase; classtype:trojan-activity; sid:100003794; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2!129&authkey=afk5vdt49soo3co",nocase; classtype:trojan-activity; sid:100003795; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2%21129&authkey=afk5vdt49soo3co",nocase; classtype:trojan-activity; sid:100003796; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e3ddc3980f743711&resid=e3ddc3980f743711%21795&authkey=aptivsvyk2we5xc",nocase; classtype:trojan-activity; sid:100003797; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21745&authkey=ah1i_jo73zgdxpc",nocase; classtype:trojan-activity; sid:100003798; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21746&authkey=ag1mhwlznwdxpw0",nocase; classtype:trojan-activity; sid:100003799; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e43694f4bd6f68d1&resid=e43694f4bd6f68d1!563&authkey=aj8ovsob9ll6r-c",nocase; classtype:trojan-activity; sid:100003800; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!509&authkey=akmdyqkzcsuf_gg",nocase; classtype:trojan-activity; sid:100003801; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!511&authkey=agfs0q7dz7os1lu",nocase; classtype:trojan-activity; sid:100003802; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c%21511&authkey=agfs0q7dz7os1lu",nocase; classtype:trojan-activity; sid:100003803; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e54ea4e0368d023b&resid=e54ea4e0368d023b%21106&authkey=aozas6g9pm0fzvq",nocase; classtype:trojan-activity; sid:100003804; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha",nocase; classtype:trojan-activity; sid:100003805; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha",nocase; classtype:trojan-activity; sid:100003806; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke",nocase; classtype:trojan-activity; sid:100003807; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da",nocase; classtype:trojan-activity; sid:100003808; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu",nocase; classtype:trojan-activity; sid:100003809; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu",nocase; classtype:trojan-activity; sid:100003810; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!148&authkey=agjcwq650c8wdbm",nocase; classtype:trojan-activity; sid:100003811; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!150&authkey=ami5aqoinvosjle",nocase; classtype:trojan-activity; sid:100003812; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21148&authkey=agjcwq650c8wdbm",nocase; classtype:trojan-activity; sid:100003813; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21150&authkey=ami5aqoinvosjle",nocase; classtype:trojan-activity; sid:100003814; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e97110434470423e&resid=e97110434470423e%21113&authkey=afowclex54if0g0",nocase; classtype:trojan-activity; sid:100003815; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33!1192&authkey=apnhep6fmmxxdkw",nocase; classtype:trojan-activity; sid:100003816; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33%211192&authkey=apnhep6fmmxxdkw",nocase; classtype:trojan-activity; sid:100003817; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211215&authkey=ac1jr_bieufz0ai",nocase; classtype:trojan-activity; sid:100003818; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211219&authkey=akgo75rmvr4khlc",nocase; classtype:trojan-activity; sid:100003819; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ebacca5dec27fd20&resid=ebacca5dec27fd20%2118735&authkey=ajfyl1mzidnylc8",nocase; classtype:trojan-activity; sid:100003820; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21113&authkey=aovavpmokd2jrns",nocase; classtype:trojan-activity; sid:100003821; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21116&authkey=aadnj5xyfasugu8",nocase; classtype:trojan-activity; sid:100003822; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4",nocase; classtype:trojan-activity; sid:100003823; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8",nocase; classtype:trojan-activity; sid:100003824; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!204&authkey=ad0nbzlscbg-0sa",nocase; classtype:trojan-activity; sid:100003825; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21202&authkey=ah1gjq8j29darw4",nocase; classtype:trojan-activity; sid:100003826; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21203&authkey=af8xr99mrqp8um8",nocase; classtype:trojan-activity; sid:100003827; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21204&authkey=ad0nbzlscbg-0sa",nocase; classtype:trojan-activity; sid:100003828; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21489&authkey=ads_gff3tjkd0w0",nocase; classtype:trojan-activity; sid:100003829; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21490&authkey=aj_rld7xooge6aw",nocase; classtype:trojan-activity; sid:100003830; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21492&authkey=ahdb75ptd1_uc8e",nocase; classtype:trojan-activity; sid:100003831; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f06038a5f7dbd6d6&resid=f06038a5f7dbd6d6%215498&authkey=aiozi3z5qzdysmu",nocase; classtype:trojan-activity; sid:100003832; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f293cebb54e5ea71&resid=f293cebb54e5ea71%21293&authkey=aha74rsqiuewnpq",nocase; classtype:trojan-activity; sid:100003833; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21566&authkey=aevafh7rydhi19k",nocase; classtype:trojan-activity; sid:100003834; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21581&authkey=agx0b8ho87w4uie",nocase; classtype:trojan-activity; sid:100003835; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21582&authkey=af-9_xwysl1o7-c",nocase; classtype:trojan-activity; sid:100003836; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21598&authkey=ah-gkc-b7fa8h-g",nocase; classtype:trojan-activity; sid:100003837; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21599&authkey=aajunhe1ex_-zta",nocase; classtype:trojan-activity; sid:100003838; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f79e41c0e32d3314&resid=f79e41c0e32d3314%211182&authkey=aiqtptberyvlgqk&em=2%22",nocase; classtype:trojan-activity; sid:100003839; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806!1368&authkey=anphh1fijhvzv6c",nocase; classtype:trojan-activity; sid:100003840; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806%211368&authkey=anphh1fijhvzv6c",nocase; classtype:trojan-activity; sid:100003841; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382!159&authkey=ai4_8srrzf48hw0",nocase; classtype:trojan-activity; sid:100003842; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382%21159&authkey=ai4_8srrzf48hw0",nocase; classtype:trojan-activity; sid:100003843; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fb2177c192eed796&resid=fb2177c192eed796%21124&authkey=abotnmdhu_tg7bc",nocase; classtype:trojan-activity; sid:100003844; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fd50774e5ce0e314&resid=fd50774e5ce0e314%21778&authkey=aoxb2vhhz3qodiu",nocase; classtype:trojan-activity; sid:100003845; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fd67fafc46d3c687&resid=fd67fafc46d3c687%21473&authkey=aoid_cp-jgffqvm",nocase; classtype:trojan-activity; sid:100003846; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!847&authkey=aemnhwbhlskovgm",nocase; classtype:trojan-activity; sid:100003847; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!848&authkey=ag1_e421v-t5r9w",nocase; classtype:trojan-activity; sid:100003848; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21847&authkey=aemnhwbhlskovgm",nocase; classtype:trojan-activity; sid:100003849; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21848&authkey=ag1_e421v-t5r9w",nocase; classtype:trojan-activity; sid:100003850; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fe85161c3947f2c1&resid=fe85161c3947f2c1%211441&authkey=agb6c1ecr91svrw",nocase; classtype:trojan-activity; sid:100003851; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!693&authkey=agcpkhnewfte_yc",nocase; classtype:trojan-activity; sid:100003852; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!694&authkey=aa5jqzjsp0esr1s",nocase; classtype:trojan-activity; sid:100003853; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21693&authkey=agcpkhnewfte_yc",nocase; classtype:trojan-activity; sid:100003854; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21694&authkey=aa5jqzjsp0esr1s",nocase; classtype:trojan-activity; sid:100003855; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!330&authkey=adxnzkb0a09pizw",nocase; classtype:trojan-activity; sid:100003856; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!334&authkey=agsvox_t7qim4ta",nocase; classtype:trojan-activity; sid:100003857; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!335&authkey=ach14e6omcghwgg",nocase; classtype:trojan-activity; sid:100003858; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21330&authkey=adxnzkb0a09pizw",nocase; classtype:trojan-activity; sid:100003859; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21333&authkey=aielwtaiuvcttlm",nocase; classtype:trojan-activity; sid:100003860; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21334&authkey=agsvox_t7qim4ta",nocase; classtype:trojan-activity; sid:100003861; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pastebin.com",nocase; http_uri; content:"/raw/77jhk0iw",nocase; classtype:trojan-activity; sid:100003862; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pastebin.com",nocase; http_uri; content:"/raw/89hkc7wb",nocase; classtype:trojan-activity; sid:100003863; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pastebin.com",nocase; http_uri; content:"/raw/yqvsvlvq",nocase; classtype:trojan-activity; sid:100003864; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pierreconsulting.info",nocase; http_uri; content:"/wp-admin/llc/mwcacs65xienqdp/",nocase; classtype:trojan-activity; sid:100003865; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"procrossover.ru",nocase; http_uri; content:"/wp-content/uploads/2020/10/skoda22.jpg",nocase; classtype:trojan-activity; sid:100003866; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"procrossover.ru",nocase; http_uri; content:"/wp-content/uploads/2020/10/skodaqq.jpg",nocase; classtype:trojan-activity; sid:100003867; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"qjbutterflyevents.co.za",nocase; http_uri; content:"/wp-admin/zzcoiatsr5wujrwagsgbnm2wkjxldvgu/",nocase; classtype:trojan-activity; sid:100003868; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"quen.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/dhlshipmentawb80326979402.ace",nocase; classtype:trojan-activity; sid:100003869; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"quen.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/maersk-bl+draft-copy-shipping-documents.ace",nocase; classtype:trojan-activity; sid:100003870; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"quen.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/po+for+april+shipment.ace",nocase; classtype:trojan-activity; sid:100003871; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/arntsonl/calc_security_poc/master/dll/calc.dll",nocase; classtype:trojan-activity; sid:100003872; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/bero1985/berotinypascal/e34bd4164f4b7c27e7cf667dffd9274d33d6dfbe/bin/btpc.exe",nocase; classtype:trojan-activity; sid:100003873; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/evil-coder66/defendercontrol/main/defendercontrol.exe",nocase; classtype:trojan-activity; sid:100003874; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/fuzzbunch/fuzzbunch/master/payloads/doublepulsar-1.3.1.exe",nocase; classtype:trojan-activity; sid:100003875; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/inquisb/shellcodeexec/master/windows/shellcodeexec.x32.exe",nocase; classtype:trojan-activity; sid:100003876; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/malwares/webshell/master/ajax_php%20command%20shell.rar",nocase; classtype:trojan-activity; sid:100003877; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/myqseeaccount/one/main/one.htm",nocase; classtype:trojan-activity; sid:100003878; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/realtek25556/rhti2/gh-pages/90hfnvo69vk2ot.bmp",nocase; classtype:trojan-activity; sid:100003879; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/secwiki/windows-kernel-exploits/master/ms15-076/binary/trebuchet.exe",nocase; classtype:trojan-activity; sid:100003880; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/secwiki/windows-kernel-exploits/master/ms16-098/bfill.exe",nocase; classtype:trojan-activity; sid:100003881; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/tennc/webshell/master/other/small_shell.txt",nocase; classtype:trojan-activity; sid:100003882; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"res.yeshen.com",nocase; http_uri; content:"/player/launch/2017/09/12/da5f9a1c23034353852750488feeaf36.exe",nocase; classtype:trojan-activity; sid:100003883; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sendspace.com",nocase; http_uri; content:"/pro/dl/q05z91",nocase; classtype:trojan-activity; sid:100003884; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"shribharatvatika.com",nocase; http_uri; content:"/ey4lpx8rx.zip",nocase; classtype:trojan-activity; sid:100003885; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/stormqk/dn/stormagent.apk?attredirects=0",nocase; classtype:trojan-activity; sid:100003886; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6ca94027662tilxa4p/base.txt",nocase; classtype:trojan-activity; sid:100003887; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6cbd811626fvoj29vw/base64.txt",nocase; classtype:trojan-activity; sid:100003888; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6cd19c87f44r9fomit/base64jef.txt",nocase; classtype:trojan-activity; sid:100003889; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6e2cbda22efxk3t7x2/base64.txt",nocase; classtype:trojan-activity; sid:100003890; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6e2f6c8c5adup2yiwx/basejefin.txt",nocase; classtype:trojan-activity; sid:100003891; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6eab37b8dadmy1gx7c/base3.5.txt",nocase; classtype:trojan-activity; sid:100003892; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6eb2aa215a8cvwcf6s/fudjs.txt",nocase; classtype:trojan-activity; sid:100003893; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6fd6b4eb1c08aamus8/go.jpeg",nocase; classtype:trojan-activity; sid:100003894; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c7921a2cf26cunjcgvm/nanocoregomes.txt",nocase; classtype:trojan-activity; sid:100003895; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c9e24cc08a4dlmv7cjo/cdt.txt",nocase; classtype:trojan-activity; sid:100003896; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"technologydistilled.com",nocase; http_uri; content:"/a-nurse-ss8d9/z/",nocase; classtype:trojan-activity; sid:100003897; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tsrv4.ws",nocase; http_uri; content:"/23.exe",nocase; classtype:trojan-activity; sid:100003898; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"users.skynet.be",nocase; http_uri; content:"/crisanar/defis/jek_crackme1.7.zip",nocase; classtype:trojan-activity; sid:100003899; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"vniel.co.kr",nocase; http_uri; content:"/gnuboard/data/scan/amowvegfrt9ja/",nocase; classtype:trojan-activity; sid:100003900; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"vniel.co.kr",nocase; http_uri; content:"/gnuboard/data/scan/fu6jvxzzs46uqlp7l/",nocase; classtype:trojan-activity; sid:100003901; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"web.mit.edu",nocase; http_uri; content:"/kolya/.f/root/net.mit.edu/net/user/chris/winnt/mit_agenda2a.doc",nocase; classtype:trojan-activity; sid:100003902; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"web.mit.edu",nocase; http_uri; content:"/kolya/.f/root/net.mit.edu/sipb/user/kolya/afs/root.afs/net/user/chris/winnt/mit_agenda2a.doc",nocase; classtype:trojan-activity; sid:100003903; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/136_140/flt_shovemydiscoupyourarse.exe",nocase; classtype:trojan-activity; sid:100003904; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/136_140/kb%5efr_ouverture.exe",nocase; classtype:trojan-activity; sid:100003905; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/136_140/kb^fr_ouverture.exe",nocase; classtype:trojan-activity; sid:100003906; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/146_150/bc_memories_from_the_mcp.exe",nocase; classtype:trojan-activity; sid:100003907; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/151_155/tidex_-_short_stuff.exe",nocase; classtype:trojan-activity; sid:100003908; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wikileaks.org",nocase; http_uri; content:"/syria-files/attach/222/222051_instruction.zip",nocase; classtype:trojan-activity; sid:100003909; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yp.hnggzyjy.cn",nocase; http_uri; content:"/common/yz.vbs",nocase; classtype:trojan-activity; sid:100003910; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wp.readhere.in",nocase; classtype:trojan-activity; sid:100003073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wpdemo.101clients.com.au",nocase; classtype:trojan-activity; sid:100003074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"writtendeer.com",nocase; classtype:trojan-activity; sid:100003075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ws5588.f3322.net",nocase; classtype:trojan-activity; sid:100003076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wsdyalgreenkelveskxz.dns.army",nocase; classtype:trojan-activity; sid:100003077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wsdykungsb2talenwsjf.dns.army",nocase; classtype:trojan-activity; sid:100003078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wsdyrkkrgorgiousejhd.dns.army",nocase; classtype:trojan-activity; sid:100003079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wsdysara1investvwsfs.dns.army",nocase; classtype:trojan-activity; sid:100003080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wsdysuresbonescagegp.dns.army",nocase; classtype:trojan-activity; sid:100003081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wyklej.pl",nocase; classtype:trojan-activity; sid:100003082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"x2vn.com",nocase; classtype:trojan-activity; sid:100003083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xia.beihaixue.com",nocase; classtype:trojan-activity; sid:100003084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xixaoclothing.com",nocase; classtype:trojan-activity; sid:100003085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xk.996is.com",nocase; classtype:trojan-activity; sid:100003086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xn--80akinnkiib6h.xn--90ais",nocase; classtype:trojan-activity; sid:100003087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"xn--polimerbizmimarlk-rvc.com",nocase; classtype:trojan-activity; sid:100003088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ybom.urbanolab.com",nocase; classtype:trojan-activity; sid:100003089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yeichner.com",nocase; classtype:trojan-activity; sid:100003090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ylfpremium.com",nocase; classtype:trojan-activity; sid:100003091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yoast.yourpageserver.com",nocase; classtype:trojan-activity; sid:100003092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"youtubetrainingacademy.com",nocase; classtype:trojan-activity; sid:100003093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yskadvisors.com",nocase; classtype:trojan-activity; sid:100003094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yummyyogaudaipur.com",nocase; classtype:trojan-activity; sid:100003095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yzkzixun.com",nocase; classtype:trojan-activity; sid:100003096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"zmedcoach.com",nocase; classtype:trojan-activity; sid:100003097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"zytrox.tk",nocase; classtype:trojan-activity; sid:100003098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"zz.690tx.com",nocase; classtype:trojan-activity; sid:100003099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.indexsinas.me:811",nocase; http_uri; content:"/64.exe",nocase; classtype:trojan-activity; sid:100003100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.indexsinas.me:811",nocase; http_uri; content:"/86.exe",nocase; classtype:trojan-activity; sid:100003101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"2.indexsinas.me:811",nocase; http_uri; content:"/c64.exe",nocase; classtype:trojan-activity; sid:100003102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"amumufree.weebly.com",nocase; http_uri; content:"/uploads/8/1/2/9/81294208/growtopiastaff_setup1.61.exe",nocase; classtype:trojan-activity; sid:100003103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"analogx.com",nocase; http_uri; content:"/files/proxyi.exe",nocase; classtype:trojan-activity; sid:100003104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/abernathyjorge711/y6788/downloads/bubblebrowserext1.0.exe",nocase; classtype:trojan-activity; sid:100003105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/dvdfv/anjj/downloads/jami.exe",nocase; classtype:trojan-activity; sid:100003106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/heyhoeee/heyhoename1/downloads/1234.exe",nocase; classtype:trojan-activity; sid:100003107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/jpavelski/chpock/downloads/4.exe",nocase; classtype:trojan-activity; sid:100003108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/jpavelski/chpock/downloads/6.exe",nocase; classtype:trojan-activity; sid:100003109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/labesoftware/update/downloads/boost-fps.exe",nocase; classtype:trojan-activity; sid:100003110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/labesoftware/update/downloads/install_plugin_x64_x86.exe",nocase; classtype:trojan-activity; sid:100003111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/labesoftware/update/downloads/vpn_free.exe",nocase; classtype:trojan-activity; sid:100003112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/1.exe",nocase; classtype:trojan-activity; sid:100003113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/2.exe",nocase; classtype:trojan-activity; sid:100003114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/3.exe",nocase; classtype:trojan-activity; sid:100003115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/clr.exe",nocase; classtype:trojan-activity; sid:100003116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/dianthus.exe",nocase; classtype:trojan-activity; sid:100003117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/n.exe",nocase; classtype:trojan-activity; sid:100003118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/newred.exe",nocase; classtype:trojan-activity; sid:100003119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/omar.exe",nocase; classtype:trojan-activity; sid:100003120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/serv.exe",nocase; classtype:trojan-activity; sid:100003121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/test.exe",nocase; classtype:trojan-activity; sid:100003122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/updachrome.exe",nocase; classtype:trojan-activity; sid:100003123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/updatedata.exe",nocase; classtype:trojan-activity; sid:100003124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/updatev.exe",nocase; classtype:trojan-activity; sid:100003125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/work.exe",nocase; classtype:trojan-activity; sid:100003126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/mminminminmin05/testtest/downloads/ya.exe",nocase; classtype:trojan-activity; sid:100003127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/player2012/rumpa1/downloads/component.exe",nocase; classtype:trojan-activity; sid:100003128; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/player2012/rumpa1/downloads/nordvpnsetup.exe",nocase; classtype:trojan-activity; sid:100003129; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/player2012/rumpa1/downloads/regsvc.exe",nocase; classtype:trojan-activity; sid:100003130; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/skygaming/updates/downloads/update.exe",nocase; classtype:trojan-activity; sid:100003131; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/001.txt",nocase; classtype:trojan-activity; sid:100003132; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/1488.txt",nocase; classtype:trojan-activity; sid:100003133; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/1_cr.txt",nocase; classtype:trojan-activity; sid:100003134; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/1cr.txt",nocase; classtype:trojan-activity; sid:100003135; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/1fc2d.txt",nocase; classtype:trojan-activity; sid:100003136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/26a5.txt",nocase; classtype:trojan-activity; sid:100003137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/6e7_2021-01-19_18-04.txt",nocase; classtype:trojan-activity; sid:100003138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/abjects.txt",nocase; classtype:trojan-activity; sid:100003139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/attached.txt",nocase; classtype:trojan-activity; sid:100003140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/b7f2c.exe",nocase; classtype:trojan-activity; sid:100003141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/battletext.txt",nocase; classtype:trojan-activity; sid:100003142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/bkghj_nowin.exe",nocase; classtype:trojan-activity; sid:100003143; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/bsdasdasd333.exe",nocase; classtype:trojan-activity; sid:100003144; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/build.txt",nocase; classtype:trojan-activity; sid:100003145; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/build_makros.exe",nocase; classtype:trojan-activity; sid:100003146; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/build_silent.txt",nocase; classtype:trojan-activity; sid:100003147; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/build_sup.txt",nocase; classtype:trojan-activity; sid:100003148; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/buildcmobiler.exe",nocase; classtype:trojan-activity; sid:100003149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/buildcmobiler.txt",nocase; classtype:trojan-activity; sid:100003150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/buildcr.txt",nocase; classtype:trojan-activity; sid:100003151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/buildss.txt",nocase; classtype:trojan-activity; sid:100003152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/clientnik.txt",nocase; classtype:trojan-activity; sid:100003153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/clientrevers.txt",nocase; classtype:trojan-activity; sid:100003154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/dcrat.exe",nocase; classtype:trojan-activity; sid:100003155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/dllservices.exe",nocase; classtype:trojan-activity; sid:100003156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/dllservices2.exe",nocase; classtype:trojan-activity; sid:100003157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/exe_morris.mcdermott.exe",nocase; classtype:trojan-activity; sid:100003158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/hans.txt",nocase; classtype:trojan-activity; sid:100003159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/hulu.txt",nocase; classtype:trojan-activity; sid:100003160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/intelfive.txt",nocase; classtype:trojan-activity; sid:100003161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/intelfour.txt",nocase; classtype:trojan-activity; sid:100003162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/intelone.txt",nocase; classtype:trojan-activity; sid:100003163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/intelthree.txt",nocase; classtype:trojan-activity; sid:100003164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/inteltwo.txt",nocase; classtype:trojan-activity; sid:100003165; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/jjuufksfn.exe",nocase; classtype:trojan-activity; sid:100003166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/kleiman.exe",nocase; classtype:trojan-activity; sid:100003167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/lucky_fixed.exe",nocase; classtype:trojan-activity; sid:100003168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/notepadplus.txt",nocase; classtype:trojan-activity; sid:100003169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/osiris_qqkz_nauto.exe",nocase; classtype:trojan-activity; sid:100003170; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/out.exe",nocase; classtype:trojan-activity; sid:100003171; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/out.txt",nocase; classtype:trojan-activity; sid:100003172; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/pacbe_bin.txt",nocase; classtype:trojan-activity; sid:100003173; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/putty.txt",nocase; classtype:trojan-activity; sid:100003174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/rockethcd.txt",nocase; classtype:trojan-activity; sid:100003175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/scvhost900.exe",nocase; classtype:trojan-activity; sid:100003176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/sessionwin.exe",nocase; classtype:trojan-activity; sid:100003177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/siliculose.txt",nocase; classtype:trojan-activity; sid:100003178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/statemobi.txt",nocase; classtype:trojan-activity; sid:100003179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/stealers.exe",nocase; classtype:trojan-activity; sid:100003180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/stealers2.exe",nocase; classtype:trojan-activity; sid:100003181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/stgedo.exe",nocase; classtype:trojan-activity; sid:100003182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/svcperf.txt",nocase; classtype:trojan-activity; sid:100003183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/symptomaticshon5.exe",nocase; classtype:trojan-activity; sid:100003184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/taurjok.txt",nocase; classtype:trojan-activity; sid:100003185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/taurusbabac.exe",nocase; classtype:trojan-activity; sid:100003186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/telekiller.exe",nocase; classtype:trojan-activity; sid:100003187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/updateanddr.txt",nocase; classtype:trojan-activity; sid:100003188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/updateandr.txt",nocase; classtype:trojan-activity; sid:100003189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/vhajeja.txt",nocase; classtype:trojan-activity; sid:100003190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/word.txt",nocase; classtype:trojan-activity; sid:100003191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/www.txt",nocase; classtype:trojan-activity; sid:100003192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/tanake5518/fi/downloads/xlsd.txt",nocase; classtype:trojan-activity; sid:100003193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/teaserex/tease/downloads/b_kfmhkk172.bin",nocase; classtype:trojan-activity; sid:100003194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"bitbucket.org",nocase; http_uri; content:"/teaserex/tease/downloads/macro_xmprohiq27.bin",nocase; classtype:trojan-activity; sid:100003195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cd.textfiles.com",nocase; http_uri; content:"/hmatrix/data/hack1226.exe",nocase; classtype:trojan-activity; sid:100003196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/775238059083038744/821062129347067924/wxhyhyciuesjdefkxcqddvfbjqrofjq",nocase; classtype:trojan-activity; sid:100003197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/816070119281131570/816070273254162442/all.txt",nocase; classtype:trojan-activity; sid:100003198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/825372018244583454/826848185246023750/loaddd.exe",nocase; classtype:trojan-activity; sid:100003199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/825372018244583454/826848348342059008/zeppelin.exe",nocase; classtype:trojan-activity; sid:100003200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/825372018244583454/826848405258633277/build.exe",nocase; classtype:trojan-activity; sid:100003201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/826198252025675816/826537386485612574/china.png",nocase; classtype:trojan-activity; sid:100003202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/826376903400751108/826431600383361065/remcmcmcm_mjvbsmlrc45.bin",nocase; classtype:trojan-activity; sid:100003203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cdn.discordapp.com",nocase; http_uri; content:"/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe",nocase; classtype:trojan-activity; sid:100003204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"chiptune.com",nocase; http_uri; content:"/razor/rzr-winner_intro.zip",nocase; classtype:trojan-activity; sid:100003205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cloudme.com",nocase; http_uri; content:"/v1/ws2/:suengpen/:buyerlist.js/buyerlist.js.xz",nocase; classtype:trojan-activity; sid:100003206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"cloudme.com",nocase; http_uri; content:"/v1/ws2/:suengpen/:buyerlist1/buyerlist1.rar",nocase; classtype:trojan-activity; sid:100003207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"codeload.github.com",nocase; http_uri; content:"/meteoradminz/hidden-tear/zip/master",nocase; classtype:trojan-activity; sid:100003208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"colfincas.com",nocase; http_uri; content:"/tmp/protected-cek9qz4zvk2n65e-c5d84gi5/security-cloud/kypqw-52kkq0n9ywj9oa/",nocase; classtype:trojan-activity; sid:100003209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq",nocase; classtype:trojan-activity; sid:100003210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq",nocase; classtype:trojan-activity; sid:100003211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com.it-barcelona.com",nocase; http_uri; content:"/frm0reseen/prntscrnofamzorderid.jpg.exe",nocase; classtype:trojan-activity; sid:100003212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm",nocase; classtype:trojan-activity; sid:100003213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g",nocase; classtype:trojan-activity; sid:100003214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss",nocase; classtype:trojan-activity; sid:100003215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch",nocase; classtype:trojan-activity; sid:100003216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g",nocase; classtype:trojan-activity; sid:100003217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox",nocase; classtype:trojan-activity; sid:100003218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo",nocase; classtype:trojan-activity; sid:100003219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w",nocase; classtype:trojan-activity; sid:100003220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig",nocase; classtype:trojan-activity; sid:100003221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld",nocase; classtype:trojan-activity; sid:100003222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn",nocase; classtype:trojan-activity; sid:100003223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw",nocase; classtype:trojan-activity; sid:100003224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio",nocase; classtype:trojan-activity; sid:100003225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv",nocase; classtype:trojan-activity; sid:100003226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben",nocase; classtype:trojan-activity; sid:100003227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a",nocase; classtype:trojan-activity; sid:100003228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e",nocase; classtype:trojan-activity; sid:100003229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv",nocase; classtype:trojan-activity; sid:100003230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd",nocase; classtype:trojan-activity; sid:100003231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6",nocase; classtype:trojan-activity; sid:100003232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei",nocase; classtype:trojan-activity; sid:100003233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr",nocase; classtype:trojan-activity; sid:100003234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd",nocase; classtype:trojan-activity; sid:100003235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx",nocase; classtype:trojan-activity; sid:100003236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu",nocase; classtype:trojan-activity; sid:100003237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer",nocase; classtype:trojan-activity; sid:100003238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp",nocase; classtype:trojan-activity; sid:100003239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y",nocase; classtype:trojan-activity; sid:100003240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd",nocase; classtype:trojan-activity; sid:100003241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw",nocase; classtype:trojan-activity; sid:100003242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol",nocase; classtype:trojan-activity; sid:100003243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk",nocase; classtype:trojan-activity; sid:100003244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s",nocase; classtype:trojan-activity; sid:100003245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej",nocase; classtype:trojan-activity; sid:100003246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p",nocase; classtype:trojan-activity; sid:100003247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl",nocase; classtype:trojan-activity; sid:100003248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko",nocase; classtype:trojan-activity; sid:100003249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq",nocase; classtype:trojan-activity; sid:100003250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn",nocase; classtype:trojan-activity; sid:100003251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w",nocase; classtype:trojan-activity; sid:100003252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno",nocase; classtype:trojan-activity; sid:100003253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t",nocase; classtype:trojan-activity; sid:100003254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb",nocase; classtype:trojan-activity; sid:100003255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy",nocase; classtype:trojan-activity; sid:100003256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh",nocase; classtype:trojan-activity; sid:100003257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e",nocase; classtype:trojan-activity; sid:100003258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi",nocase; classtype:trojan-activity; sid:100003259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58",nocase; classtype:trojan-activity; sid:100003260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi",nocase; classtype:trojan-activity; sid:100003261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy",nocase; classtype:trojan-activity; sid:100003262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr",nocase; classtype:trojan-activity; sid:100003263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0",nocase; classtype:trojan-activity; sid:100003264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drpamelageorge.com",nocase; http_uri; content:"/wp-includes/1zilg/",nocase; classtype:trojan-activity; sid:100003265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"drpamelageorge.com",nocase; http_uri; content:"/wp-includes/qcgfmfvh/",nocase; classtype:trojan-activity; sid:100003266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"e-mudhra.com",nocase; http_uri; content:"/downloads/emclick.zip",nocase; classtype:trojan-activity; sid:100003267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"evertkok.nl",nocase; http_uri; content:"/informatica/informatica-actief/hoofdstuk1/extrasoftware/getallen.exe",nocase; classtype:trojan-activity; sid:100003268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"evertkok.nl",nocase; http_uri; content:"/informatica/informatica-actief/hoofdstuk2/software/hksetup.exe",nocase; classtype:trojan-activity; sid:100003269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"expeditionquest.com",nocase; http_uri; content:"/register/phpcaptcha/images/19dnqhg1p/sbhvtqlysxhxn/",nocase; classtype:trojan-activity; sid:100003270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"expeditionquest.com",nocase; http_uri; content:"/register/phpcaptcha/images/35egphpl5uzpvdmz9bncmvon3p/",nocase; classtype:trojan-activity; sid:100003271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"expeditionquest.com",nocase; http_uri; content:"/x/",nocase; classtype:trojan-activity; sid:100003272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exxonabnie.ir",nocase; http_uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf/",nocase; classtype:trojan-activity; sid:100003273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exxonabnie.ir",nocase; http_uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf//",nocase; classtype:trojan-activity; sid:100003274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exxonabnie.ir",nocase; http_uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf///",nocase; classtype:trojan-activity; sid:100003275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"exxonabnie.ir",nocase; http_uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf////",nocase; classtype:trojan-activity; sid:100003276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"file.elecfans.com",nocase; http_uri; content:"/web1/m00/8f/36/o4ybafy-2m2aarfzaahkaiik5pi122.exe",nocase; classtype:trojan-activity; sid:100003277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"files.constantcontact.com",nocase; http_uri; content:"/4cb7cebd101/e5fb4174-ab23-48e8-bf05-e80ec5fa2169.xls",nocase; classtype:trojan-activity; sid:100003278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"files.constantcontact.com",nocase; http_uri; content:"/ee304de9001/7e533e73-e272-4a44-9d9e-138cab64bf19.docx",nocase; classtype:trojan-activity; sid:100003279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"gist.githubusercontent.com",nocase; http_uri; content:"/zibri/19f9838ffd12349bb2c6c3afddc9388f/raw/01977fd3c7e036c3a38f062f626fd189ba1e1aa3/uefivar.exe",nocase; classtype:trojan-activity; sid:100003280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hqdecig.com",nocase; http_uri; content:"/cgi-bin/sni8w3fssb44iavmzss2nv0od6eiixlq6/",nocase; classtype:trojan-activity; sid:100003281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"hsecaravans.co.uk",nocase; http_uri; content:"/wp-admin/suy/",nocase; classtype:trojan-activity; sid:100003282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ia801802.us.archive.org",nocase; http_uri; content:"/19/items/startup_20210219/startup.txt",nocase; classtype:trojan-activity; sid:100003283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ie-best.net",nocase; http_uri; content:"/online-timer-kvhxz/ilxl/",nocase; classtype:trojan-activity; sid:100003284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"indonesias.me:9998",nocase; http_uri; content:"/64.exe",nocase; classtype:trojan-activity; sid:100003285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"indonesias.me:9998",nocase; http_uri; content:"/c64.exe",nocase; classtype:trojan-activity; sid:100003286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"insupportofchildren.co.uk",nocase; http_uri; content:"/v/bnun9t30zqx9t6z944g7o9z9o2plcrswmwuv9/",nocase; classtype:trojan-activity; sid:100003287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jcedu.org",nocase; http_uri; content:"/ebook/cs17.exe",nocase; classtype:trojan-activity; sid:100003288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jointings.org",nocase; http_uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/1",nocase; classtype:trojan-activity; sid:100003289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jointings.org",nocase; http_uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/2",nocase; classtype:trojan-activity; sid:100003290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"jointings.org",nocase; http_uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/3",nocase; classtype:trojan-activity; sid:100003291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"karmakoincodes.weebly.com",nocase; http_uri; content:"/uploads/3/2/8/8/3288864/karma_koin_codes.exe",nocase; classtype:trojan-activity; sid:100003292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kotakwarna.co.id",nocase; http_uri; content:"/dg/etrac/nf4emwz/",nocase; classtype:trojan-activity; sid:100003293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"ksh.hu",nocase; http_uri; content:"/docs/adatgyujtesek/elektra/csv_to_xml.exe",nocase; classtype:trojan-activity; sid:100003294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"kuaizip.com",nocase; http_uri; content:"/down/affiliate/kuaizip_setup_10029.exe",nocase; classtype:trojan-activity; sid:100003295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"linuxforensicsbook.com.s3.amazonaws.com",nocase; http_uri; content:"/linuxforensicscode.zip",nocase; classtype:trojan-activity; sid:100003296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lojavirtual.top",nocase; http_uri; content:"/dl8.exe",nocase; classtype:trojan-activity; sid:100003297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"lojavirtual.top",nocase; http_uri; content:"/dl8v2.exe",nocase; classtype:trojan-activity; sid:100003298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"marcostrombetta.com.br",nocase; http_uri; content:"/ds/1802.gif",nocase; classtype:trojan-activity; sid:100003299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"minpic.de",nocase; http_uri; content:"/k/big5/1giof6/",nocase; classtype:trojan-activity; sid:100003300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"miot2.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/order+00843112.ace",nocase; classtype:trojan-activity; sid:100003301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"miot2.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/shipping+docs(ci%2ccoo%2cbl%2cpl).ace",nocase; classtype:trojan-activity; sid:100003302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"morrobaydrugandgift.com",nocase; http_uri; content:"/wp-contentbak/t9m/",nocase; classtype:trojan-activity; sid:100003303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"my.cloudme.com",nocase; http_uri; content:"/v1/ws2/:gianni1962/:ie6setup/ie6setup.exe",nocase; classtype:trojan-activity; sid:100003304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nch.com.au",nocase; http_uri; content:"/components/aacenc.exe",nocase; classtype:trojan-activity; sid:100003305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nch.com.au",nocase; http_uri; content:"/components/doxillionsetup.exe",nocase; classtype:trojan-activity; sid:100003306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"newyarlfm.weebly.com",nocase; http_uri; content:"/uploads/4/1/6/6/4166984/keygen.exe",nocase; classtype:trojan-activity; sid:100003307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"nhipcauytevietnhat.com",nocase; http_uri; content:"/efficiency-all-iuehb/bjug3jyhuyilwhcqs3ykssaqqw7tpyvmypb91wtzdbluio1ekope5vrbbcx8zhdar9yt/",nocase; classtype:trojan-activity; sid:100003308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"note.youdao.com",nocase; http_uri; content:"/yws/api/personal/file/web3a243b322cf83ca7cae587a92916bac7?method=download&inline=true&sharekey=649ac0bb5d5b13d15cbf50b2609e193a",nocase; classtype:trojan-activity; sid:100003309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"oldschoolvalue.s3.amazonaws.com",nocase; http_uri; content:"/spreadsheets/osv_stock_valuation-sample-dummy.exe",nocase; classtype:trojan-activity; sid:100003310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm",nocase; classtype:trojan-activity; sid:100003311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm",nocase; classtype:trojan-activity; sid:100003312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa",nocase; classtype:trojan-activity; sid:100003313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq",nocase; classtype:trojan-activity; sid:100003314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe",nocase; classtype:trojan-activity; sid:100003315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=b4c15a27928f663b!230&authkey=ancu1eabetiubzg",nocase; classtype:trojan-activity; sid:100003316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=b4c15a27928f663b!231&authkey=ai9h3sk_luxran0",nocase; classtype:trojan-activity; sid:100003317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?&resid=c127f9e0fb7cbbea!214&authkey=aat73nvghhjdr9g",nocase; classtype:trojan-activity; sid:100003318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?authkey=!aase4ma0-vo_cls&cid=4df11eda676a355f&resid=4df11eda676a355f!140",nocase; classtype:trojan-activity; sid:100003319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?authkey=!akd6uxvljtlvpxu&cid=4df11eda676a355f&resid=4df11eda676a355f!130",nocase; classtype:trojan-activity; sid:100003320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?authkey=!aomvnemlpgwfuie&cid=4df11eda676a355f&resid=4df11eda676a355f!135",nocase; classtype:trojan-activity; sid:100003321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?authkey=adf5p_kn8rjf29y&cid=34224e3e49966a27&resid=34224e3e49966a27%211732",nocase; classtype:trojan-activity; sid:100003322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=013413cfbbbcfae4&resid=13413cfbbbcfae4%211656&authkey=ai9wpcp_k9okgk4",nocase; classtype:trojan-activity; sid:100003323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c!111&authkey=aemrwamaaaiyyjc",nocase; classtype:trojan-activity; sid:100003324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c%21111&authkey=aemrwamaaaiyyjc",nocase; classtype:trojan-activity; sid:100003325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0175cdbe2d2944c5&resid=175cdbe2d2944c5%21107&authkey=al6uptubjmmugo0",nocase; classtype:trojan-activity; sid:100003326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!157&authkey=aagcsm7chqez6uu",nocase; classtype:trojan-activity; sid:100003327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!158&authkey=amsoii5nr6pomhc",nocase; classtype:trojan-activity; sid:100003328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21157&authkey=aagcsm7chqez6uu",nocase; classtype:trojan-activity; sid:100003329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21158&authkey=amsoii5nr6pomhc",nocase; classtype:trojan-activity; sid:100003330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211177&authkey=am0i98nwgvzgqvq",nocase; classtype:trojan-activity; sid:100003331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211183&authkey=anv33trmzmi5cko",nocase; classtype:trojan-activity; sid:100003332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0319bb40eba80dcc&resid=319bb40eba80dcc%21110&authkey=ag8bs48lq9n-piw",nocase; classtype:trojan-activity; sid:100003333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0412fba39d6c52de&resid=412fba39d6c52de%2122008&authkey=amn2bgbswxwgpma",nocase; classtype:trojan-activity; sid:100003334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=045adcdfe91be4f5&resid=45adcdfe91be4f5%21318&authkey=aa6lutarluhyj48",nocase; classtype:trojan-activity; sid:100003335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0489c74de4facb30&resid=489c74de4facb30!109&authkey=ajo32arrzl_vwdq",nocase; classtype:trojan-activity; sid:100003336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=062a585e433edce3&resid=62a585e433edce3%211618&authkey=ahzfppat_uettfg",nocase; classtype:trojan-activity; sid:100003337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=087f57dcf1bd61bc&resid=87f57dcf1bd61bc!113&authkey=ap0wsc-rsiegllw",nocase; classtype:trojan-activity; sid:100003338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=09eebe7829f6351d&resid=9eebe7829f6351d%21827&authkey=amysfuvfuc5jezq",nocase; classtype:trojan-activity; sid:100003339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d!184&authkey=ackbiiarirejcam",nocase; classtype:trojan-activity; sid:100003340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d%21184&authkey=ackbiiarirejcam",nocase; classtype:trojan-activity; sid:100003341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!273&authkey=ae2m69e5nu3rrea",nocase; classtype:trojan-activity; sid:100003342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!274&authkey=acqg0akutoxdpgo",nocase; classtype:trojan-activity; sid:100003343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21273&authkey=ae2m69e5nu3rrea",nocase; classtype:trojan-activity; sid:100003344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21274&authkey=acqg0akutoxdpgo",nocase; classtype:trojan-activity; sid:100003345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0!1667&authkey=an8otd7jzc7xgho",nocase; classtype:trojan-activity; sid:100003346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0%211667&authkey=an8otd7jzc7xgho",nocase; classtype:trojan-activity; sid:100003347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0e26b39babdbf63c&resid=e26b39babdbf63c%21137&authkey=anshbgxg1_qa2h4",nocase; classtype:trojan-activity; sid:100003348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242!309&authkey=alfe36drai1zmwc",nocase; classtype:trojan-activity; sid:100003349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242%21309&authkey=alfe36drai1zmwc",nocase; classtype:trojan-activity; sid:100003350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21123&authkey=aco5hiwppfq8vrw",nocase; classtype:trojan-activity; sid:100003351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21124&authkey=ai6sfa2z-kqf6x0",nocase; classtype:trojan-activity; sid:100003352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=125290ca4dc682c9&resid=125290ca4dc682c9%21452&authkey=afdp5rurqhdqa2a",nocase; classtype:trojan-activity; sid:100003353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=13b301f1cb48f8cd&resid=13b301f1cb48f8cd%21106&authkey=aiae3olcs4lulz4",nocase; classtype:trojan-activity; sid:100003354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=14f52af71b98dbc5&resid=14f52af71b98dbc5%212449&authkey=anfs_n5cs1noojo",nocase; classtype:trojan-activity; sid:100003355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0",nocase; classtype:trojan-activity; sid:100003356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte",nocase; classtype:trojan-activity; sid:100003357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte",nocase; classtype:trojan-activity; sid:100003358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=16b1c02dce9ea41f&resid=16b1c02dce9ea41f!286&authkey=almwisomhv3c0zc",nocase; classtype:trojan-activity; sid:100003359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54",nocase; classtype:trojan-activity; sid:100003360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54",nocase; classtype:trojan-activity; sid:100003361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g",nocase; classtype:trojan-activity; sid:100003362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!129&authkey=apqoonsrce0ari4",nocase; classtype:trojan-activity; sid:100003363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21126&authkey=ad4yflrisq6d82g",nocase; classtype:trojan-activity; sid:100003364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21129&authkey=apqoonsrce0ari4",nocase; classtype:trojan-activity; sid:100003365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=196e83840ef8c152&resid=196e83840ef8c152%21107&authkey=ah2lhjyd0ukjcve",nocase; classtype:trojan-activity; sid:100003366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a162e8fcaaef5fa&resid=1a162e8fcaaef5fa%215495&authkey=aic7rmj1cm3rt2w",nocase; classtype:trojan-activity; sid:100003367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!106&authkey=aklmrzgetlbm5wc",nocase; classtype:trojan-activity; sid:100003368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!107&authkey=albnx4ylxil-nog",nocase; classtype:trojan-activity; sid:100003369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21106&authkey=aklmrzgetlbm5wc",nocase; classtype:trojan-activity; sid:100003370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21107&authkey=albnx4ylxil-nog",nocase; classtype:trojan-activity; sid:100003371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558!8182&authkey=aautw8tvzxr5v3a",nocase; classtype:trojan-activity; sid:100003372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558%218182&authkey=aautw8tvzxr5v3a",nocase; classtype:trojan-activity; sid:100003373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1cbd82dd55d70086&resid=1cbd82dd55d70086%212526&authkey=aogaboensav3jrg",nocase; classtype:trojan-activity; sid:100003374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1dbdf62bc3c2b05b&resid=1dbdf62bc3c2b05b!134&authkey=ape6bhxn7c89z60",nocase; classtype:trojan-activity; sid:100003375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg",nocase; classtype:trojan-activity; sid:100003376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4",nocase; classtype:trojan-activity; sid:100003377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c",nocase; classtype:trojan-activity; sid:100003378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo",nocase; classtype:trojan-activity; sid:100003379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i",nocase; classtype:trojan-activity; sid:100003380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc",nocase; classtype:trojan-activity; sid:100003381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo",nocase; classtype:trojan-activity; sid:100003382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i",nocase; classtype:trojan-activity; sid:100003383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc",nocase; classtype:trojan-activity; sid:100003384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom",nocase; classtype:trojan-activity; sid:100003385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom",nocase; classtype:trojan-activity; sid:100003386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po",nocase; classtype:trojan-activity; sid:100003387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe",nocase; classtype:trojan-activity; sid:100003388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk",nocase; classtype:trojan-activity; sid:100003389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f!191&authkey=ajvumpkzpla_nca",nocase; classtype:trojan-activity; sid:100003390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f%21191&authkey=ajvumpkzpla_nca",nocase; classtype:trojan-activity; sid:100003391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=26bbd7d5ad88dd29&resid=26bbd7d5ad88dd29%21115&authkey=acipfa3gbiqqcvu",nocase; classtype:trojan-activity; sid:100003392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=26f87316a7e32bb5&resid=26f87316a7e32bb5%21106&authkey=aepqo5hlkxn1t1k",nocase; classtype:trojan-activity; sid:100003393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2831401bbac0235e&resid=2831401bbac0235e%211037&authkey=aagnkp6l76yhrlo",nocase; classtype:trojan-activity; sid:100003394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga",nocase; classtype:trojan-activity; sid:100003395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28",nocase; classtype:trojan-activity; sid:100003396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28",nocase; classtype:trojan-activity; sid:100003397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi",nocase; classtype:trojan-activity; sid:100003398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk",nocase; classtype:trojan-activity; sid:100003399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi",nocase; classtype:trojan-activity; sid:100003400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk",nocase; classtype:trojan-activity; sid:100003401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0",nocase; classtype:trojan-activity; sid:100003402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620",nocase; classtype:trojan-activity; sid:100003403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo",nocase; classtype:trojan-activity; sid:100003404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21115&authkey=aglznnsx71tbe9e",nocase; classtype:trojan-activity; sid:100003405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37!183&authkey=akon9i9zzhusiuk",nocase; classtype:trojan-activity; sid:100003406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37%21183&authkey=akon9i9zzhusiuk",nocase; classtype:trojan-activity; sid:100003407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!116&authkey=!abwledjhfsqwap4",nocase; classtype:trojan-activity; sid:100003408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!121&authkey=!aa0qbuuss-wb13w",nocase; classtype:trojan-activity; sid:100003409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1!119&authkey=apmakx2cqb9rimu",nocase; classtype:trojan-activity; sid:100003410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21118&authkey=acrl2iiem-zjer8",nocase; classtype:trojan-activity; sid:100003411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21119&authkey=apmakx2cqb9rimu",nocase; classtype:trojan-activity; sid:100003412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=2ffaa48ef4bec51a&resid=2ffaa48ef4bec51a%21107&authkey=aiohrvrc3uuo_cw",nocase; classtype:trojan-activity; sid:100003413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3004cdd743a543f5&resid=3004cdd743a543f5%21170&authkey=ao8vz-4rkwuiyn8",nocase; classtype:trojan-activity; sid:100003414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!320&authkey=aooujzuf408dclw",nocase; classtype:trojan-activity; sid:100003415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!321&authkey=almpxnbtsbzauna",nocase; classtype:trojan-activity; sid:100003416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21320&authkey=aooujzuf408dclw",nocase; classtype:trojan-activity; sid:100003417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21321&authkey=almpxnbtsbzauna",nocase; classtype:trojan-activity; sid:100003418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3164ddeba70d2263&resid=3164ddeba70d2263%21106&authkey=afkvqrm4zoor8qq",nocase; classtype:trojan-activity; sid:100003419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=31771958ea3373a1&resid=31771958ea3373a1%21108&authkey=aiofxduo9rdb_-o",nocase; classtype:trojan-activity; sid:100003420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1!223&authkey=aajr842bzum0yg8",nocase; classtype:trojan-activity; sid:100003421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1%21223&authkey=aajr842bzum0yg8",nocase; classtype:trojan-activity; sid:100003422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=34207675f7506d94&resid=34207675f7506d94%21137&authkey=angxnhqpe2x5koc",nocase; classtype:trojan-activity; sid:100003423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3447601ab357f8c1&resid=3447601ab357f8c1!114&authkey=aitwerxd-t2cxl0",nocase; classtype:trojan-activity; sid:100003424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8",nocase; classtype:trojan-activity; sid:100003425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8,standard,n/a,n/a,urlhaus",nocase; classtype:trojan-activity; sid:100003426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866!107&authkey=af08d9zk1yestqa",nocase; classtype:trojan-activity; sid:100003427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866%21107&authkey=af08d9zk1yestqa",nocase; classtype:trojan-activity; sid:100003428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c!139&authkey=ap4bbakgkikau-a",nocase; classtype:trojan-activity; sid:100003429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c%21139&authkey=ap4bbakgkikau-a",nocase; classtype:trojan-activity; sid:100003430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!152&authkey=am09sv26njxzyn0",nocase; classtype:trojan-activity; sid:100003431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!153&authkey=ajs0jkoeqkqjrze",nocase; classtype:trojan-activity; sid:100003432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21152&authkey=am09sv26njxzyn0",nocase; classtype:trojan-activity; sid:100003433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21153&authkey=ajs0jkoeqkqjrze",nocase; classtype:trojan-activity; sid:100003434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3a1715e2cb964f25&resid=3a1715e2cb964f25%213713&authkey=aortxmfnibnoqkk",nocase; classtype:trojan-activity; sid:100003435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0!119&authkey=adkqcwv8_3k86z4",nocase; classtype:trojan-activity; sid:100003436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0%21119&authkey=adkqcwv8_3k86z4",nocase; classtype:trojan-activity; sid:100003437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21432&authkey=aa_npsupyqb2kge",nocase; classtype:trojan-activity; sid:100003438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21435&authkey=admsjhgpkbtcqzs",nocase; classtype:trojan-activity; sid:100003439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3ee68228c34c236d&resid=3ee68228c34c236d%21129&authkey=apll6hu3-xetzxu",nocase; classtype:trojan-activity; sid:100003440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f!154&authkey=aasj15d0g_p2pog",nocase; classtype:trojan-activity; sid:100003441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f%21154&authkey=aasj15d0g_p2pog",nocase; classtype:trojan-activity; sid:100003442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f!134&authkey=aaipzy8nllirlky",nocase; classtype:trojan-activity; sid:100003443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f%21134&authkey=aaipzy8nllirlky",nocase; classtype:trojan-activity; sid:100003444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm",nocase; classtype:trojan-activity; sid:100003445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm",nocase; classtype:trojan-activity; sid:100003446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik",nocase; classtype:trojan-activity; sid:100003447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21109&authkey=adzxmpjk-etbkjq",nocase; classtype:trojan-activity; sid:100003448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy",nocase; classtype:trojan-activity; sid:100003449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0",nocase; classtype:trojan-activity; sid:100003450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0",nocase; classtype:trojan-activity; sid:100003451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw",nocase; classtype:trojan-activity; sid:100003452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw",nocase; classtype:trojan-activity; sid:100003453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y",nocase; classtype:trojan-activity; sid:100003454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13805&authkey=ae-zbfo2uwln_gg",nocase; classtype:trojan-activity; sid:100003455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13806&authkey=aakiq-ymrjjodns",nocase; classtype:trojan-activity; sid:100003456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113805&authkey=ae-zbfo2uwln_gg",nocase; classtype:trojan-activity; sid:100003457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113806&authkey=aakiq-ymrjjodns",nocase; classtype:trojan-activity; sid:100003458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4b676ea3ff139b93&resid=4b676ea3ff139b93!133&authkey=amfix63glytflgo",nocase; classtype:trojan-activity; sid:100003459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21127&authkey=ablg20r-aat_ob4",nocase; classtype:trojan-activity; sid:100003460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21131&authkey=akbwlkrrtso_bqm",nocase; classtype:trojan-activity; sid:100003461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4df11eda676a355f&resid=4df11eda676a355f!130&authkey=!akd6uxvljtlvpxu",nocase; classtype:trojan-activity; sid:100003462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b!108&authkey=anbjpqxg-iwr4g8",nocase; classtype:trojan-activity; sid:100003463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8",nocase; classtype:trojan-activity; sid:100003464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc",nocase; classtype:trojan-activity; sid:100003465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y",nocase; classtype:trojan-activity; sid:100003466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4",nocase; classtype:trojan-activity; sid:100003467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8",nocase; classtype:trojan-activity; sid:100003468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0",nocase; classtype:trojan-activity; sid:100003469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc",nocase; classtype:trojan-activity; sid:100003470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21119&authkey=amrs3-3hsvcmtfs",nocase; classtype:trojan-activity; sid:100003471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21158&authkey=aodderdrnvhruts",nocase; classtype:trojan-activity; sid:100003472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21161&authkey=agdsfxdnre82jjc",nocase; classtype:trojan-activity; sid:100003473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21192&authkey=agn2xvrvup-xvtg",nocase; classtype:trojan-activity; sid:100003474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21206&authkey=ai1r52mhtbdnm2y",nocase; classtype:trojan-activity; sid:100003475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21247&authkey=ae6weny1fa4pday",nocase; classtype:trojan-activity; sid:100003476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21252&authkey=aphl0oi4r6lrty0",nocase; classtype:trojan-activity; sid:100003477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21257&authkey=afnyvqwcghnyoas",nocase; classtype:trojan-activity; sid:100003478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21265&authkey=abxqdhlwiurjvve",nocase; classtype:trojan-activity; sid:100003479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21271&authkey=ae5qwlr5ceeptmy",nocase; classtype:trojan-activity; sid:100003480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21272&authkey=ahrqeoaynibwt14",nocase; classtype:trojan-activity; sid:100003481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21275&authkey=af_sgsaxsmaxg7i",nocase; classtype:trojan-activity; sid:100003482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21289&authkey=angyngbqixtrjaa",nocase; classtype:trojan-activity; sid:100003483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21293&authkey=acvh08asxosbwfu",nocase; classtype:trojan-activity; sid:100003484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21299&authkey=amicxuotubpok2c",nocase; classtype:trojan-activity; sid:100003485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21306&authkey=ahpivoukyerzcjy",nocase; classtype:trojan-activity; sid:100003486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21314&authkey=aex2uv2-eiofr8q",nocase; classtype:trojan-activity; sid:100003487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21332&authkey=ad0jmjxgbaebvbm",nocase; classtype:trojan-activity; sid:100003488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21335&authkey=ah0vupcfbdfa6g4",nocase; classtype:trojan-activity; sid:100003489; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21357&authkey=ap8sswuqjjjexho",nocase; classtype:trojan-activity; sid:100003490; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21366&authkey=aoblpmbmx7o_v18",nocase; classtype:trojan-activity; sid:100003491; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21379&authkey=air-bsjj46et47q",nocase; classtype:trojan-activity; sid:100003492; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21389&authkey=aduenohuq_rbyhm",nocase; classtype:trojan-activity; sid:100003493; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21391&authkey=aa15sw51njbn_na",nocase; classtype:trojan-activity; sid:100003494; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21392&authkey=abp0heeg6ybn0lk",nocase; classtype:trojan-activity; sid:100003495; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21393&authkey=aa1pmur8sy8xtwe",nocase; classtype:trojan-activity; sid:100003496; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212718&authkey=aie0v1d-cusuabi",nocase; classtype:trojan-activity; sid:100003497; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212725&authkey=aanrz9et3bym3lc",nocase; classtype:trojan-activity; sid:100003498; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212728&authkey=ahsmbkltfrwgqjc",nocase; classtype:trojan-activity; sid:100003499; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!395&authkey=alwvub_yhtogjxw",nocase; classtype:trojan-activity; sid:100003500; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!398&authkey=abaa_tjd7ohh4so",nocase; classtype:trojan-activity; sid:100003501; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!406&authkey=aarnp48wumgu6tq",nocase; classtype:trojan-activity; sid:100003502; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!415&authkey=aglzsd6-g0nzj7s",nocase; classtype:trojan-activity; sid:100003503; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!420&authkey=akk5droung_ecww",nocase; classtype:trojan-activity; sid:100003504; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!440&authkey=ai7-dpr11wnzyq8",nocase; classtype:trojan-activity; sid:100003505; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21395&authkey=alwvub_yhtogjxw",nocase; classtype:trojan-activity; sid:100003506; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21398&authkey=abaa_tjd7ohh4so",nocase; classtype:trojan-activity; sid:100003507; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21406&authkey=aarnp48wumgu6tq",nocase; classtype:trojan-activity; sid:100003508; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21415&authkey=aglzsd6-g0nzj7s",nocase; classtype:trojan-activity; sid:100003509; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21420&authkey=akk5droung_ecww",nocase; classtype:trojan-activity; sid:100003510; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21440&authkey=ai7-dpr11wnzyq8",nocase; classtype:trojan-activity; sid:100003511; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211121&authkey=al_fmezwfay4za4",nocase; classtype:trojan-activity; sid:100003512; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211122&authkey=anz_q5njlanv2mu",nocase; classtype:trojan-activity; sid:100003513; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21110&authkey=akars6koxqzdwgi",nocase; classtype:trojan-activity; sid:100003514; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21112&authkey=aadare1gec7nzy8",nocase; classtype:trojan-activity; sid:100003515; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8",nocase; classtype:trojan-activity; sid:100003516; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8&em=2",nocase; classtype:trojan-activity; sid:100003517; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d%21109&authkey=adriswrtwdpbuc8&em=2",nocase; classtype:trojan-activity; sid:100003518; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=53c5e6b8f6893887&resid=53c5e6b8f6893887!802&authkey=aapuufivkn2zwu8",nocase; classtype:trojan-activity; sid:100003519; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!106&authkey=anzlf1ksptbqok8",nocase; classtype:trojan-activity; sid:100003520; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!107&authkey=ag4dr58jrjuxfyq",nocase; classtype:trojan-activity; sid:100003521; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21106&authkey=anzlf1ksptbqok8",nocase; classtype:trojan-activity; sid:100003522; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21107&authkey=ag4dr58jrjuxfyq",nocase; classtype:trojan-activity; sid:100003523; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=547b1e4a6b15bf97&resid=547b1e4a6b15bf97%21106&authkey=akgsmzqhemioz8g",nocase; classtype:trojan-activity; sid:100003524; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=54f92c3a2f5d8033&resid=54f92c3a2f5d8033%21200&authkey=aofadhhfwlm2gum",nocase; classtype:trojan-activity; sid:100003525; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=55381ffd75ef8cda&resid=55381ffd75ef8cda!270&authkey=aev4isgyubiofdi",nocase; classtype:trojan-activity; sid:100003526; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613!157&authkey=an55tjzt-9vbjfy",nocase; classtype:trojan-activity; sid:100003527; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613%21156&authkey=agiuawekkbxb_4o",nocase; classtype:trojan-activity; sid:100003528; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=55c9feaf3907aae5&resid=55c9feaf3907aae5%21208&authkey=adwuyrapfdzkyoa",nocase; classtype:trojan-activity; sid:100003529; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950!280&authkey=advq4p3xhfhinq8",nocase; classtype:trojan-activity; sid:100003530; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950%21280&authkey=advq4p3xhfhinq8",nocase; classtype:trojan-activity; sid:100003531; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5629da828892367d&resid=5629da828892367d!803&authkey=aphjbq-bsg7ohpc",nocase; classtype:trojan-activity; sid:100003532; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21383&authkey=adldpuaya7kj1dk",nocase; classtype:trojan-activity; sid:100003533; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21384&authkey=alsuxvtsof32vea",nocase; classtype:trojan-activity; sid:100003534; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3599&authkey=am4yicme6lrjpki",nocase; classtype:trojan-activity; sid:100003535; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3604&authkey=al6pb71mtq4jr1s",nocase; classtype:trojan-activity; sid:100003536; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213599&authkey=am4yicme6lrjpki",nocase; classtype:trojan-activity; sid:100003537; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213604&authkey=al6pb71mtq4jr1s",nocase; classtype:trojan-activity; sid:100003538; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b!68197&authkey=aowpm7ocl_21-oc",nocase; classtype:trojan-activity; sid:100003539; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b%2168197&authkey=aowpm7ocl_21-oc",nocase; classtype:trojan-activity; sid:100003540; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=59389d626d829e8c&resid=59389d626d829e8c%212940&authkey=anx1ngd27vqeiwo",nocase; classtype:trojan-activity; sid:100003541; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211568&authkey=aemrnwoi75oflva",nocase; classtype:trojan-activity; sid:100003542; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211572&authkey=aelz-gxlrxcwtnc",nocase; classtype:trojan-activity; sid:100003543; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211573&authkey=ahksfdvda0doles",nocase; classtype:trojan-activity; sid:100003544; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5c5404bd403dbdc9&resid=5c5404bd403dbdc9!4464&authkey=ajskjf2hshbudeg",nocase; classtype:trojan-activity; sid:100003545; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!406&authkey=aeyeq5j9zfepgai",nocase; classtype:trojan-activity; sid:100003546; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!407&authkey=adnh8af-rvoxlcc",nocase; classtype:trojan-activity; sid:100003547; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21406&authkey=aeyeq5j9zfepgai",nocase; classtype:trojan-activity; sid:100003548; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21407&authkey=adnh8af-rvoxlcc",nocase; classtype:trojan-activity; sid:100003549; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21892&authkey=apwphufzjdtsedw",nocase; classtype:trojan-activity; sid:100003550; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21897&authkey=aomt6el1av5ruc8",nocase; classtype:trojan-activity; sid:100003551; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21121&authkey=adjzlorvgx_ezhq",nocase; classtype:trojan-activity; sid:100003552; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21123&authkey=ancfnepawtbmnug",nocase; classtype:trojan-activity; sid:100003553; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21124&authkey=ao7bknnuodxtfua",nocase; classtype:trojan-activity; sid:100003554; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe",nocase; classtype:trojan-activity; sid:100003555; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i",nocase; classtype:trojan-activity; sid:100003556; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8",nocase; classtype:trojan-activity; sid:100003557; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq",nocase; classtype:trojan-activity; sid:100003558; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s",nocase; classtype:trojan-activity; sid:100003559; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa",nocase; classtype:trojan-activity; sid:100003560; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe",nocase; classtype:trojan-activity; sid:100003561; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi",nocase; classtype:trojan-activity; sid:100003562; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e",nocase; classtype:trojan-activity; sid:100003563; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e!1094&authkey=anqjzd7pr18fu90",nocase; classtype:trojan-activity; sid:100003564; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211094&authkey=anqjzd7pr18fu90",nocase; classtype:trojan-activity; sid:100003565; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211099&authkey=alxq-bvz7nqbv4c",nocase; classtype:trojan-activity; sid:100003566; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk",nocase; classtype:trojan-activity; sid:100003567; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4",nocase; classtype:trojan-activity; sid:100003568; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo",nocase; classtype:trojan-activity; sid:100003569; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2!517&authkey=akfewcyiwlwomyk",nocase; classtype:trojan-activity; sid:100003570; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21505&authkey=ag7xi3lcnvi_hji",nocase; classtype:trojan-activity; sid:100003571; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21517&authkey=akfewcyiwlwomyk",nocase; classtype:trojan-activity; sid:100003572; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad!1421&authkey=adixg2-asekemjw",nocase; classtype:trojan-activity; sid:100003573; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad%211421&authkey=adixg2-asekemjw",nocase; classtype:trojan-activity; sid:100003574; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213096&authkey=aob-cm9vv6erxqg",nocase; classtype:trojan-activity; sid:100003575; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213097&authkey=abcuevfyu6pdw70",nocase; classtype:trojan-activity; sid:100003576; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=69b503a3f081a183&resid=69b503a3f081a183%21111&authkey=aazm9wlg1rvgzoc",nocase; classtype:trojan-activity; sid:100003577; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!112&authkey=aasndgbcwol3mys",nocase; classtype:trojan-activity; sid:100003578; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!113&authkey=ak3tzu1lg4uuh5m",nocase; classtype:trojan-activity; sid:100003579; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21112&authkey=aasndgbcwol3mys",nocase; classtype:trojan-activity; sid:100003580; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21113&authkey=ak3tzu1lg4uuh5m",nocase; classtype:trojan-activity; sid:100003581; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21108&authkey=ameouv2jdxo5obw",nocase; classtype:trojan-activity; sid:100003582; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21119&authkey=aazzzrl7mv2xbwq",nocase; classtype:trojan-activity; sid:100003583; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6a7b40a2bc530c6c&resid=6a7b40a2bc530c6c%21112&authkey=afuov36rbymlvxm",nocase; classtype:trojan-activity; sid:100003584; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3!118&authkey=aepf8f3mfmlsng0",nocase; classtype:trojan-activity; sid:100003585; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3%21118&authkey=aepf8f3mfmlsng0",nocase; classtype:trojan-activity; sid:100003586; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b61e983f930f79f&resid=6b61e983f930f79f!540&authkey=ap2n5w41ifew0i8",nocase; classtype:trojan-activity; sid:100003587; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7!1154&authkey=acnbdscb8-rbmcu",nocase; classtype:trojan-activity; sid:100003588; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7%211154&authkey=acnbdscb8-rbmcu",nocase; classtype:trojan-activity; sid:100003589; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21106&authkey=apvhok6edhtogfu",nocase; classtype:trojan-activity; sid:100003590; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21115&authkey=amc_k1nnlywdc4i",nocase; classtype:trojan-activity; sid:100003591; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=724b5c509337556e&resid=724b5c509337556e%21908&authkey=agcbb3nakpteyam",nocase; classtype:trojan-activity; sid:100003592; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7285f51e65036769&resid=7285f51e65036769%21264&authkey=akyjvrz006qlble",nocase; classtype:trojan-activity; sid:100003593; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21243&authkey=apivjmxivosek60",nocase; classtype:trojan-activity; sid:100003594; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21256&authkey=adljht0ogfq775k",nocase; classtype:trojan-activity; sid:100003595; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21260&authkey=aig6cydr4_e-qj8",nocase; classtype:trojan-activity; sid:100003596; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21262&authkey=ak4fiz1-a1ks8rg",nocase; classtype:trojan-activity; sid:100003597; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21264&authkey=aizkjymvlgqwpte",nocase; classtype:trojan-activity; sid:100003598; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!106&authkey=ahu5s4ttjvxbnxo",nocase; classtype:trojan-activity; sid:100003599; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!107&authkey=abj3eccentbeaqa",nocase; classtype:trojan-activity; sid:100003600; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!108&authkey=amvcygo4prlgt4i",nocase; classtype:trojan-activity; sid:100003601; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!110&authkey=ahzuehvk5nvzo90",nocase; classtype:trojan-activity; sid:100003602; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21106&authkey=ahu5s4ttjvxbnxo",nocase; classtype:trojan-activity; sid:100003603; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21107&authkey=abj3eccentbeaqa",nocase; classtype:trojan-activity; sid:100003604; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21108&authkey=amvcygo4prlgt4i",nocase; classtype:trojan-activity; sid:100003605; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21110&authkey=ahzuehvk5nvzo90",nocase; classtype:trojan-activity; sid:100003606; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=77518d098ad4dfb0&resid=77518d098ad4dfb0%21939&authkey=akzqobxxxn89z34",nocase; classtype:trojan-activity; sid:100003607; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21111&authkey=aggnhgqj6uhxm2w",nocase; classtype:trojan-activity; sid:100003608; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21112&authkey=abser1xtkpb3-ta",nocase; classtype:trojan-activity; sid:100003609; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21117&authkey=aivf1ddcvvu22em",nocase; classtype:trojan-activity; sid:100003610; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!119&authkey=aozjai26izprqto",nocase; classtype:trojan-activity; sid:100003611; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!120&authkey=ajj7ueqjvobgfum",nocase; classtype:trojan-activity; sid:100003612; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21119&authkey=aozjai26izprqto",nocase; classtype:trojan-activity; sid:100003613; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21120&authkey=ajj7ueqjvobgfum",nocase; classtype:trojan-activity; sid:100003614; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c1fc7da38ab958e&resid=7c1fc7da38ab958e!146&authkey=aktmjqz8n4s_sbm",nocase; classtype:trojan-activity; sid:100003615; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5295&authkey=aasceqj1mdodeuo",nocase; classtype:trojan-activity; sid:100003616; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5296&authkey=ank3vz5syaf6bny",nocase; classtype:trojan-activity; sid:100003617; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5298&authkey=albzyizuqczfv9s",nocase; classtype:trojan-activity; sid:100003618; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215295&authkey=aasceqj1mdodeuo",nocase; classtype:trojan-activity; sid:100003619; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215296&authkey=ank3vz5syaf6bny",nocase; classtype:trojan-activity; sid:100003620; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215298&authkey=albzyizuqczfv9s",nocase; classtype:trojan-activity; sid:100003621; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7d109f249b512466&resid=7d109f249b512466!543&authkey=acqc4xjghclmwbs",nocase; classtype:trojan-activity; sid:100003622; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7e81645429ac5a22&resid=7e81645429ac5a22%21105&authkey=aa691jwf5wqi80c",nocase; classtype:trojan-activity; sid:100003623; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=7fed4fbea32e3c1e&resid=7fed4fbea32e3c1e%21107&authkey=aeoxfycpolifch0",nocase; classtype:trojan-activity; sid:100003624; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=806bac90dc071edf&resid=806bac90dc071edf!105&authkey=!ao7jyz6-licb8hq",nocase; classtype:trojan-activity; sid:100003625; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=81c2d8b116274e17&resid=81c2d8b116274e17%21107&authkey=aaqw-t4dx2sbvda",nocase; classtype:trojan-activity; sid:100003626; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=82977114b1af209d&resid=82977114b1af209d!220&authkey=abuin5vdedjughm",nocase; classtype:trojan-activity; sid:100003627; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=855b20b0e8399717&resid=855b20b0e8399717%21110&authkey=afhxx21ztsd7hbm",nocase; classtype:trojan-activity; sid:100003628; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=860a0980486c93fa&resid=860a0980486c93fa!303&authkey=!agcmlab4r6syfvk",nocase; classtype:trojan-activity; sid:100003629; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21164&authkey=agbeiinncf8ok_4",nocase; classtype:trojan-activity; sid:100003630; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21165&authkey=aiof8rdvxglnm-c",nocase; classtype:trojan-activity; sid:100003631; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4!2402&authkey=amigiam45mt6jia",nocase; classtype:trojan-activity; sid:100003632; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4%212402&authkey=amigiam45mt6jia",nocase; classtype:trojan-activity; sid:100003633; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4",nocase; classtype:trojan-activity; sid:100003634; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk",nocase; classtype:trojan-activity; sid:100003635; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk",nocase; classtype:trojan-activity; sid:100003636; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y",nocase; classtype:trojan-activity; sid:100003637; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y",nocase; classtype:trojan-activity; sid:100003638; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0",nocase; classtype:trojan-activity; sid:100003639; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s",nocase; classtype:trojan-activity; sid:100003640; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my",nocase; classtype:trojan-activity; sid:100003641; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25!130&authkey=ais_g9dqoddonsc",nocase; classtype:trojan-activity; sid:100003642; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21106&authkey=ahfgxp0p6nk0eby",nocase; classtype:trojan-activity; sid:100003643; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21109&authkey=akr1n3qxtmnttuo",nocase; classtype:trojan-activity; sid:100003644; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21113&authkey=ajpvf1h89sqstti",nocase; classtype:trojan-activity; sid:100003645; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!112&authkey=af43qpcgl0t2f5o",nocase; classtype:trojan-activity; sid:100003646; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!113&authkey=ag92_wxfvrsuix8",nocase; classtype:trojan-activity; sid:100003647; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21112&authkey=af43qpcgl0t2f5o",nocase; classtype:trojan-activity; sid:100003648; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21113&authkey=ag92_wxfvrsuix8",nocase; classtype:trojan-activity; sid:100003649; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21105&authkey=ah9x7rn0p03kd_m",nocase; classtype:trojan-activity; sid:100003650; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21110&authkey=ammswulpdsjeu4w",nocase; classtype:trojan-activity; sid:100003651; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3!107&authkey=ac-m9dlvo5l7wfk",nocase; classtype:trojan-activity; sid:100003652; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3%21107&authkey=ac-m9dlvo5l7wfk",nocase; classtype:trojan-activity; sid:100003653; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=96a54b19ff5f6bab&resid=96a54b19ff5f6bab%21107&authkey=anxv07ez7s5sh_k",nocase; classtype:trojan-activity; sid:100003654; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli",nocase; classtype:trojan-activity; sid:100003655; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm",nocase; classtype:trojan-activity; sid:100003656; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue",nocase; classtype:trojan-activity; sid:100003657; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc",nocase; classtype:trojan-activity; sid:100003658; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w",nocase; classtype:trojan-activity; sid:100003659; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm",nocase; classtype:trojan-activity; sid:100003660; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211953&authkey=abdfqiyruwplpo0",nocase; classtype:trojan-activity; sid:100003661; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211954&authkey=aok-srkhxjazccy",nocase; classtype:trojan-activity; sid:100003662; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21172&authkey=ahharhcv0fmn5fm",nocase; classtype:trojan-activity; sid:100003663; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21173&authkey=aecb3qcquacvzhi",nocase; classtype:trojan-activity; sid:100003664; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21174&authkey=afv7cprqwxezgsi",nocase; classtype:trojan-activity; sid:100003665; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21177&authkey=als6_be40lt5jk8",nocase; classtype:trojan-activity; sid:100003666; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2!113&authkey=akeqdnxllfzf8hq",nocase; classtype:trojan-activity; sid:100003667; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2%21113&authkey=akeqdnxllfzf8hq",nocase; classtype:trojan-activity; sid:100003668; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9fb622acb27482ef&resid=9fb622acb27482ef%211197&authkey=aeacibxy2zlyxro",nocase; classtype:trojan-activity; sid:100003669; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=9fba865c1fdce17f&resid=9fba865c1fdce17f%211109&authkey=achpeiyvsphyn9o",nocase; classtype:trojan-activity; sid:100003670; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a023fe2d1ac611f2&resid=a023fe2d1ac611f2!514&authkey=alaxh02uycquui4",nocase; classtype:trojan-activity; sid:100003671; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a04a98741fafee2b&resid=a04a98741fafee2b%211857&authkey=af3qhnjtfnffevi",nocase; classtype:trojan-activity; sid:100003672; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340!997&authkey=akw6btyej2zht08",nocase; classtype:trojan-activity; sid:100003673; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340%21997&authkey=akw6btyej2zht08",nocase; classtype:trojan-activity; sid:100003674; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a1c8c8055848b889&resid=a1c8c8055848b889!111&authkey=agzlftsgr4lspvo",nocase; classtype:trojan-activity; sid:100003675; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a2cd2cdb93584d7e&resid=a2cd2cdb93584d7e%21106&authkey=aeifpqbwo1s3dyq",nocase; classtype:trojan-activity; sid:100003676; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e!108&authkey=amcjnb2j1bd4tyu",nocase; classtype:trojan-activity; sid:100003677; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21107&authkey=ab9lanzt1aj_0ws",nocase; classtype:trojan-activity; sid:100003678; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21108&authkey=amcjnb2j1bd4tyu",nocase; classtype:trojan-activity; sid:100003679; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21109&authkey=afhg_ay2_zz0kkg",nocase; classtype:trojan-activity; sid:100003680; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211064&authkey=apebndb6tstxywi",nocase; classtype:trojan-activity; sid:100003681; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211065&authkey=aca4_dggi5gbbfs",nocase; classtype:trojan-activity; sid:100003682; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211067&authkey=ae-3ej9zzj4ibhw",nocase; classtype:trojan-activity; sid:100003683; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211069&authkey=agx6b8qjt_clm-o",nocase; classtype:trojan-activity; sid:100003684; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a502994ea313f5c7&resid=a502994ea313f5c7%21215&authkey=aiydvejv0l8stbs",nocase; classtype:trojan-activity; sid:100003685; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114!256&authkey=aapnly5qifymcvw",nocase; classtype:trojan-activity; sid:100003686; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21251&authkey=ainluv1ppu-8ogu",nocase; classtype:trojan-activity; sid:100003687; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21256&authkey=aapnly5qifymcvw",nocase; classtype:trojan-activity; sid:100003688; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21!6053&authkey=agfh0ahstj7rrki",nocase; classtype:trojan-activity; sid:100003689; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21%216053&authkey=agfh0ahstj7rrki",nocase; classtype:trojan-activity; sid:100003690; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi",nocase; classtype:trojan-activity; sid:100003691; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21414&authkey=akf9uwwkitvhrvc",nocase; classtype:trojan-activity; sid:100003692; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21415&authkey=ag_5kthuezprnoy",nocase; classtype:trojan-activity; sid:100003693; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21416&authkey=airlma-pycgfkyc",nocase; classtype:trojan-activity; sid:100003694; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21419&authkey=ab1-sgyv2gibyey",nocase; classtype:trojan-activity; sid:100003695; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21422&authkey=acphsmdy415izjg",nocase; classtype:trojan-activity; sid:100003696; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21424&authkey=afvfwz5uvde1pui",nocase; classtype:trojan-activity; sid:100003697; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818!129&authkey=aesewk3cf5vbrxw",nocase; classtype:trojan-activity; sid:100003698; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818%21129&authkey=aesewk3cf5vbrxw",nocase; classtype:trojan-activity; sid:100003699; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=aa4e252db942faec&resid=aa4e252db942faec%21168&authkey=anlnjo7xnwtswuk",nocase; classtype:trojan-activity; sid:100003700; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw",nocase; classtype:trojan-activity; sid:100003701; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992!113&authkey=agh9q_zzyjjcspc",nocase; classtype:trojan-activity; sid:100003702; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992%21113&authkey=agh9q_zzyjjcspc",nocase; classtype:trojan-activity; sid:100003703; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=af84ebf13dd5499c&resid=af84ebf13dd5499c!167&authkey=anqr_yvn_hdh2_e",nocase; classtype:trojan-activity; sid:100003704; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308!2152&authkey=abutaac83l5utks",nocase; classtype:trojan-activity; sid:100003705; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308%212152&authkey=abutaac83l5utks",nocase; classtype:trojan-activity; sid:100003706; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21650&authkey=aht-wbxsofyx33u",nocase; classtype:trojan-activity; sid:100003707; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21651&authkey=aebbyk6sevdmzgm",nocase; classtype:trojan-activity; sid:100003708; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21652&authkey=afsw5wahxo5kwjy",nocase; classtype:trojan-activity; sid:100003709; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b1c3a5ef115e135c&resid=b1c3a5ef115e135c%216219&authkey=ahr7bklirbub0pc",nocase; classtype:trojan-activity; sid:100003710; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21120&authkey=aozmspl2dqkgkgy",nocase; classtype:trojan-activity; sid:100003711; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21123&authkey=aj18p0rtfbtwa84",nocase; classtype:trojan-activity; sid:100003712; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21139&authkey=ahwfjvw4zmjukeo",nocase; classtype:trojan-activity; sid:100003713; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21140&authkey=aksvfpmrfqrrggw",nocase; classtype:trojan-activity; sid:100003714; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21141&authkey=acznh6clby0qyww",nocase; classtype:trojan-activity; sid:100003715; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21142&authkey=ajf7j1rr3d7jcxy",nocase; classtype:trojan-activity; sid:100003716; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21143&authkey=ahs21wnsqb_vu9w",nocase; classtype:trojan-activity; sid:100003717; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b50c4248502103d0&resid=b50c4248502103d0%21107&authkey=alf1nley7ja4dbq",nocase; classtype:trojan-activity; sid:100003718; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6!164&authkey=adfsfcdaw3biboy",nocase; classtype:trojan-activity; sid:100003719; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6%21164&authkey=adfsfcdaw3biboy",nocase; classtype:trojan-activity; sid:100003720; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b7cb31db66675eb4&resid=b7cb31db66675eb4%21922&authkey=aghayyucvwey7lg",nocase; classtype:trojan-activity; sid:100003721; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b86046e8cbd4254b&resid=b86046e8cbd4254b%21115&authkey=agwstptwpaquleg",nocase; classtype:trojan-activity; sid:100003722; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b!7521&authkey=ablt9zdyq2d4rb0",nocase; classtype:trojan-activity; sid:100003723; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0",nocase; classtype:trojan-activity; sid:100003724; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m",nocase; classtype:trojan-activity; sid:100003725; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8",nocase; classtype:trojan-activity; sid:100003726; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm",nocase; classtype:trojan-activity; sid:100003727; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g",nocase; classtype:trojan-activity; sid:100003728; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g",nocase; classtype:trojan-activity; sid:100003729; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90",nocase; classtype:trojan-activity; sid:100003730; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b%21246&authkey=afyrchdutalpu90",nocase; classtype:trojan-activity; sid:100003731; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=bf83d9247c2329e0&resid=bf83d9247c2329e0%211108&authkey=absaw-bpqrc6mpq",nocase; classtype:trojan-activity; sid:100003732; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm",nocase; classtype:trojan-activity; sid:100003733; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai",nocase; classtype:trojan-activity; sid:100003734; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk",nocase; classtype:trojan-activity; sid:100003735; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta",nocase; classtype:trojan-activity; sid:100003736; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa",nocase; classtype:trojan-activity; sid:100003737; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa",nocase; classtype:trojan-activity; sid:100003738; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e",nocase; classtype:trojan-activity; sid:100003739; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1338&authkey=ajngambosws75_c",nocase; classtype:trojan-activity; sid:100003740; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1340&authkey=al1ay3fbtude6d8",nocase; classtype:trojan-activity; sid:100003741; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1342&authkey=acpr_htn2jtaxfu",nocase; classtype:trojan-activity; sid:100003742; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1343&authkey=abodysrxu9l2xxu",nocase; classtype:trojan-activity; sid:100003743; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1344&authkey=aozerppd6mnokwy",nocase; classtype:trojan-activity; sid:100003744; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1345&authkey=aevvyhonxhtcdh0",nocase; classtype:trojan-activity; sid:100003745; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1346&authkey=achrnf5vlov1gf4",nocase; classtype:trojan-activity; sid:100003746; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1347&authkey=al-zge-ttvr921s",nocase; classtype:trojan-activity; sid:100003747; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211337&authkey=afnvu1fsuczht5e",nocase; classtype:trojan-activity; sid:100003748; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211338&authkey=ajngambosws75_c",nocase; classtype:trojan-activity; sid:100003749; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211340&authkey=al1ay3fbtude6d8",nocase; classtype:trojan-activity; sid:100003750; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211342&authkey=acpr_htn2jtaxfu",nocase; classtype:trojan-activity; sid:100003751; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211343&authkey=abodysrxu9l2xxu",nocase; classtype:trojan-activity; sid:100003752; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211344&authkey=aozerppd6mnokwy",nocase; classtype:trojan-activity; sid:100003753; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211345&authkey=aevvyhonxhtcdh0",nocase; classtype:trojan-activity; sid:100003754; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211346&authkey=achrnf5vlov1gf4",nocase; classtype:trojan-activity; sid:100003755; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211347&authkey=al-zge-ttvr921s",nocase; classtype:trojan-activity; sid:100003756; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c701663053a57d59&resid=c701663053a57d59%211009&authkey=ahowgkak7j0p2q8",nocase; classtype:trojan-activity; sid:100003757; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21486&authkey=amy4euf_rrlcykc",nocase; classtype:trojan-activity; sid:100003758; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21489&authkey=ako3anwfnqfohnc",nocase; classtype:trojan-activity; sid:100003759; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=c80630c4d385fb9d&resid=c80630c4d385fb9d%21286&authkey=amgaucv8bld_5qs",nocase; classtype:trojan-activity; sid:100003760; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21546&authkey=aa6q-ryiifnet5m",nocase; classtype:trojan-activity; sid:100003761; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21547&authkey=aipm8qnwbgo4yga",nocase; classtype:trojan-activity; sid:100003762; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!355&authkey=aajjwf_sm4xdqdk",nocase; classtype:trojan-activity; sid:100003763; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!357&authkey=alw3vqqxz6myrle",nocase; classtype:trojan-activity; sid:100003764; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!362&authkey=alycl9izrvfl7oc",nocase; classtype:trojan-activity; sid:100003765; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21354&authkey=aa_ukeour7rex1s",nocase; classtype:trojan-activity; sid:100003766; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21355&authkey=aajjwf_sm4xdqdk",nocase; classtype:trojan-activity; sid:100003767; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21357&authkey=alw3vqqxz6myrle",nocase; classtype:trojan-activity; sid:100003768; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21362&authkey=alycl9izrvfl7oc",nocase; classtype:trojan-activity; sid:100003769; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ca897bdd16fc7940&resid=ca897bdd16fc7940%21106&authkey=aniklpt8vtlahbg",nocase; classtype:trojan-activity; sid:100003770; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2!109&authkey=ac4gxwjoopafr9a",nocase; classtype:trojan-activity; sid:100003771; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2%21109&authkey=ac4gxwjoopafr9a",nocase; classtype:trojan-activity; sid:100003772; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cbb66cac420484bc&resid=cbb66cac420484bc!10968&authkey=aj9bjkobu-rlnaw",nocase; classtype:trojan-activity; sid:100003773; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c!44331&authkey=afohia-wo-alwiy",nocase; classtype:trojan-activity; sid:100003774; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c%2144331&authkey=afohia-wo-alwiy",nocase; classtype:trojan-activity; sid:100003775; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!742&authkey=akbxju17f8g0r2s",nocase; classtype:trojan-activity; sid:100003776; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!744&authkey=adak4zftd0yhhhs",nocase; classtype:trojan-activity; sid:100003777; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21742&authkey=akbxju17f8g0r2s",nocase; classtype:trojan-activity; sid:100003778; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21744&authkey=adak4zftd0yhhhs",nocase; classtype:trojan-activity; sid:100003779; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!872&authkey=ap9hchztywo8zuo",nocase; classtype:trojan-activity; sid:100003780; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!874&authkey=alkzcbxz-dscgum",nocase; classtype:trojan-activity; sid:100003781; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!875&authkey=aka55ybdhqnoc6c",nocase; classtype:trojan-activity; sid:100003782; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21872&authkey=ap9hchztywo8zuo",nocase; classtype:trojan-activity; sid:100003783; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21874&authkey=alkzcbxz-dscgum",nocase; classtype:trojan-activity; sid:100003784; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21875&authkey=aka55ybdhqnoc6c",nocase; classtype:trojan-activity; sid:100003785; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!499&authkey=adegfbfx54fy3qu",nocase; classtype:trojan-activity; sid:100003786; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!510&authkey=aamxlkp3spxmvxc",nocase; classtype:trojan-activity; sid:100003787; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb%21510&authkey=aamxlkp3spxmvxc",nocase; classtype:trojan-activity; sid:100003788; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d2f3748954f6f8a8&resid=d2f3748954f6f8a8%21119&authkey=aex5s9uoun2zps0",nocase; classtype:trojan-activity; sid:100003789; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d4d413b6e7cf7088&resid=d4d413b6e7cf7088%211271&authkey=akz65bxpgvdxjb8",nocase; classtype:trojan-activity; sid:100003790; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!191&authkey=ajl2uegqunsgc3q",nocase; classtype:trojan-activity; sid:100003791; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!192&authkey=acd_hx4bka3z0nw",nocase; classtype:trojan-activity; sid:100003792; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q",nocase; classtype:trojan-activity; sid:100003793; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw",nocase; classtype:trojan-activity; sid:100003794; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy",nocase; classtype:trojan-activity; sid:100003795; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe",nocase; classtype:trojan-activity; sid:100003796; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq",nocase; classtype:trojan-activity; sid:100003797; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4",nocase; classtype:trojan-activity; sid:100003798; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dcd65237fcd1a1a9&resid=dcd65237fcd1a1a9%21162&authkey=aprqs0hugnfo6uq",nocase; classtype:trojan-activity; sid:100003799; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7527&authkey=aipybipwht56um8",nocase; classtype:trojan-activity; sid:100003800; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7530&authkey=am9p2ic6zdkgfmy",nocase; classtype:trojan-activity; sid:100003801; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7532&authkey=aonjnubquvon_uk",nocase; classtype:trojan-activity; sid:100003802; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217527&authkey=aipybipwht56um8",nocase; classtype:trojan-activity; sid:100003803; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217530&authkey=am9p2ic6zdkgfmy",nocase; classtype:trojan-activity; sid:100003804; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217532&authkey=aonjnubquvon_uk",nocase; classtype:trojan-activity; sid:100003805; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2!1818&authkey=anh2wga7qmhbmuo",nocase; classtype:trojan-activity; sid:100003806; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2%211818&authkey=anh2wga7qmhbmuo",nocase; classtype:trojan-activity; sid:100003807; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21107&authkey=akrabrcroiddkxw",nocase; classtype:trojan-activity; sid:100003808; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21115&authkey=ad1ncwtj_zcjsh0",nocase; classtype:trojan-activity; sid:100003809; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21132&authkey=akpbxohbtjebyn4",nocase; classtype:trojan-activity; sid:100003810; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21150&authkey=aevazjbqnu7cmjs",nocase; classtype:trojan-activity; sid:100003811; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21160&authkey=aiendf-9lyln0x0",nocase; classtype:trojan-activity; sid:100003812; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e1065ab3e86a5fc2&resid=e1065ab3e86a5fc2%211443&authkey=apybkcvf4iwxp_q",nocase; classtype:trojan-activity; sid:100003813; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2!107&authkey=af-bicrg1c6vgck",nocase; classtype:trojan-activity; sid:100003814; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2%21107&authkey=af-bicrg1c6vgck",nocase; classtype:trojan-activity; sid:100003815; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2!129&authkey=afk5vdt49soo3co",nocase; classtype:trojan-activity; sid:100003816; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2%21129&authkey=afk5vdt49soo3co",nocase; classtype:trojan-activity; sid:100003817; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e3ddc3980f743711&resid=e3ddc3980f743711%21795&authkey=aptivsvyk2we5xc",nocase; classtype:trojan-activity; sid:100003818; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21745&authkey=ah1i_jo73zgdxpc",nocase; classtype:trojan-activity; sid:100003819; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21746&authkey=ag1mhwlznwdxpw0",nocase; classtype:trojan-activity; sid:100003820; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e43694f4bd6f68d1&resid=e43694f4bd6f68d1!563&authkey=aj8ovsob9ll6r-c",nocase; classtype:trojan-activity; sid:100003821; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!509&authkey=akmdyqkzcsuf_gg",nocase; classtype:trojan-activity; sid:100003822; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!511&authkey=agfs0q7dz7os1lu",nocase; classtype:trojan-activity; sid:100003823; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c%21511&authkey=agfs0q7dz7os1lu",nocase; classtype:trojan-activity; sid:100003824; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e54ea4e0368d023b&resid=e54ea4e0368d023b%21106&authkey=aozas6g9pm0fzvq",nocase; classtype:trojan-activity; sid:100003825; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha",nocase; classtype:trojan-activity; sid:100003826; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha",nocase; classtype:trojan-activity; sid:100003827; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke",nocase; classtype:trojan-activity; sid:100003828; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21349&authkey=ae9ea8jdsa7vmom",nocase; classtype:trojan-activity; sid:100003829; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da",nocase; classtype:trojan-activity; sid:100003830; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu",nocase; classtype:trojan-activity; sid:100003831; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu",nocase; classtype:trojan-activity; sid:100003832; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!148&authkey=agjcwq650c8wdbm",nocase; classtype:trojan-activity; sid:100003833; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!150&authkey=ami5aqoinvosjle",nocase; classtype:trojan-activity; sid:100003834; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21148&authkey=agjcwq650c8wdbm",nocase; classtype:trojan-activity; sid:100003835; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21150&authkey=ami5aqoinvosjle",nocase; classtype:trojan-activity; sid:100003836; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e97110434470423e&resid=e97110434470423e%21113&authkey=afowclex54if0g0",nocase; classtype:trojan-activity; sid:100003837; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33!1192&authkey=apnhep6fmmxxdkw",nocase; classtype:trojan-activity; sid:100003838; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33%211192&authkey=apnhep6fmmxxdkw",nocase; classtype:trojan-activity; sid:100003839; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211215&authkey=ac1jr_bieufz0ai",nocase; classtype:trojan-activity; sid:100003840; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211219&authkey=akgo75rmvr4khlc",nocase; classtype:trojan-activity; sid:100003841; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ebacca5dec27fd20&resid=ebacca5dec27fd20%2118735&authkey=ajfyl1mzidnylc8",nocase; classtype:trojan-activity; sid:100003842; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21113&authkey=aovavpmokd2jrns",nocase; classtype:trojan-activity; sid:100003843; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21116&authkey=aadnj5xyfasugu8",nocase; classtype:trojan-activity; sid:100003844; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4",nocase; classtype:trojan-activity; sid:100003845; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8",nocase; classtype:trojan-activity; sid:100003846; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!204&authkey=ad0nbzlscbg-0sa",nocase; classtype:trojan-activity; sid:100003847; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21202&authkey=ah1gjq8j29darw4",nocase; classtype:trojan-activity; sid:100003848; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21203&authkey=af8xr99mrqp8um8",nocase; classtype:trojan-activity; sid:100003849; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21204&authkey=ad0nbzlscbg-0sa",nocase; classtype:trojan-activity; sid:100003850; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21489&authkey=ads_gff3tjkd0w0",nocase; classtype:trojan-activity; sid:100003851; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21490&authkey=aj_rld7xooge6aw",nocase; classtype:trojan-activity; sid:100003852; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21492&authkey=ahdb75ptd1_uc8e",nocase; classtype:trojan-activity; sid:100003853; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f06038a5f7dbd6d6&resid=f06038a5f7dbd6d6%215498&authkey=aiozi3z5qzdysmu",nocase; classtype:trojan-activity; sid:100003854; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f293cebb54e5ea71&resid=f293cebb54e5ea71%21293&authkey=aha74rsqiuewnpq",nocase; classtype:trojan-activity; sid:100003855; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21566&authkey=aevafh7rydhi19k",nocase; classtype:trojan-activity; sid:100003856; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21581&authkey=agx0b8ho87w4uie",nocase; classtype:trojan-activity; sid:100003857; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21582&authkey=af-9_xwysl1o7-c",nocase; classtype:trojan-activity; sid:100003858; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21598&authkey=ah-gkc-b7fa8h-g",nocase; classtype:trojan-activity; sid:100003859; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21599&authkey=aajunhe1ex_-zta",nocase; classtype:trojan-activity; sid:100003860; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f79e41c0e32d3314&resid=f79e41c0e32d3314%211182&authkey=aiqtptberyvlgqk&em=2%22",nocase; classtype:trojan-activity; sid:100003861; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806!1368&authkey=anphh1fijhvzv6c",nocase; classtype:trojan-activity; sid:100003862; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806%211368&authkey=anphh1fijhvzv6c",nocase; classtype:trojan-activity; sid:100003863; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382!159&authkey=ai4_8srrzf48hw0",nocase; classtype:trojan-activity; sid:100003864; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382%21159&authkey=ai4_8srrzf48hw0",nocase; classtype:trojan-activity; sid:100003865; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fb2177c192eed796&resid=fb2177c192eed796%21124&authkey=abotnmdhu_tg7bc",nocase; classtype:trojan-activity; sid:100003866; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fd50774e5ce0e314&resid=fd50774e5ce0e314%21778&authkey=aoxb2vhhz3qodiu",nocase; classtype:trojan-activity; sid:100003867; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fd67fafc46d3c687&resid=fd67fafc46d3c687%21473&authkey=aoid_cp-jgffqvm",nocase; classtype:trojan-activity; sid:100003868; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!847&authkey=aemnhwbhlskovgm",nocase; classtype:trojan-activity; sid:100003869; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!848&authkey=ag1_e421v-t5r9w",nocase; classtype:trojan-activity; sid:100003870; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21847&authkey=aemnhwbhlskovgm",nocase; classtype:trojan-activity; sid:100003871; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21848&authkey=ag1_e421v-t5r9w",nocase; classtype:trojan-activity; sid:100003872; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=fe85161c3947f2c1&resid=fe85161c3947f2c1%211441&authkey=agb6c1ecr91svrw",nocase; classtype:trojan-activity; sid:100003873; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!693&authkey=agcpkhnewfte_yc",nocase; classtype:trojan-activity; sid:100003874; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!694&authkey=aa5jqzjsp0esr1s",nocase; classtype:trojan-activity; sid:100003875; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21693&authkey=agcpkhnewfte_yc",nocase; classtype:trojan-activity; sid:100003876; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21694&authkey=aa5jqzjsp0esr1s",nocase; classtype:trojan-activity; sid:100003877; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!330&authkey=adxnzkb0a09pizw",nocase; classtype:trojan-activity; sid:100003878; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!334&authkey=agsvox_t7qim4ta",nocase; classtype:trojan-activity; sid:100003879; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!335&authkey=ach14e6omcghwgg",nocase; classtype:trojan-activity; sid:100003880; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21330&authkey=adxnzkb0a09pizw",nocase; classtype:trojan-activity; sid:100003881; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21333&authkey=aielwtaiuvcttlm",nocase; classtype:trojan-activity; sid:100003882; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21334&authkey=agsvox_t7qim4ta",nocase; classtype:trojan-activity; sid:100003883; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"paste.ee",nocase; http_uri; content:"/r/a39ev",nocase; classtype:trojan-activity; sid:100003884; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pastebin.com",nocase; http_uri; content:"/raw/77jhk0iw",nocase; classtype:trojan-activity; sid:100003885; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pastebin.com",nocase; http_uri; content:"/raw/89hkc7wb",nocase; classtype:trojan-activity; sid:100003886; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pastebin.com",nocase; http_uri; content:"/raw/yqvsvlvq",nocase; classtype:trojan-activity; sid:100003887; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"pierreconsulting.info",nocase; http_uri; content:"/wp-admin/llc/mwcacs65xienqdp/",nocase; classtype:trojan-activity; sid:100003888; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"procrossover.ru",nocase; http_uri; content:"/wp-content/uploads/2020/10/skoda22.jpg",nocase; classtype:trojan-activity; sid:100003889; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"procrossover.ru",nocase; http_uri; content:"/wp-content/uploads/2020/10/skodaqq.jpg",nocase; classtype:trojan-activity; sid:100003890; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"qjbutterflyevents.co.za",nocase; http_uri; content:"/wp-admin/zzcoiatsr5wujrwagsgbnm2wkjxldvgu/",nocase; classtype:trojan-activity; sid:100003891; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"quen.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/dhlshipmentawb80326979402.ace",nocase; classtype:trojan-activity; sid:100003892; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"quen.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/maersk-bl+draft-copy-shipping-documents.ace",nocase; classtype:trojan-activity; sid:100003893; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"quen.s3.us-east-2.amazonaws.com",nocase; http_uri; content:"/po+for+april+shipment.ace",nocase; classtype:trojan-activity; sid:100003894; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/arntsonl/calc_security_poc/master/dll/calc.dll",nocase; classtype:trojan-activity; sid:100003895; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/bero1985/berotinypascal/e34bd4164f4b7c27e7cf667dffd9274d33d6dfbe/bin/btpc.exe",nocase; classtype:trojan-activity; sid:100003896; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/evil-coder66/defendercontrol/main/defendercontrol.exe",nocase; classtype:trojan-activity; sid:100003897; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/fuzzbunch/fuzzbunch/master/payloads/doublepulsar-1.3.1.exe",nocase; classtype:trojan-activity; sid:100003898; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/inquisb/shellcodeexec/master/windows/shellcodeexec.x32.exe",nocase; classtype:trojan-activity; sid:100003899; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/malwares/webshell/master/ajax_php%20command%20shell.rar",nocase; classtype:trojan-activity; sid:100003900; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/myqseeaccount/one/main/one.htm",nocase; classtype:trojan-activity; sid:100003901; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/realtek25556/rhti2/gh-pages/90hfnvo69vk2ot.bmp",nocase; classtype:trojan-activity; sid:100003902; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/secwiki/windows-kernel-exploits/master/ms15-076/binary/trebuchet.exe",nocase; classtype:trojan-activity; sid:100003903; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/secwiki/windows-kernel-exploits/master/ms16-098/bfill.exe",nocase; classtype:trojan-activity; sid:100003904; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"raw.githubusercontent.com",nocase; http_uri; content:"/tennc/webshell/master/other/small_shell.txt",nocase; classtype:trojan-activity; sid:100003905; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"res.yeshen.com",nocase; http_uri; content:"/player/launch/2017/09/12/da5f9a1c23034353852750488feeaf36.exe",nocase; classtype:trojan-activity; sid:100003906; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sendspace.com",nocase; http_uri; content:"/pro/dl/q05z91",nocase; classtype:trojan-activity; sid:100003907; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"shribharatvatika.com",nocase; http_uri; content:"/ey4lpx8rx.zip",nocase; classtype:trojan-activity; sid:100003908; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/stormqk/dn/stormagent.apk?attredirects=0",nocase; classtype:trojan-activity; sid:100003909; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6ca94027662tilxa4p/base.txt",nocase; classtype:trojan-activity; sid:100003910; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6cbd811626fvoj29vw/base64.txt",nocase; classtype:trojan-activity; sid:100003911; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6cd19c87f44r9fomit/base64jef.txt",nocase; classtype:trojan-activity; sid:100003912; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6e2cbda22efxk3t7x2/base64.txt",nocase; classtype:trojan-activity; sid:100003913; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6e2f6c8c5adup2yiwx/basejefin.txt",nocase; classtype:trojan-activity; sid:100003914; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6eab37b8dadmy1gx7c/base3.5.txt",nocase; classtype:trojan-activity; sid:100003915; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6eb2aa215a8cvwcf6s/fudjs.txt",nocase; classtype:trojan-activity; sid:100003916; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c6fd6b4eb1c08aamus8/go.jpeg",nocase; classtype:trojan-activity; sid:100003917; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c7921a2cf26cunjcgvm/nanocoregomes.txt",nocase; classtype:trojan-activity; sid:100003918; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/wzukusers/user-34654398/documents/5c9e24cc08a4dlmv7cjo/cdt.txt",nocase; classtype:trojan-activity; sid:100003919; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"technologydistilled.com",nocase; http_uri; content:"/a-nurse-ss8d9/z/",nocase; classtype:trojan-activity; sid:100003920; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"tsrv4.ws",nocase; http_uri; content:"/23.exe",nocase; classtype:trojan-activity; sid:100003921; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"users.skynet.be",nocase; http_uri; content:"/crisanar/defis/jek_crackme1.7.zip",nocase; classtype:trojan-activity; sid:100003922; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"vniel.co.kr",nocase; http_uri; content:"/gnuboard/data/scan/amowvegfrt9ja/",nocase; classtype:trojan-activity; sid:100003923; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"vniel.co.kr",nocase; http_uri; content:"/gnuboard/data/scan/fu6jvxzzs46uqlp7l/",nocase; classtype:trojan-activity; sid:100003924; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"web.mit.edu",nocase; http_uri; content:"/kolya/.f/root/net.mit.edu/net/user/chris/winnt/mit_agenda2a.doc",nocase; classtype:trojan-activity; sid:100003925; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"web.mit.edu",nocase; http_uri; content:"/kolya/.f/root/net.mit.edu/sipb/user/kolya/afs/root.afs/net/user/chris/winnt/mit_agenda2a.doc",nocase; classtype:trojan-activity; sid:100003926; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/136_140/flt_shovemydiscoupyourarse.exe",nocase; classtype:trojan-activity; sid:100003927; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/136_140/kb%5efr_ouverture.exe",nocase; classtype:trojan-activity; sid:100003928; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/136_140/kb^fr_ouverture.exe",nocase; classtype:trojan-activity; sid:100003929; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/146_150/bc_memories_from_the_mcp.exe",nocase; classtype:trojan-activity; sid:100003930; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"websound.ru",nocase; http_uri; content:"/issues/151_155/tidex_-_short_stuff.exe",nocase; classtype:trojan-activity; sid:100003931; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"wikileaks.org",nocase; http_uri; content:"/syria-files/attach/222/222051_instruction.zip",nocase; classtype:trojan-activity; sid:100003932; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"yp.hnggzyjy.cn",nocase; http_uri; content:"/common/yz.vbs",nocase; classtype:trojan-activity; sid:100003933; rev:1;) diff --git a/urlhaus-filter-suricata-online.rules b/urlhaus-filter-suricata-online.rules index d38dfd83..fb5d494e 100644 --- a/urlhaus-filter-suricata-online.rules +++ b/urlhaus-filter-suricata-online.rules @@ -1,5 +1,5 @@ # Title: Online Malicious URL Suricata Ruleset -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -7,778 +7,778 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0-24bpautomentes.hu"; classtype:trojan-activity; sid:100000001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0cl.sldov.ru"; classtype:trojan-activity; sid:100000002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.10.147.48"; classtype:trojan-activity; sid:100000003; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.207.196.135"; classtype:trojan-activity; sid:100000004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.222.196.60"; classtype:trojan-activity; sid:100000005; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.245.4.163"; classtype:trojan-activity; sid:100000006; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.107"; classtype:trojan-activity; sid:100000007; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.109"; classtype:trojan-activity; sid:100000008; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.113"; classtype:trojan-activity; sid:100000009; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.127"; classtype:trojan-activity; sid:100000010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.134"; classtype:trojan-activity; sid:100000011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.138"; classtype:trojan-activity; sid:100000012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.14"; classtype:trojan-activity; sid:100000013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.222.196.60"; classtype:trojan-activity; sid:100000004; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.245.4.163"; classtype:trojan-activity; sid:100000005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.107"; classtype:trojan-activity; sid:100000006; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.109"; classtype:trojan-activity; sid:100000007; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.113"; classtype:trojan-activity; sid:100000008; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.127"; classtype:trojan-activity; sid:100000009; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.134"; classtype:trojan-activity; sid:100000010; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.138"; classtype:trojan-activity; sid:100000011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.14"; classtype:trojan-activity; sid:100000012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.153"; classtype:trojan-activity; sid:100000013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.16"; classtype:trojan-activity; sid:100000014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.165"; classtype:trojan-activity; sid:100000015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.20"; classtype:trojan-activity; sid:100000016; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.228"; classtype:trojan-activity; sid:100000017; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.234"; classtype:trojan-activity; sid:100000018; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.237"; classtype:trojan-activity; sid:100000019; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.245"; classtype:trojan-activity; sid:100000020; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.249"; classtype:trojan-activity; sid:100000021; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.25"; classtype:trojan-activity; sid:100000022; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.38"; classtype:trojan-activity; sid:100000023; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.41"; classtype:trojan-activity; sid:100000024; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.43"; classtype:trojan-activity; sid:100000025; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.45"; classtype:trojan-activity; sid:100000026; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.56"; classtype:trojan-activity; sid:100000027; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.63"; classtype:trojan-activity; sid:100000028; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.69"; classtype:trojan-activity; sid:100000029; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.8"; classtype:trojan-activity; sid:100000030; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.80"; classtype:trojan-activity; sid:100000031; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.94"; classtype:trojan-activity; sid:100000032; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.98"; classtype:trojan-activity; sid:100000033; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.10"; classtype:trojan-activity; sid:100000034; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.105"; classtype:trojan-activity; sid:100000035; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.109"; classtype:trojan-activity; sid:100000036; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.126"; classtype:trojan-activity; sid:100000037; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.127"; classtype:trojan-activity; sid:100000038; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.130"; classtype:trojan-activity; sid:100000039; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.146"; classtype:trojan-activity; sid:100000040; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.148"; classtype:trojan-activity; sid:100000041; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.15"; classtype:trojan-activity; sid:100000042; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.151"; classtype:trojan-activity; sid:100000043; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.22"; classtype:trojan-activity; sid:100000044; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.223"; classtype:trojan-activity; sid:100000045; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.4"; classtype:trojan-activity; sid:100000046; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.48"; classtype:trojan-activity; sid:100000047; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.54"; classtype:trojan-activity; sid:100000048; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.58"; classtype:trojan-activity; sid:100000049; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.59"; classtype:trojan-activity; sid:100000050; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.6"; classtype:trojan-activity; sid:100000051; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.71"; classtype:trojan-activity; sid:100000052; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.83"; classtype:trojan-activity; sid:100000053; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.94"; classtype:trojan-activity; sid:100000054; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.247.221.141"; classtype:trojan-activity; sid:100000055; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.247.221.142"; classtype:trojan-activity; sid:100000056; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.250.159.41"; classtype:trojan-activity; sid:100000057; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.65.166.225"; classtype:trojan-activity; sid:100000058; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.82.104.89"; classtype:trojan-activity; sid:100000059; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"100.12.184.63"; classtype:trojan-activity; sid:100000060; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"100.12.51.122"; classtype:trojan-activity; sid:100000061; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"100.8.77.4"; classtype:trojan-activity; sid:100000062; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1008691.com"; classtype:trojan-activity; sid:100000063; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.108.130.121"; classtype:trojan-activity; sid:100000064; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.16.183.179"; classtype:trojan-activity; sid:100000065; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.229.85.127"; classtype:trojan-activity; sid:100000066; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.255.36.154"; classtype:trojan-activity; sid:100000067; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.28.105.132"; classtype:trojan-activity; sid:100000068; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.28.218.245"; classtype:trojan-activity; sid:100000069; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.28.76.34"; classtype:trojan-activity; sid:100000070; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.66.81.70"; classtype:trojan-activity; sid:100000071; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.75.157.99"; classtype:trojan-activity; sid:100000072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.130.115.14"; classtype:trojan-activity; sid:100000073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.141.240.139"; classtype:trojan-activity; sid:100000074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.113.99.79"; classtype:trojan-activity; sid:100000075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.125.218.107"; classtype:trojan-activity; sid:100000076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.141.138.118"; classtype:trojan-activity; sid:100000077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.16.145.25"; classtype:trojan-activity; sid:100000078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.204.168.34"; classtype:trojan-activity; sid:100000079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.217.215.21"; classtype:trojan-activity; sid:100000080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.219.152.228"; classtype:trojan-activity; sid:100000081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.224.200.146"; classtype:trojan-activity; sid:100000082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.224.200.40"; classtype:trojan-activity; sid:100000083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.237.21.36"; classtype:trojan-activity; sid:100000084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.238.228.3"; classtype:trojan-activity; sid:100000085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.240.249.121"; classtype:trojan-activity; sid:100000086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.4.117.26"; classtype:trojan-activity; sid:100000087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.79.112.254"; classtype:trojan-activity; sid:100000088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.82.98.170"; classtype:trojan-activity; sid:100000089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.123.92"; classtype:trojan-activity; sid:100000090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.12"; classtype:trojan-activity; sid:100000091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.14"; classtype:trojan-activity; sid:100000092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.16"; classtype:trojan-activity; sid:100000093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.17"; classtype:trojan-activity; sid:100000094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.23"; classtype:trojan-activity; sid:100000095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.25"; classtype:trojan-activity; sid:100000096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.28"; classtype:trojan-activity; sid:100000097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.36"; classtype:trojan-activity; sid:100000098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.46"; classtype:trojan-activity; sid:100000099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.47"; classtype:trojan-activity; sid:100000100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.92.25.90"; classtype:trojan-activity; sid:100000101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.92.25.95"; classtype:trojan-activity; sid:100000102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.97.184.180"; classtype:trojan-activity; sid:100000103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.168.98.159"; classtype:trojan-activity; sid:100000104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.184.75.123"; classtype:trojan-activity; sid:100000105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.206.93.94"; classtype:trojan-activity; sid:100000106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.33.52.85"; classtype:trojan-activity; sid:100000107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.61.86.37"; classtype:trojan-activity; sid:100000108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.7.141.172"; classtype:trojan-activity; sid:100000109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"106.1.111.91"; classtype:trojan-activity; sid:100000110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"106.104.172.178"; classtype:trojan-activity; sid:100000111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"106.104.193.155"; classtype:trojan-activity; sid:100000112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"106.105.33.43"; classtype:trojan-activity; sid:100000113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.172.104.105"; classtype:trojan-activity; sid:100000114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.172.193.132"; classtype:trojan-activity; sid:100000115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.172.249.148"; classtype:trojan-activity; sid:100000116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.173.219.80"; classtype:trojan-activity; sid:100000117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.174.250.107"; classtype:trojan-activity; sid:100000118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.174.61.139"; classtype:trojan-activity; sid:100000119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.175.197.135"; classtype:trojan-activity; sid:100000120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.175.31.130"; classtype:trojan-activity; sid:100000121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.175.33.48"; classtype:trojan-activity; sid:100000122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.181.136.96"; classtype:trojan-activity; sid:100000123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.194.242.170"; classtype:trojan-activity; sid:100000124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.219.185.75"; classtype:trojan-activity; sid:100000125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.220.119.25"; classtype:trojan-activity; sid:100000126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.221.96.202"; classtype:trojan-activity; sid:100000127; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"108.190.201.37"; classtype:trojan-activity; sid:100000128; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"108.190.250.48"; classtype:trojan-activity; sid:100000129; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"108.249.194.121"; classtype:trojan-activity; sid:100000130; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.104.151.108"; classtype:trojan-activity; sid:100000131; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.124.90.229"; classtype:trojan-activity; sid:100000132; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.233.196.232"; classtype:trojan-activity; sid:100000133; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.235.7.228"; classtype:trojan-activity; sid:100000134; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.86.85.253"; classtype:trojan-activity; sid:100000135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.88.185.119"; classtype:trojan-activity; sid:100000136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.95.200.102"; classtype:trojan-activity; sid:100000137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.95.200.230"; classtype:trojan-activity; sid:100000138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.96.127.90"; classtype:trojan-activity; sid:100000139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.96.57.246"; classtype:trojan-activity; sid:100000140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.99.37.97"; classtype:trojan-activity; sid:100000141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.14.58.190"; classtype:trojan-activity; sid:100000142; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.187.229.182"; classtype:trojan-activity; sid:100000143; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.228.195.46"; classtype:trojan-activity; sid:100000144; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.248.124.254"; classtype:trojan-activity; sid:100000145; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.248.175.141"; classtype:trojan-activity; sid:100000146; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.248.251.194"; classtype:trojan-activity; sid:100000147; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.251.10.18"; classtype:trojan-activity; sid:100000148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.253.150.248"; classtype:trojan-activity; sid:100000149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.253.213.198"; classtype:trojan-activity; sid:100000150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.255.101.184"; classtype:trojan-activity; sid:100000151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.145.127"; classtype:trojan-activity; sid:100000152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.208.21"; classtype:trojan-activity; sid:100000153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.221.77"; classtype:trojan-activity; sid:100000154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.223.92"; classtype:trojan-activity; sid:100000155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.225.24"; classtype:trojan-activity; sid:100000156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.235.57"; classtype:trojan-activity; sid:100000157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.4.2"; classtype:trojan-activity; sid:100000158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.89.10.147"; classtype:trojan-activity; sid:100000159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.89.222.213"; classtype:trojan-activity; sid:100000160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.118.111.207"; classtype:trojan-activity; sid:100000161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.118.88.61"; classtype:trojan-activity; sid:100000162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.119.245.114"; classtype:trojan-activity; sid:100000163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.125.67.125"; classtype:trojan-activity; sid:100000164; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.163.50.120"; classtype:trojan-activity; sid:100000165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.170.86.31"; classtype:trojan-activity; sid:100000166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.172.57.20"; classtype:trojan-activity; sid:100000167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.182.235.252"; classtype:trojan-activity; sid:100000168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.171.111"; classtype:trojan-activity; sid:100000169; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.177.85"; classtype:trojan-activity; sid:100000170; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.23.84"; classtype:trojan-activity; sid:100000171; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.230.136"; classtype:trojan-activity; sid:100000172; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.27.9"; classtype:trojan-activity; sid:100000173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.49.223"; classtype:trojan-activity; sid:100000174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.103.122"; classtype:trojan-activity; sid:100000175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.103.66"; classtype:trojan-activity; sid:100000176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.104.141"; classtype:trojan-activity; sid:100000177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.106.19"; classtype:trojan-activity; sid:100000178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.121.222"; classtype:trojan-activity; sid:100000179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.121.223"; classtype:trojan-activity; sid:100000180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.121.226"; classtype:trojan-activity; sid:100000181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.121.228"; classtype:trojan-activity; sid:100000182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.123.136"; classtype:trojan-activity; sid:100000183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.26.243"; classtype:trojan-activity; sid:100000184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.8.81"; classtype:trojan-activity; sid:100000185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.111.108.184"; classtype:trojan-activity; sid:100000186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.133.222.151"; classtype:trojan-activity; sid:100000187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.170.124.75"; classtype:trojan-activity; sid:100000188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.170.233.9"; classtype:trojan-activity; sid:100000189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.186.210.211"; classtype:trojan-activity; sid:100000190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.186.96.252"; classtype:trojan-activity; sid:100000191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.187.91.117"; classtype:trojan-activity; sid:100000192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.214.127.42"; classtype:trojan-activity; sid:100000193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.225.187.19"; classtype:trojan-activity; sid:100000194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.225.236.77"; classtype:trojan-activity; sid:100000195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.225.239.126"; classtype:trojan-activity; sid:100000196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.225.43.27"; classtype:trojan-activity; sid:100000197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.226.162.148"; classtype:trojan-activity; sid:100000198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.226.67.193"; classtype:trojan-activity; sid:100000199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.228.180.95"; classtype:trojan-activity; sid:100000200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.229.178.109"; classtype:trojan-activity; sid:100000201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.230.168.103"; classtype:trojan-activity; sid:100000202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.234.218.202"; classtype:trojan-activity; sid:100000203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.235.188.86"; classtype:trojan-activity; sid:100000204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.236.171.69"; classtype:trojan-activity; sid:100000205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.141.241"; classtype:trojan-activity; sid:100000206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.144.226"; classtype:trojan-activity; sid:100000207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.209.30"; classtype:trojan-activity; sid:100000208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.75.157"; classtype:trojan-activity; sid:100000209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.99.207"; classtype:trojan-activity; sid:100000210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.238.143.135"; classtype:trojan-activity; sid:100000211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.238.190.207"; classtype:trojan-activity; sid:100000212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.238.227.228"; classtype:trojan-activity; sid:100000213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.238.39.2"; classtype:trojan-activity; sid:100000214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.240.216.17"; classtype:trojan-activity; sid:100000215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.245.12.89"; classtype:trojan-activity; sid:100000216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.245.8.24"; classtype:trojan-activity; sid:100000217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.246.126.58"; classtype:trojan-activity; sid:100000218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.246.162.50"; classtype:trojan-activity; sid:100000219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.246.180.49"; classtype:trojan-activity; sid:100000220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.100.14"; classtype:trojan-activity; sid:100000221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.16.222"; classtype:trojan-activity; sid:100000222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.191.118"; classtype:trojan-activity; sid:100000223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.214.146"; classtype:trojan-activity; sid:100000224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.240.226"; classtype:trojan-activity; sid:100000225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.82.122"; classtype:trojan-activity; sid:100000226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.248.148.90"; classtype:trojan-activity; sid:100000227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.248.197.164"; classtype:trojan-activity; sid:100000228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.249.109.217"; classtype:trojan-activity; sid:100000229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.249.118.157"; classtype:trojan-activity; sid:100000230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.250.102.173"; classtype:trojan-activity; sid:100000231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.251.218.210"; classtype:trojan-activity; sid:100000232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.252.196.17"; classtype:trojan-activity; sid:100000233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.252.221.244"; classtype:trojan-activity; sid:100000234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.254.208.123"; classtype:trojan-activity; sid:100000235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.255.6.129"; classtype:trojan-activity; sid:100000236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.255.8.235"; classtype:trojan-activity; sid:100000237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.111"; classtype:trojan-activity; sid:100000238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.117"; classtype:trojan-activity; sid:100000239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.131"; classtype:trojan-activity; sid:100000240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.132"; classtype:trojan-activity; sid:100000241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.133"; classtype:trojan-activity; sid:100000242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.138"; classtype:trojan-activity; sid:100000243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.139"; classtype:trojan-activity; sid:100000244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.143"; classtype:trojan-activity; sid:100000245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.146"; classtype:trojan-activity; sid:100000246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.147"; classtype:trojan-activity; sid:100000247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.149"; classtype:trojan-activity; sid:100000248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.151"; classtype:trojan-activity; sid:100000249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.158"; classtype:trojan-activity; sid:100000250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.162"; classtype:trojan-activity; sid:100000251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.165"; classtype:trojan-activity; sid:100000252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.175"; classtype:trojan-activity; sid:100000253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.177"; classtype:trojan-activity; sid:100000254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.179"; classtype:trojan-activity; sid:100000255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.180"; classtype:trojan-activity; sid:100000256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.127.155"; classtype:trojan-activity; sid:100000257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.80.120"; classtype:trojan-activity; sid:100000258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.82.29"; classtype:trojan-activity; sid:100000259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.83.23"; classtype:trojan-activity; sid:100000260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.85.113"; classtype:trojan-activity; sid:100000261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.87.130"; classtype:trojan-activity; sid:100000262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.88.116"; classtype:trojan-activity; sid:100000263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.91.212"; classtype:trojan-activity; sid:100000264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.158"; classtype:trojan-activity; sid:100000265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.159"; classtype:trojan-activity; sid:100000266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.168"; classtype:trojan-activity; sid:100000267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.177"; classtype:trojan-activity; sid:100000268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.188"; classtype:trojan-activity; sid:100000269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.200"; classtype:trojan-activity; sid:100000270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.219"; classtype:trojan-activity; sid:100000271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.229"; classtype:trojan-activity; sid:100000272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.230"; classtype:trojan-activity; sid:100000273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.247"; classtype:trojan-activity; sid:100000274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.90"; classtype:trojan-activity; sid:100000275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.91"; classtype:trojan-activity; sid:100000276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.33"; classtype:trojan-activity; sid:100000277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.38"; classtype:trojan-activity; sid:100000278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.43"; classtype:trojan-activity; sid:100000279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.48"; classtype:trojan-activity; sid:100000280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.38.19"; classtype:trojan-activity; sid:100000281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.103"; classtype:trojan-activity; sid:100000282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.124"; classtype:trojan-activity; sid:100000283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.136"; classtype:trojan-activity; sid:100000284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.57"; classtype:trojan-activity; sid:100000285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.68"; classtype:trojan-activity; sid:100000286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.97.184"; classtype:trojan-activity; sid:100000287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.0.113"; classtype:trojan-activity; sid:100000288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.176.16"; classtype:trojan-activity; sid:100000289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.240.239"; classtype:trojan-activity; sid:100000290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.87.98"; classtype:trojan-activity; sid:100000291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.53.224.79"; classtype:trojan-activity; sid:100000292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.65.53.175"; classtype:trojan-activity; sid:100000293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.153.37"; classtype:trojan-activity; sid:100000294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.162.49"; classtype:trojan-activity; sid:100000295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.175.147"; classtype:trojan-activity; sid:100000296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.176.112"; classtype:trojan-activity; sid:100000297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.176.84"; classtype:trojan-activity; sid:100000298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.226.202"; classtype:trojan-activity; sid:100000299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.78.45.158"; classtype:trojan-activity; sid:100000300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.80.127.91"; classtype:trojan-activity; sid:100000301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.80.215.101"; classtype:trojan-activity; sid:100000302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.82.146.253"; classtype:trojan-activity; sid:100000303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.82.18.255"; classtype:trojan-activity; sid:100000304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.82.224.139"; classtype:trojan-activity; sid:100000305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.93.29.211"; classtype:trojan-activity; sid:100000306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.11.95.254"; classtype:trojan-activity; sid:100000307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.122.238.68"; classtype:trojan-activity; sid:100000308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.161.58.249"; classtype:trojan-activity; sid:100000309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.161.78.185"; classtype:trojan-activity; sid:100000310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.226.42.250"; classtype:trojan-activity; sid:100000311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.227.194.172"; classtype:trojan-activity; sid:100000312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.227.35.229"; classtype:trojan-activity; sid:100000313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.231.211.131"; classtype:trojan-activity; sid:100000314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.254.169.251"; classtype:trojan-activity; sid:100000315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.128.133"; classtype:trojan-activity; sid:100000316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.133.16"; classtype:trojan-activity; sid:100000317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.144.42"; classtype:trojan-activity; sid:100000318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.154.21"; classtype:trojan-activity; sid:100000319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.61.204.205"; classtype:trojan-activity; sid:100000320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.87.226.255"; classtype:trojan-activity; sid:100000321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.87.32.93"; classtype:trojan-activity; sid:100000322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.89.43.185"; classtype:trojan-activity; sid:100000323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.111.242.3"; classtype:trojan-activity; sid:100000324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.224.203.128"; classtype:trojan-activity; sid:100000325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.226.100.56"; classtype:trojan-activity; sid:100000326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.228.205.101"; classtype:trojan-activity; sid:100000327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.229.165.194"; classtype:trojan-activity; sid:100000328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.30.54.64"; classtype:trojan-activity; sid:100000329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.79.172.42"; classtype:trojan-activity; sid:100000330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.165.216.112"; classtype:trojan-activity; sid:100000331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.201.38.185"; classtype:trojan-activity; sid:100000332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.42.47.36"; classtype:trojan-activity; sid:100000333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.50.227.209"; classtype:trojan-activity; sid:100000334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.50.92.195"; classtype:trojan-activity; sid:100000335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.55.158.93"; classtype:trojan-activity; sid:100000336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.56.131.242"; classtype:trojan-activity; sid:100000337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.56.133.96"; classtype:trojan-activity; sid:100000338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.56.135.210"; classtype:trojan-activity; sid:100000339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.56.152.194"; classtype:trojan-activity; sid:100000340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.58.132.140"; classtype:trojan-activity; sid:100000341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.59.233.160"; classtype:trojan-activity; sid:100000342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.61.112.199"; classtype:trojan-activity; sid:100000343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.73.3.11"; classtype:trojan-activity; sid:100000344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.92.174.231"; classtype:trojan-activity; sid:100000345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.124.219.2"; classtype:trojan-activity; sid:100000346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.132.151.60"; classtype:trojan-activity; sid:100000347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.206.164.46"; classtype:trojan-activity; sid:100000348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.211.100.26"; classtype:trojan-activity; sid:100000349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.196.50.5"; classtype:trojan-activity; sid:100000350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.204.138"; classtype:trojan-activity; sid:100000351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.204.5"; classtype:trojan-activity; sid:100000352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.210.52"; classtype:trojan-activity; sid:100000353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.220.126"; classtype:trojan-activity; sid:100000354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.243.40"; classtype:trojan-activity; sid:100000355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.200.76.54"; classtype:trojan-activity; sid:100000356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.26.104.74"; classtype:trojan-activity; sid:100000357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.63.113.146"; classtype:trojan-activity; sid:100000358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.63.195.140"; classtype:trojan-activity; sid:100000359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.63.53.15"; classtype:trojan-activity; sid:100000360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.86.105.110"; classtype:trojan-activity; sid:100000361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.176.104.35"; classtype:trojan-activity; sid:100000362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.176.157.64"; classtype:trojan-activity; sid:100000363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.176.7.132"; classtype:trojan-activity; sid:100000364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.223.32.74"; classtype:trojan-activity; sid:100000365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.223.5.149"; classtype:trojan-activity; sid:100000366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.223.72.141"; classtype:trojan-activity; sid:100000367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.12.130"; classtype:trojan-activity; sid:100000368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.128.147"; classtype:trojan-activity; sid:100000369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.208.215"; classtype:trojan-activity; sid:100000370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.209.108"; classtype:trojan-activity; sid:100000371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.214.72"; classtype:trojan-activity; sid:100000372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.88.146"; classtype:trojan-activity; sid:100000373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.96.150"; classtype:trojan-activity; sid:100000374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.96.6"; classtype:trojan-activity; sid:100000375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.233.221.162"; classtype:trojan-activity; sid:100000376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.233.63.194"; classtype:trojan-activity; sid:100000377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.233.65.93"; classtype:trojan-activity; sid:100000378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.42.125.246"; classtype:trojan-activity; sid:100000379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.43.180.33"; classtype:trojan-activity; sid:100000380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.79.125.92"; classtype:trojan-activity; sid:100000381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.79.50.203"; classtype:trojan-activity; sid:100000382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.79.58.82"; classtype:trojan-activity; sid:100000383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.99.179.164"; classtype:trojan-activity; sid:100000384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.99.183.235"; classtype:trojan-activity; sid:100000385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.99.239.217"; classtype:trojan-activity; sid:100000386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.102.179.235"; classtype:trojan-activity; sid:100000387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.108.161.25"; classtype:trojan-activity; sid:100000388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.112.185.232"; classtype:trojan-activity; sid:100000389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.123.238.52"; classtype:trojan-activity; sid:100000390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.14.143.145"; classtype:trojan-activity; sid:100000391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.147.213.57"; classtype:trojan-activity; sid:100000392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.163.93.191"; classtype:trojan-activity; sid:100000393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.164.18.235"; classtype:trojan-activity; sid:100000394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.164.218.229"; classtype:trojan-activity; sid:100000395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.165.107.93"; classtype:trojan-activity; sid:100000396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.165.241.222"; classtype:trojan-activity; sid:100000397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.165.27.77"; classtype:trojan-activity; sid:100000398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.165.68.145"; classtype:trojan-activity; sid:100000399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.166.170.241"; classtype:trojan-activity; sid:100000400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.166.97.6"; classtype:trojan-activity; sid:100000401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.167.26.33"; classtype:trojan-activity; sid:100000402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.177.147.38"; classtype:trojan-activity; sid:100000403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.178.248.123"; classtype:trojan-activity; sid:100000404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.179.43.1"; classtype:trojan-activity; sid:100000405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.18.38.144"; classtype:trojan-activity; sid:100000406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.180.106.217"; classtype:trojan-activity; sid:100000407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.180.33.161"; classtype:trojan-activity; sid:100000408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.181.119.21"; classtype:trojan-activity; sid:100000409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.181.124.203"; classtype:trojan-activity; sid:100000410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.182.97.232"; classtype:trojan-activity; sid:100000411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.183.115.103"; classtype:trojan-activity; sid:100000412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.184.172.199"; classtype:trojan-activity; sid:100000413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.187.195.161"; classtype:trojan-activity; sid:100000414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.187.245.61"; classtype:trojan-activity; sid:100000415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.189.137.195"; classtype:trojan-activity; sid:100000416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.189.227.244"; classtype:trojan-activity; sid:100000417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.150.85"; classtype:trojan-activity; sid:100000418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.187.206"; classtype:trojan-activity; sid:100000419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.215.221"; classtype:trojan-activity; sid:100000420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.240.20"; classtype:trojan-activity; sid:100000421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.255.236"; classtype:trojan-activity; sid:100000422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.204.30.144"; classtype:trojan-activity; sid:100000423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.250.129.231"; classtype:trojan-activity; sid:100000424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.251.105.221"; classtype:trojan-activity; sid:100000425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.131.155"; classtype:trojan-activity; sid:100000426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.143.46"; classtype:trojan-activity; sid:100000427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.143.71"; classtype:trojan-activity; sid:100000428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.144.75"; classtype:trojan-activity; sid:100000429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.148.115"; classtype:trojan-activity; sid:100000430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.155.57"; classtype:trojan-activity; sid:100000431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.173.24"; classtype:trojan-activity; sid:100000432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.195.90"; classtype:trojan-activity; sid:100000433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.132.113.2"; classtype:trojan-activity; sid:100000434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.15.69.83"; classtype:trojan-activity; sid:100000435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.178.187.6"; classtype:trojan-activity; sid:100000436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.178.187.7"; classtype:trojan-activity; sid:100000437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.178.187.8"; classtype:trojan-activity; sid:100000438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.178.187.9"; classtype:trojan-activity; sid:100000439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.207.39.227"; classtype:trojan-activity; sid:100000440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.25.204.189"; classtype:trojan-activity; sid:100000441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.0.255.173"; classtype:trojan-activity; sid:100000442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.142.222.22"; classtype:trojan-activity; sid:100000443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.150.213.110"; classtype:trojan-activity; sid:100000444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.151.248.134"; classtype:trojan-activity; sid:100000445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.180"; classtype:trojan-activity; sid:100000446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.183"; classtype:trojan-activity; sid:100000447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.185"; classtype:trojan-activity; sid:100000448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.186"; classtype:trojan-activity; sid:100000449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.193"; classtype:trojan-activity; sid:100000450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.201"; classtype:trojan-activity; sid:100000451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.202"; classtype:trojan-activity; sid:100000452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.204"; classtype:trojan-activity; sid:100000453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.208"; classtype:trojan-activity; sid:100000454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.212"; classtype:trojan-activity; sid:100000455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.233"; classtype:trojan-activity; sid:100000456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.126.235"; classtype:trojan-activity; sid:100000457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.126.239"; classtype:trojan-activity; sid:100000458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.126.60"; classtype:trojan-activity; sid:100000459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.127.187"; classtype:trojan-activity; sid:100000460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.99.127"; classtype:trojan-activity; sid:100000461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.210.89.79"; classtype:trojan-activity; sid:100000462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.50.66.60"; classtype:trojan-activity; sid:100000463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.50.93.115"; classtype:trojan-activity; sid:100000464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.6.8.11"; classtype:trojan-activity; sid:100000465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.7.75.99"; classtype:trojan-activity; sid:100000466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.100.114.164"; classtype:trojan-activity; sid:100000467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.100.96.8"; classtype:trojan-activity; sid:100000468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.121.44.222"; classtype:trojan-activity; sid:100000469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.123.53.25"; classtype:trojan-activity; sid:100000470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.127.155.220"; classtype:trojan-activity; sid:100000471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.141.11.56"; classtype:trojan-activity; sid:100000472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.15.142.137"; classtype:trojan-activity; sid:100000473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.159.22.144"; classtype:trojan-activity; sid:100000474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.170.234.142"; classtype:trojan-activity; sid:100000475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.170.8.146"; classtype:trojan-activity; sid:100000476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.185.31.2"; classtype:trojan-activity; sid:100000477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.190.36.8"; classtype:trojan-activity; sid:100000478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.20.104.26"; classtype:trojan-activity; sid:100000479; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.225.11.163"; classtype:trojan-activity; sid:100000480; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.237.226.202"; classtype:trojan-activity; sid:100000481; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.24.116.173"; classtype:trojan-activity; sid:100000482; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.25.54.241"; classtype:trojan-activity; sid:100000483; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.254.76.17"; classtype:trojan-activity; sid:100000484; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.88.99.236"; classtype:trojan-activity; sid:100000485; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.100.150.204"; classtype:trojan-activity; sid:100000486; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.160.147.53"; classtype:trojan-activity; sid:100000487; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.188.86.225"; classtype:trojan-activity; sid:100000488; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.199.72.23"; classtype:trojan-activity; sid:100000489; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.199.79.27"; classtype:trojan-activity; sid:100000490; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.202.37.85"; classtype:trojan-activity; sid:100000491; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.254.33.214"; classtype:trojan-activity; sid:100000492; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.0.240.58"; classtype:trojan-activity; sid:100000493; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.10.15.35"; classtype:trojan-activity; sid:100000494; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.124.244"; classtype:trojan-activity; sid:100000495; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.170.237"; classtype:trojan-activity; sid:100000496; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.182.187"; classtype:trojan-activity; sid:100000497; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.19.248"; classtype:trojan-activity; sid:100000498; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.238.188"; classtype:trojan-activity; sid:100000499; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.129.2.28"; classtype:trojan-activity; sid:100000500; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.129.84.36"; classtype:trojan-activity; sid:100000501; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.130.208.52"; classtype:trojan-activity; sid:100000502; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.130.27.19"; classtype:trojan-activity; sid:100000503; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.130.37.182"; classtype:trojan-activity; sid:100000504; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.131.186.250"; classtype:trojan-activity; sid:100000505; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.132.219.147"; classtype:trojan-activity; sid:100000506; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.133.98.135"; classtype:trojan-activity; sid:100000507; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.134.14.130"; classtype:trojan-activity; sid:100000508; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.154.236.114"; classtype:trojan-activity; sid:100000509; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.159.8.100"; classtype:trojan-activity; sid:100000510; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.183.16.71"; classtype:trojan-activity; sid:100000511; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.191.164.92"; classtype:trojan-activity; sid:100000512; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.192.101.163"; classtype:trojan-activity; sid:100000513; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.193.53.237"; classtype:trojan-activity; sid:100000514; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.194.235.37"; classtype:trojan-activity; sid:100000515; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.194.35.146"; classtype:trojan-activity; sid:100000516; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.194.52.79"; classtype:trojan-activity; sid:100000517; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.194.60.238"; classtype:trojan-activity; sid:100000518; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.195.112.240"; classtype:trojan-activity; sid:100000519; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.195.184.191"; classtype:trojan-activity; sid:100000520; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.195.98.141"; classtype:trojan-activity; sid:100000521; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.212.29.154"; classtype:trojan-activity; sid:100000522; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.213.225.130"; classtype:trojan-activity; sid:100000523; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.233.130.162"; classtype:trojan-activity; sid:100000524; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.233.152.249"; classtype:trojan-activity; sid:100000525; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.234.116.110"; classtype:trojan-activity; sid:100000526; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.234.184.57"; classtype:trojan-activity; sid:100000527; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.240.103.89"; classtype:trojan-activity; sid:100000528; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.240.181.57"; classtype:trojan-activity; sid:100000529; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.240.79.61"; classtype:trojan-activity; sid:100000530; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.241.11.41"; classtype:trojan-activity; sid:100000531; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.241.148.58"; classtype:trojan-activity; sid:100000532; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.241.184.124"; classtype:trojan-activity; sid:100000533; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.28.217.23"; classtype:trojan-activity; sid:100000534; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.4.44.113"; classtype:trojan-activity; sid:100000535; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.5.5.242"; classtype:trojan-activity; sid:100000536; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.8.17.78"; classtype:trojan-activity; sid:100000537; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.129.221.150"; classtype:trojan-activity; sid:100000538; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.129.76.230"; classtype:trojan-activity; sid:100000539; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.129.78.176"; classtype:trojan-activity; sid:100000540; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.130.40.31"; classtype:trojan-activity; sid:100000541; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.104.82"; classtype:trojan-activity; sid:100000542; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.151.135"; classtype:trojan-activity; sid:100000543; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.24.185"; classtype:trojan-activity; sid:100000544; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.26.243"; classtype:trojan-activity; sid:100000545; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.54.33"; classtype:trojan-activity; sid:100000546; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.132.110.150"; classtype:trojan-activity; sid:100000547; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.135.34.49"; classtype:trojan-activity; sid:100000548; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.152.26.45"; classtype:trojan-activity; sid:100000549; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.153.236.6"; classtype:trojan-activity; sid:100000550; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.160.126.238"; classtype:trojan-activity; sid:100000551; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.163.65.64"; classtype:trojan-activity; sid:100000552; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.165.123.7"; classtype:trojan-activity; sid:100000553; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.187.111.160"; classtype:trojan-activity; sid:100000554; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.199.56.198"; classtype:trojan-activity; sid:100000555; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.230.174.233"; classtype:trojan-activity; sid:100000556; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.254.251.54"; classtype:trojan-activity; sid:100000557; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.5.92.20"; classtype:trojan-activity; sid:100000558; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.6.0.4"; classtype:trojan-activity; sid:100000559; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.67.89.28"; classtype:trojan-activity; sid:100000560; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.7.254.85"; classtype:trojan-activity; sid:100000561; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.80.46.73"; classtype:trojan-activity; sid:100000562; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.93.94.207"; classtype:trojan-activity; sid:100000563; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.105.217.252"; classtype:trojan-activity; sid:100000564; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.128.28.161"; classtype:trojan-activity; sid:100000565; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.142.93.34"; classtype:trojan-activity; sid:100000566; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.191.113.212"; classtype:trojan-activity; sid:100000567; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.209.71.6"; classtype:trojan-activity; sid:100000568; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.40.1.235"; classtype:trojan-activity; sid:100000569; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.40.73.68"; classtype:trojan-activity; sid:100000570; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.43.23.193"; classtype:trojan-activity; sid:100000571; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.46.142.96"; classtype:trojan-activity; sid:100000572; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.46.255.38"; classtype:trojan-activity; sid:100000573; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"128.116.133.92"; classtype:trojan-activity; sid:100000574; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"130.255.159.133"; classtype:trojan-activity; sid:100000575; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"134.195.139.4"; classtype:trojan-activity; sid:100000576; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"135.148.36.127"; classtype:trojan-activity; sid:100000577; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"138.99.204.224"; classtype:trojan-activity; sid:100000578; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"139.159.226.180"; classtype:trojan-activity; sid:100000579; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"139.170.173.198"; classtype:trojan-activity; sid:100000580; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"139.216.102.151"; classtype:trojan-activity; sid:100000581; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.102.17.222"; classtype:trojan-activity; sid:100000582; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.136.80.242"; classtype:trojan-activity; sid:100000583; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.138.8.51"; classtype:trojan-activity; sid:100000584; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.160.34.50"; classtype:trojan-activity; sid:100000585; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.189.247.118"; classtype:trojan-activity; sid:100000586; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.232.33.212"; classtype:trojan-activity; sid:100000587; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.37.222.190"; classtype:trojan-activity; sid:100000588; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.45.127.110"; classtype:trojan-activity; sid:100000589; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.46.25.17"; classtype:trojan-activity; sid:100000590; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.46.98.241"; classtype:trojan-activity; sid:100000591; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.50.129.248"; classtype:trojan-activity; sid:100000592; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.55.29.2"; classtype:trojan-activity; sid:100000593; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"142.11.216.5"; classtype:trojan-activity; sid:100000594; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"142.177.56.127"; classtype:trojan-activity; sid:100000595; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"143.198.120.58"; classtype:trojan-activity; sid:100000596; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"146.71.79.230"; classtype:trojan-activity; sid:100000597; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"148.69.108.177"; classtype:trojan-activity; sid:100000598; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"149.255.15.134"; classtype:trojan-activity; sid:100000599; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"149.255.15.184"; classtype:trojan-activity; sid:100000600; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"149.255.15.87"; classtype:trojan-activity; sid:100000601; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"149.255.15.99"; classtype:trojan-activity; sid:100000602; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14karatvisions.com"; classtype:trojan-activity; sid:100000603; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"150.116.207.99"; classtype:trojan-activity; sid:100000604; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"151.177.163.87"; classtype:trojan-activity; sid:100000605; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"151.33.230.191"; classtype:trojan-activity; sid:100000606; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"153.101.234.167"; classtype:trojan-activity; sid:100000607; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"153.101.47.145"; classtype:trojan-activity; sid:100000608; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"153.3.152.106"; classtype:trojan-activity; sid:100000609; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"153.34.135.92"; classtype:trojan-activity; sid:100000610; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"157.230.219.6"; classtype:trojan-activity; sid:100000611; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"158.101.165.14"; classtype:trojan-activity; sid:100000612; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"158.174.213.128"; classtype:trojan-activity; sid:100000613; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"158.51.125.115"; classtype:trojan-activity; sid:100000614; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"159.224.74.112"; classtype:trojan-activity; sid:100000615; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"162.194.28.60"; classtype:trojan-activity; sid:100000616; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"162.209.98.174"; classtype:trojan-activity; sid:100000617; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"163.53.206.228"; classtype:trojan-activity; sid:100000618; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"165.90.16.5"; classtype:trojan-activity; sid:100000619; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"167.114.172.177"; classtype:trojan-activity; sid:100000620; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"168.205.223.254"; classtype:trojan-activity; sid:100000621; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"170.81.238.178"; classtype:trojan-activity; sid:100000622; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.120.222.98"; classtype:trojan-activity; sid:100000623; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.121.255.12"; classtype:trojan-activity; sid:100000624; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.123.14.190"; classtype:trojan-activity; sid:100000625; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.34.176.217"; classtype:trojan-activity; sid:100000626; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.34.179.178"; classtype:trojan-activity; sid:100000627; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.35.162.156"; classtype:trojan-activity; sid:100000628; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.35.174.198"; classtype:trojan-activity; sid:100000629; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.105.36.168"; classtype:trojan-activity; sid:100000630; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.114.244.127"; classtype:trojan-activity; sid:100000631; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.245.186.107"; classtype:trojan-activity; sid:100000632; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.245.5.185"; classtype:trojan-activity; sid:100000633; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.245.5.190"; classtype:trojan-activity; sid:100000634; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.245.81.19"; classtype:trojan-activity; sid:100000635; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.93.194.114"; classtype:trojan-activity; sid:100000636; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.167.85.89"; classtype:trojan-activity; sid:100000637; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.169.46.85"; classtype:trojan-activity; sid:100000638; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.19.58.108"; classtype:trojan-activity; sid:100000639; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.233.85.171"; classtype:trojan-activity; sid:100000640; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.235.209.70"; classtype:trojan-activity; sid:100000641; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.25.113.8"; classtype:trojan-activity; sid:100000642; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.52.95.134"; classtype:trojan-activity; sid:100000643; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.52.97.25"; classtype:trojan-activity; sid:100000644; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.56.119.108"; classtype:trojan-activity; sid:100000645; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.56.92.166"; classtype:trojan-activity; sid:100000646; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.63.64.213"; classtype:trojan-activity; sid:100000647; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.106.33.85"; classtype:trojan-activity; sid:100000648; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.61.3.149"; classtype:trojan-activity; sid:100000649; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.61.48.94"; classtype:trojan-activity; sid:100000650; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.73.246.193"; classtype:trojan-activity; sid:100000651; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.81.78.7"; classtype:trojan-activity; sid:100000652; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.83.73.163"; classtype:trojan-activity; sid:100000653; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.10.147.167"; classtype:trojan-activity; sid:100000654; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.11.193.66"; classtype:trojan-activity; sid:100000655; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.11.65.112"; classtype:trojan-activity; sid:100000656; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.117.66.74"; classtype:trojan-activity; sid:100000657; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.169.13.182"; classtype:trojan-activity; sid:100000658; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.201.104.192"; classtype:trojan-activity; sid:100000659; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.208.230.8"; classtype:trojan-activity; sid:100000660; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.213.25.192"; classtype:trojan-activity; sid:100000661; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.42.46.118"; classtype:trojan-activity; sid:100000662; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.7.184.32"; classtype:trojan-activity; sid:100000663; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.9.24.110"; classtype:trojan-activity; sid:100000664; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.111.174.35"; classtype:trojan-activity; sid:100000665; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.111.174.63"; classtype:trojan-activity; sid:100000666; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.111.174.66"; classtype:trojan-activity; sid:100000667; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.111.174.67"; classtype:trojan-activity; sid:100000668; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.104"; classtype:trojan-activity; sid:100000669; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.113"; classtype:trojan-activity; sid:100000670; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.60"; classtype:trojan-activity; sid:100000671; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.66"; classtype:trojan-activity; sid:100000672; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.76"; classtype:trojan-activity; sid:100000673; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.84"; classtype:trojan-activity; sid:100000674; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.91"; classtype:trojan-activity; sid:100000675; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.12.117.70"; classtype:trojan-activity; sid:100000676; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.123.7.115"; classtype:trojan-activity; sid:100000677; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.123.7.127"; classtype:trojan-activity; sid:100000678; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.123.9.243"; classtype:trojan-activity; sid:100000679; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.124.7.225"; classtype:trojan-activity; sid:100000680; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.221.188.251"; classtype:trojan-activity; sid:100000681; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.221.251.238"; classtype:trojan-activity; sid:100000682; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.240.84.106"; classtype:trojan-activity; sid:100000683; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"177.11.92.78"; classtype:trojan-activity; sid:100000684; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"177.131.226.235"; classtype:trojan-activity; sid:100000685; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"177.54.82.154"; classtype:trojan-activity; sid:100000686; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.124.182.187"; classtype:trojan-activity; sid:100000687; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.134.185.112"; classtype:trojan-activity; sid:100000688; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.150.174.65"; classtype:trojan-activity; sid:100000689; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.151.143.2"; classtype:trojan-activity; sid:100000690; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.165.122.141"; classtype:trojan-activity; sid:100000691; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.1.179"; classtype:trojan-activity; sid:100000692; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.10.164"; classtype:trojan-activity; sid:100000693; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.10.94"; classtype:trojan-activity; sid:100000694; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.101.51"; classtype:trojan-activity; sid:100000695; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.102.138"; classtype:trojan-activity; sid:100000696; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.102.142"; classtype:trojan-activity; sid:100000697; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.102.162"; classtype:trojan-activity; sid:100000698; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.102.25"; classtype:trojan-activity; sid:100000699; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.103.143"; classtype:trojan-activity; sid:100000700; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.103.173"; classtype:trojan-activity; sid:100000701; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.104.112"; classtype:trojan-activity; sid:100000702; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.104.69"; classtype:trojan-activity; sid:100000703; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.105.213"; classtype:trojan-activity; sid:100000704; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.105.238"; classtype:trojan-activity; sid:100000705; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.105.7"; classtype:trojan-activity; sid:100000706; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.107.0"; classtype:trojan-activity; sid:100000707; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.108.173"; classtype:trojan-activity; sid:100000708; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.108.87"; classtype:trojan-activity; sid:100000709; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.109.118"; classtype:trojan-activity; sid:100000710; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.110.201"; classtype:trojan-activity; sid:100000711; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.111.135"; classtype:trojan-activity; sid:100000712; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.111.171"; classtype:trojan-activity; sid:100000713; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.111.190"; classtype:trojan-activity; sid:100000714; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.111"; classtype:trojan-activity; sid:100000715; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.135"; classtype:trojan-activity; sid:100000716; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.159"; classtype:trojan-activity; sid:100000717; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.198"; classtype:trojan-activity; sid:100000718; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.85"; classtype:trojan-activity; sid:100000719; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.114.151"; classtype:trojan-activity; sid:100000720; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.114.178"; classtype:trojan-activity; sid:100000721; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.114.57"; classtype:trojan-activity; sid:100000722; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.115.166"; classtype:trojan-activity; sid:100000723; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.116.101"; classtype:trojan-activity; sid:100000724; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.116.138"; classtype:trojan-activity; sid:100000725; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.116.242"; classtype:trojan-activity; sid:100000726; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.118.112"; classtype:trojan-activity; sid:100000727; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.118.116"; classtype:trojan-activity; sid:100000728; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.118.244"; classtype:trojan-activity; sid:100000729; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.119.69"; classtype:trojan-activity; sid:100000730; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.12.135"; classtype:trojan-activity; sid:100000731; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.120.154"; classtype:trojan-activity; sid:100000732; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.121.0"; classtype:trojan-activity; sid:100000733; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.121.228"; classtype:trojan-activity; sid:100000734; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.122.28"; classtype:trojan-activity; sid:100000735; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.213"; classtype:trojan-activity; sid:100000736; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.223"; classtype:trojan-activity; sid:100000737; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.232"; classtype:trojan-activity; sid:100000738; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.248"; classtype:trojan-activity; sid:100000739; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.26"; classtype:trojan-activity; sid:100000740; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.91"; classtype:trojan-activity; sid:100000741; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.124.4"; classtype:trojan-activity; sid:100000742; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.125.14"; classtype:trojan-activity; sid:100000743; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.126.129"; classtype:trojan-activity; sid:100000744; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.126.254"; classtype:trojan-activity; sid:100000745; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.126.46"; classtype:trojan-activity; sid:100000746; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.127.202"; classtype:trojan-activity; sid:100000747; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.127.63"; classtype:trojan-activity; sid:100000748; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.14.14"; classtype:trojan-activity; sid:100000749; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.15.199"; classtype:trojan-activity; sid:100000750; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.15.232"; classtype:trojan-activity; sid:100000751; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.15.44"; classtype:trojan-activity; sid:100000752; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.17.194"; classtype:trojan-activity; sid:100000753; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.17.236"; classtype:trojan-activity; sid:100000754; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.18.75"; classtype:trojan-activity; sid:100000755; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.19.163"; classtype:trojan-activity; sid:100000756; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.158"; classtype:trojan-activity; sid:100000757; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.217"; classtype:trojan-activity; sid:100000758; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.225"; classtype:trojan-activity; sid:100000759; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.59"; classtype:trojan-activity; sid:100000760; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.20.126"; classtype:trojan-activity; sid:100000761; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.20.7"; classtype:trojan-activity; sid:100000762; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.20.74"; classtype:trojan-activity; sid:100000763; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.21.149"; classtype:trojan-activity; sid:100000764; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.23.119"; classtype:trojan-activity; sid:100000765; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.24.166"; classtype:trojan-activity; sid:100000766; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.24.232"; classtype:trojan-activity; sid:100000767; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.25.129"; classtype:trojan-activity; sid:100000768; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.25.177"; classtype:trojan-activity; sid:100000769; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.27.32"; classtype:trojan-activity; sid:100000770; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.27.46"; classtype:trojan-activity; sid:100000771; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.29.233"; classtype:trojan-activity; sid:100000772; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.30.133"; classtype:trojan-activity; sid:100000773; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.30.151"; classtype:trojan-activity; sid:100000774; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.32.146"; classtype:trojan-activity; sid:100000775; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.234"; classtype:trojan-activity; sid:100000017; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.237"; classtype:trojan-activity; sid:100000018; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.245"; classtype:trojan-activity; sid:100000019; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.249"; classtype:trojan-activity; sid:100000020; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.25"; classtype:trojan-activity; sid:100000021; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.38"; classtype:trojan-activity; sid:100000022; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.41"; classtype:trojan-activity; sid:100000023; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.43"; classtype:trojan-activity; sid:100000024; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.45"; classtype:trojan-activity; sid:100000025; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.56"; classtype:trojan-activity; sid:100000026; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.63"; classtype:trojan-activity; sid:100000027; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.69"; classtype:trojan-activity; sid:100000028; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.8"; classtype:trojan-activity; sid:100000029; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.80"; classtype:trojan-activity; sid:100000030; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.94"; classtype:trojan-activity; sid:100000031; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.222.98"; classtype:trojan-activity; sid:100000032; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.10"; classtype:trojan-activity; sid:100000033; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.105"; classtype:trojan-activity; sid:100000034; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.109"; classtype:trojan-activity; sid:100000035; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.126"; classtype:trojan-activity; sid:100000036; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.127"; classtype:trojan-activity; sid:100000037; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.130"; classtype:trojan-activity; sid:100000038; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.146"; classtype:trojan-activity; sid:100000039; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.148"; classtype:trojan-activity; sid:100000040; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.15"; classtype:trojan-activity; sid:100000041; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.151"; classtype:trojan-activity; sid:100000042; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.223"; classtype:trojan-activity; sid:100000043; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.4"; classtype:trojan-activity; sid:100000044; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.48"; classtype:trojan-activity; sid:100000045; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.58"; classtype:trojan-activity; sid:100000046; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.59"; classtype:trojan-activity; sid:100000047; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.6"; classtype:trojan-activity; sid:100000048; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.61"; classtype:trojan-activity; sid:100000049; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.71"; classtype:trojan-activity; sid:100000050; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.83"; classtype:trojan-activity; sid:100000051; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.246.223.94"; classtype:trojan-activity; sid:100000052; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.247.221.141"; classtype:trojan-activity; sid:100000053; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.247.221.142"; classtype:trojan-activity; sid:100000054; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.250.159.41"; classtype:trojan-activity; sid:100000055; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.65.166.225"; classtype:trojan-activity; sid:100000056; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.82.104.89"; classtype:trojan-activity; sid:100000057; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"100.12.184.63"; classtype:trojan-activity; sid:100000058; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"100.12.51.122"; classtype:trojan-activity; sid:100000059; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"100.8.77.4"; classtype:trojan-activity; sid:100000060; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1008691.com"; classtype:trojan-activity; sid:100000061; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.108.130.121"; classtype:trojan-activity; sid:100000062; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.16.183.179"; classtype:trojan-activity; sid:100000063; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.229.85.127"; classtype:trojan-activity; sid:100000064; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.255.36.154"; classtype:trojan-activity; sid:100000065; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.28.105.132"; classtype:trojan-activity; sid:100000066; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.28.218.245"; classtype:trojan-activity; sid:100000067; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.28.76.34"; classtype:trojan-activity; sid:100000068; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.66.81.70"; classtype:trojan-activity; sid:100000069; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.75.157.99"; classtype:trojan-activity; sid:100000070; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.130.115.14"; classtype:trojan-activity; sid:100000071; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.141.240.139"; classtype:trojan-activity; sid:100000072; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.113.99.79"; classtype:trojan-activity; sid:100000073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.125.218.107"; classtype:trojan-activity; sid:100000074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.16.145.25"; classtype:trojan-activity; sid:100000075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.204.168.34"; classtype:trojan-activity; sid:100000076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.217.215.21"; classtype:trojan-activity; sid:100000077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.219.152.228"; classtype:trojan-activity; sid:100000078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.224.200.146"; classtype:trojan-activity; sid:100000079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.224.200.40"; classtype:trojan-activity; sid:100000080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.237.21.36"; classtype:trojan-activity; sid:100000081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.238.228.3"; classtype:trojan-activity; sid:100000082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.240.249.121"; classtype:trojan-activity; sid:100000083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.4.117.26"; classtype:trojan-activity; sid:100000084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.79.112.254"; classtype:trojan-activity; sid:100000085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.82.98.170"; classtype:trojan-activity; sid:100000086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.84.240.228"; classtype:trojan-activity; sid:100000087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.84.241.94"; classtype:trojan-activity; sid:100000088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.12"; classtype:trojan-activity; sid:100000089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.14"; classtype:trojan-activity; sid:100000090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.16"; classtype:trojan-activity; sid:100000091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.46"; classtype:trojan-activity; sid:100000092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.91.245.47"; classtype:trojan-activity; sid:100000093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.92.25.90"; classtype:trojan-activity; sid:100000094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.92.25.95"; classtype:trojan-activity; sid:100000095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.97.184.180"; classtype:trojan-activity; sid:100000096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.168.98.159"; classtype:trojan-activity; sid:100000097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.184.75.123"; classtype:trojan-activity; sid:100000098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.206.93.94"; classtype:trojan-activity; sid:100000099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.33.52.85"; classtype:trojan-activity; sid:100000100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.61.86.37"; classtype:trojan-activity; sid:100000101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"104.7.141.172"; classtype:trojan-activity; sid:100000102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"106.1.111.91"; classtype:trojan-activity; sid:100000103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"106.104.172.178"; classtype:trojan-activity; sid:100000104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"106.104.193.155"; classtype:trojan-activity; sid:100000105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"106.105.33.43"; classtype:trojan-activity; sid:100000106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.172.104.105"; classtype:trojan-activity; sid:100000107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.172.193.132"; classtype:trojan-activity; sid:100000108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.172.249.148"; classtype:trojan-activity; sid:100000109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.173.219.80"; classtype:trojan-activity; sid:100000110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.173.23.240"; classtype:trojan-activity; sid:100000111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.174.250.107"; classtype:trojan-activity; sid:100000112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.174.61.139"; classtype:trojan-activity; sid:100000113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.175.197.135"; classtype:trojan-activity; sid:100000114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.175.31.130"; classtype:trojan-activity; sid:100000115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.175.33.48"; classtype:trojan-activity; sid:100000116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.181.136.96"; classtype:trojan-activity; sid:100000117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.194.242.170"; classtype:trojan-activity; sid:100000118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.219.185.75"; classtype:trojan-activity; sid:100000119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.220.119.25"; classtype:trojan-activity; sid:100000120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"107.221.96.202"; classtype:trojan-activity; sid:100000121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"108.190.201.37"; classtype:trojan-activity; sid:100000122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"108.190.250.48"; classtype:trojan-activity; sid:100000123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"108.249.194.121"; classtype:trojan-activity; sid:100000124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.124.90.229"; classtype:trojan-activity; sid:100000125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.233.196.232"; classtype:trojan-activity; sid:100000126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.235.7.228"; classtype:trojan-activity; sid:100000127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.248.58.238"; classtype:trojan-activity; sid:100000128; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.86.85.253"; classtype:trojan-activity; sid:100000129; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.95.200.102"; classtype:trojan-activity; sid:100000130; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.95.200.230"; classtype:trojan-activity; sid:100000131; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.96.127.90"; classtype:trojan-activity; sid:100000132; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.96.57.246"; classtype:trojan-activity; sid:100000133; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"109.99.37.97"; classtype:trojan-activity; sid:100000134; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.14.58.190"; classtype:trojan-activity; sid:100000135; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.228.195.46"; classtype:trojan-activity; sid:100000136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.248.124.254"; classtype:trojan-activity; sid:100000137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.248.175.141"; classtype:trojan-activity; sid:100000138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.248.251.194"; classtype:trojan-activity; sid:100000139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.251.10.18"; classtype:trojan-activity; sid:100000140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.253.213.198"; classtype:trojan-activity; sid:100000141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.255.101.184"; classtype:trojan-activity; sid:100000142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.145.127"; classtype:trojan-activity; sid:100000143; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.208.21"; classtype:trojan-activity; sid:100000144; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.221.77"; classtype:trojan-activity; sid:100000145; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.223.92"; classtype:trojan-activity; sid:100000146; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.233.147"; classtype:trojan-activity; sid:100000147; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.235.57"; classtype:trojan-activity; sid:100000148; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.35.4.2"; classtype:trojan-activity; sid:100000149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.89.10.147"; classtype:trojan-activity; sid:100000150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"110.89.222.213"; classtype:trojan-activity; sid:100000151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.118.41.173"; classtype:trojan-activity; sid:100000152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.118.88.128"; classtype:trojan-activity; sid:100000153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.118.88.61"; classtype:trojan-activity; sid:100000154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.119.245.114"; classtype:trojan-activity; sid:100000155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.125.67.125"; classtype:trojan-activity; sid:100000156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.163.50.120"; classtype:trojan-activity; sid:100000157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.170.86.31"; classtype:trojan-activity; sid:100000158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.172.57.20"; classtype:trojan-activity; sid:100000159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.171.111"; classtype:trojan-activity; sid:100000160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.177.85"; classtype:trojan-activity; sid:100000161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.23.84"; classtype:trojan-activity; sid:100000162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.230.136"; classtype:trojan-activity; sid:100000163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.27.9"; classtype:trojan-activity; sid:100000164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.185.49.223"; classtype:trojan-activity; sid:100000165; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.103.122"; classtype:trojan-activity; sid:100000166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.103.66"; classtype:trojan-activity; sid:100000167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.104.141"; classtype:trojan-activity; sid:100000168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.106.19"; classtype:trojan-activity; sid:100000169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.121.222"; classtype:trojan-activity; sid:100000170; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.121.223"; classtype:trojan-activity; sid:100000171; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.121.226"; classtype:trojan-activity; sid:100000172; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.121.228"; classtype:trojan-activity; sid:100000173; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.26.243"; classtype:trojan-activity; sid:100000174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"111.38.8.81"; classtype:trojan-activity; sid:100000175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.111.108.184"; classtype:trojan-activity; sid:100000176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.133.222.151"; classtype:trojan-activity; sid:100000177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.170.124.75"; classtype:trojan-activity; sid:100000178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.170.233.9"; classtype:trojan-activity; sid:100000179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.186.210.211"; classtype:trojan-activity; sid:100000180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.186.96.252"; classtype:trojan-activity; sid:100000181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.187.91.117"; classtype:trojan-activity; sid:100000182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.214.127.42"; classtype:trojan-activity; sid:100000183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.225.187.19"; classtype:trojan-activity; sid:100000184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.225.236.77"; classtype:trojan-activity; sid:100000185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.225.239.126"; classtype:trojan-activity; sid:100000186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.225.43.27"; classtype:trojan-activity; sid:100000187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.226.162.148"; classtype:trojan-activity; sid:100000188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.226.67.193"; classtype:trojan-activity; sid:100000189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.228.180.95"; classtype:trojan-activity; sid:100000190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.229.178.109"; classtype:trojan-activity; sid:100000191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.230.168.103"; classtype:trojan-activity; sid:100000192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.234.218.202"; classtype:trojan-activity; sid:100000193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.235.188.86"; classtype:trojan-activity; sid:100000194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.236.171.69"; classtype:trojan-activity; sid:100000195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.141.241"; classtype:trojan-activity; sid:100000196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.144.226"; classtype:trojan-activity; sid:100000197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.75.157"; classtype:trojan-activity; sid:100000198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.237.99.207"; classtype:trojan-activity; sid:100000199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.238.143.135"; classtype:trojan-activity; sid:100000200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.238.190.207"; classtype:trojan-activity; sid:100000201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.238.227.228"; classtype:trojan-activity; sid:100000202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.238.39.2"; classtype:trojan-activity; sid:100000203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.240.216.17"; classtype:trojan-activity; sid:100000204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.245.12.89"; classtype:trojan-activity; sid:100000205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.245.8.24"; classtype:trojan-activity; sid:100000206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.246.126.58"; classtype:trojan-activity; sid:100000207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.246.162.50"; classtype:trojan-activity; sid:100000208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.246.180.49"; classtype:trojan-activity; sid:100000209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.100.14"; classtype:trojan-activity; sid:100000210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.16.222"; classtype:trojan-activity; sid:100000211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.191.118"; classtype:trojan-activity; sid:100000212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.214.146"; classtype:trojan-activity; sid:100000213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.240.226"; classtype:trojan-activity; sid:100000214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.247.82.122"; classtype:trojan-activity; sid:100000215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.248.148.90"; classtype:trojan-activity; sid:100000216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.248.197.164"; classtype:trojan-activity; sid:100000217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.249.109.217"; classtype:trojan-activity; sid:100000218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.249.118.157"; classtype:trojan-activity; sid:100000219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.250.102.173"; classtype:trojan-activity; sid:100000220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.251.218.210"; classtype:trojan-activity; sid:100000221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.252.196.17"; classtype:trojan-activity; sid:100000222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.252.221.244"; classtype:trojan-activity; sid:100000223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.254.208.123"; classtype:trojan-activity; sid:100000224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.255.6.129"; classtype:trojan-activity; sid:100000225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.255.8.235"; classtype:trojan-activity; sid:100000226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.26.212.80"; classtype:trojan-activity; sid:100000227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.111"; classtype:trojan-activity; sid:100000228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.117"; classtype:trojan-activity; sid:100000229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.131"; classtype:trojan-activity; sid:100000230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.132"; classtype:trojan-activity; sid:100000231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.133"; classtype:trojan-activity; sid:100000232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.138"; classtype:trojan-activity; sid:100000233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.139"; classtype:trojan-activity; sid:100000234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.143"; classtype:trojan-activity; sid:100000235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.146"; classtype:trojan-activity; sid:100000236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.147"; classtype:trojan-activity; sid:100000237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.149"; classtype:trojan-activity; sid:100000238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.151"; classtype:trojan-activity; sid:100000239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.158"; classtype:trojan-activity; sid:100000240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.162"; classtype:trojan-activity; sid:100000241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.165"; classtype:trojan-activity; sid:100000242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.175"; classtype:trojan-activity; sid:100000243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.177"; classtype:trojan-activity; sid:100000244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.179"; classtype:trojan-activity; sid:100000245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.124.180"; classtype:trojan-activity; sid:100000246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.127.155"; classtype:trojan-activity; sid:100000247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.80.120"; classtype:trojan-activity; sid:100000248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.82.29"; classtype:trojan-activity; sid:100000249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.83.23"; classtype:trojan-activity; sid:100000250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.85.113"; classtype:trojan-activity; sid:100000251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.87.130"; classtype:trojan-activity; sid:100000252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.88.116"; classtype:trojan-activity; sid:100000253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.27.91.212"; classtype:trojan-activity; sid:100000254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.158"; classtype:trojan-activity; sid:100000255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.159"; classtype:trojan-activity; sid:100000256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.168"; classtype:trojan-activity; sid:100000257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.177"; classtype:trojan-activity; sid:100000258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.188"; classtype:trojan-activity; sid:100000259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.200"; classtype:trojan-activity; sid:100000260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.219"; classtype:trojan-activity; sid:100000261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.229"; classtype:trojan-activity; sid:100000262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.230"; classtype:trojan-activity; sid:100000263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.245"; classtype:trojan-activity; sid:100000264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.247"; classtype:trojan-activity; sid:100000265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.90"; classtype:trojan-activity; sid:100000266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.1.91"; classtype:trojan-activity; sid:100000267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.33"; classtype:trojan-activity; sid:100000268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.38"; classtype:trojan-activity; sid:100000269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.43"; classtype:trojan-activity; sid:100000270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.48"; classtype:trojan-activity; sid:100000271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.110.62"; classtype:trojan-activity; sid:100000272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.38.19"; classtype:trojan-activity; sid:100000273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.103"; classtype:trojan-activity; sid:100000274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.124"; classtype:trojan-activity; sid:100000275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.136"; classtype:trojan-activity; sid:100000276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.57"; classtype:trojan-activity; sid:100000277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.4.68"; classtype:trojan-activity; sid:100000278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.30.97.184"; classtype:trojan-activity; sid:100000279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.0.113"; classtype:trojan-activity; sid:100000280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.176.16"; classtype:trojan-activity; sid:100000281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.177.39"; classtype:trojan-activity; sid:100000282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.240.239"; classtype:trojan-activity; sid:100000283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.31.87.98"; classtype:trojan-activity; sid:100000284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.53.224.79"; classtype:trojan-activity; sid:100000285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.53.227.66"; classtype:trojan-activity; sid:100000286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.65.53.175"; classtype:trojan-activity; sid:100000287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.153.37"; classtype:trojan-activity; sid:100000288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.162.159"; classtype:trojan-activity; sid:100000289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.162.49"; classtype:trojan-activity; sid:100000290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.175.147"; classtype:trojan-activity; sid:100000291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.176.112"; classtype:trojan-activity; sid:100000292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.176.84"; classtype:trojan-activity; sid:100000293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.226.202"; classtype:trojan-activity; sid:100000294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.72.231.35"; classtype:trojan-activity; sid:100000295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.78.45.158"; classtype:trojan-activity; sid:100000296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.80.127.91"; classtype:trojan-activity; sid:100000297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.80.215.101"; classtype:trojan-activity; sid:100000298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.82.146.253"; classtype:trojan-activity; sid:100000299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.82.18.255"; classtype:trojan-activity; sid:100000300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.82.224.139"; classtype:trojan-activity; sid:100000301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"112.93.29.211"; classtype:trojan-activity; sid:100000302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.11.95.254"; classtype:trojan-activity; sid:100000303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.122.238.68"; classtype:trojan-activity; sid:100000304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.161.58.249"; classtype:trojan-activity; sid:100000305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.161.78.185"; classtype:trojan-activity; sid:100000306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.227.194.172"; classtype:trojan-activity; sid:100000307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.227.35.229"; classtype:trojan-activity; sid:100000308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.231.211.131"; classtype:trojan-activity; sid:100000309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.254.169.251"; classtype:trojan-activity; sid:100000310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.128.133"; classtype:trojan-activity; sid:100000311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.133.16"; classtype:trojan-activity; sid:100000312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.136.39"; classtype:trojan-activity; sid:100000313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.144.42"; classtype:trojan-activity; sid:100000314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.59.191.47"; classtype:trojan-activity; sid:100000315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.61.204.205"; classtype:trojan-activity; sid:100000316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.87.32.93"; classtype:trojan-activity; sid:100000317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"113.89.43.185"; classtype:trojan-activity; sid:100000318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.111.242.3"; classtype:trojan-activity; sid:100000319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.224.203.128"; classtype:trojan-activity; sid:100000320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.229.165.194"; classtype:trojan-activity; sid:100000321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.30.54.64"; classtype:trojan-activity; sid:100000322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"114.79.172.42"; classtype:trojan-activity; sid:100000323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.165.216.112"; classtype:trojan-activity; sid:100000324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.201.38.185"; classtype:trojan-activity; sid:100000325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.42.47.36"; classtype:trojan-activity; sid:100000326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.50.227.209"; classtype:trojan-activity; sid:100000327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.53.254.187"; classtype:trojan-activity; sid:100000328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.55.158.93"; classtype:trojan-activity; sid:100000329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.56.131.242"; classtype:trojan-activity; sid:100000330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.56.133.96"; classtype:trojan-activity; sid:100000331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.56.152.194"; classtype:trojan-activity; sid:100000332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.58.132.140"; classtype:trojan-activity; sid:100000333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.59.233.160"; classtype:trojan-activity; sid:100000334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.73.3.11"; classtype:trojan-activity; sid:100000335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.92.174.231"; classtype:trojan-activity; sid:100000336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"115.97.142.58"; classtype:trojan-activity; sid:100000337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.124.219.2"; classtype:trojan-activity; sid:100000338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.132.151.60"; classtype:trojan-activity; sid:100000339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.206.164.46"; classtype:trojan-activity; sid:100000340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.211.100.26"; classtype:trojan-activity; sid:100000341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"116.75.197.220"; classtype:trojan-activity; sid:100000342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.204.138"; classtype:trojan-activity; sid:100000343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.204.5"; classtype:trojan-activity; sid:100000344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.220.126"; classtype:trojan-activity; sid:100000345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.20.243.40"; classtype:trojan-activity; sid:100000346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.200.76.54"; classtype:trojan-activity; sid:100000347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.251.59.16"; classtype:trojan-activity; sid:100000348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.26.104.74"; classtype:trojan-activity; sid:100000349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.63.113.146"; classtype:trojan-activity; sid:100000350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.63.195.140"; classtype:trojan-activity; sid:100000351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.63.53.15"; classtype:trojan-activity; sid:100000352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"117.86.105.110"; classtype:trojan-activity; sid:100000353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.176.104.35"; classtype:trojan-activity; sid:100000354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.176.157.64"; classtype:trojan-activity; sid:100000355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.176.7.132"; classtype:trojan-activity; sid:100000356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.223.32.74"; classtype:trojan-activity; sid:100000357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.223.5.149"; classtype:trojan-activity; sid:100000358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.223.72.141"; classtype:trojan-activity; sid:100000359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.12.130"; classtype:trojan-activity; sid:100000360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.128.147"; classtype:trojan-activity; sid:100000361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.208.215"; classtype:trojan-activity; sid:100000362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.209.108"; classtype:trojan-activity; sid:100000363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.214.72"; classtype:trojan-activity; sid:100000364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.88.146"; classtype:trojan-activity; sid:100000365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.96.150"; classtype:trojan-activity; sid:100000366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.232.96.6"; classtype:trojan-activity; sid:100000367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.233.221.162"; classtype:trojan-activity; sid:100000368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.233.63.194"; classtype:trojan-activity; sid:100000369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.233.65.93"; classtype:trojan-activity; sid:100000370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.42.125.246"; classtype:trojan-activity; sid:100000371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.43.180.33"; classtype:trojan-activity; sid:100000372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.79.50.203"; classtype:trojan-activity; sid:100000373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.79.58.82"; classtype:trojan-activity; sid:100000374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.99.179.164"; classtype:trojan-activity; sid:100000375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.99.183.235"; classtype:trojan-activity; sid:100000376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"118.99.239.217"; classtype:trojan-activity; sid:100000377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.102.179.235"; classtype:trojan-activity; sid:100000378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.108.161.25"; classtype:trojan-activity; sid:100000379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.112.185.232"; classtype:trojan-activity; sid:100000380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.123.238.52"; classtype:trojan-activity; sid:100000381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.14.143.145"; classtype:trojan-activity; sid:100000382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.147.213.57"; classtype:trojan-activity; sid:100000383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.164.18.235"; classtype:trojan-activity; sid:100000384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.164.218.229"; classtype:trojan-activity; sid:100000385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.165.107.93"; classtype:trojan-activity; sid:100000386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.165.241.222"; classtype:trojan-activity; sid:100000387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.165.27.77"; classtype:trojan-activity; sid:100000388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.165.68.145"; classtype:trojan-activity; sid:100000389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.166.170.241"; classtype:trojan-activity; sid:100000390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.166.97.6"; classtype:trojan-activity; sid:100000391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.167.26.33"; classtype:trojan-activity; sid:100000392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.177.147.38"; classtype:trojan-activity; sid:100000393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.178.248.123"; classtype:trojan-activity; sid:100000394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.179.43.1"; classtype:trojan-activity; sid:100000395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.18.38.144"; classtype:trojan-activity; sid:100000396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.180.106.217"; classtype:trojan-activity; sid:100000397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.180.33.161"; classtype:trojan-activity; sid:100000398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.181.119.21"; classtype:trojan-activity; sid:100000399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.181.124.203"; classtype:trojan-activity; sid:100000400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.182.97.232"; classtype:trojan-activity; sid:100000401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.183.115.103"; classtype:trojan-activity; sid:100000402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.184.172.199"; classtype:trojan-activity; sid:100000403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.187.195.161"; classtype:trojan-activity; sid:100000404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.187.245.61"; classtype:trojan-activity; sid:100000405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.189.137.195"; classtype:trojan-activity; sid:100000406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.189.227.244"; classtype:trojan-activity; sid:100000407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.150.85"; classtype:trojan-activity; sid:100000408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.187.206"; classtype:trojan-activity; sid:100000409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.215.221"; classtype:trojan-activity; sid:100000410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.240.20"; classtype:trojan-activity; sid:100000411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.191.255.236"; classtype:trojan-activity; sid:100000412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.204.30.144"; classtype:trojan-activity; sid:100000413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.250.129.231"; classtype:trojan-activity; sid:100000414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.251.105.221"; classtype:trojan-activity; sid:100000415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.131.155"; classtype:trojan-activity; sid:100000416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.143.46"; classtype:trojan-activity; sid:100000417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.143.71"; classtype:trojan-activity; sid:100000418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.144.75"; classtype:trojan-activity; sid:100000419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.148.115"; classtype:trojan-activity; sid:100000420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.155.57"; classtype:trojan-activity; sid:100000421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.195.90"; classtype:trojan-activity; sid:100000422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.206.43"; classtype:trojan-activity; sid:100000423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"119.56.220.170"; classtype:trojan-activity; sid:100000424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.132.113.2"; classtype:trojan-activity; sid:100000425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.15.69.83"; classtype:trojan-activity; sid:100000426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.178.187.6"; classtype:trojan-activity; sid:100000427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.178.187.7"; classtype:trojan-activity; sid:100000428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.178.187.8"; classtype:trojan-activity; sid:100000429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.178.187.9"; classtype:trojan-activity; sid:100000430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.207.39.227"; classtype:trojan-activity; sid:100000431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"12.25.204.189"; classtype:trojan-activity; sid:100000432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.0.255.173"; classtype:trojan-activity; sid:100000433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.142.222.22"; classtype:trojan-activity; sid:100000434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.150.213.110"; classtype:trojan-activity; sid:100000435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.151.248.134"; classtype:trojan-activity; sid:100000436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.180"; classtype:trojan-activity; sid:100000437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.183"; classtype:trojan-activity; sid:100000438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.185"; classtype:trojan-activity; sid:100000439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.186"; classtype:trojan-activity; sid:100000440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.193"; classtype:trojan-activity; sid:100000441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.201"; classtype:trojan-activity; sid:100000442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.202"; classtype:trojan-activity; sid:100000443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.204"; classtype:trojan-activity; sid:100000444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.208"; classtype:trojan-activity; sid:100000445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.212"; classtype:trojan-activity; sid:100000446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.193.91.233"; classtype:trojan-activity; sid:100000447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.126.235"; classtype:trojan-activity; sid:100000448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.126.239"; classtype:trojan-activity; sid:100000449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.126.250"; classtype:trojan-activity; sid:100000450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.126.60"; classtype:trojan-activity; sid:100000451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.127.187"; classtype:trojan-activity; sid:100000452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.209.99.127"; classtype:trojan-activity; sid:100000453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.50.66.60"; classtype:trojan-activity; sid:100000454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.50.93.115"; classtype:trojan-activity; sid:100000455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.6.8.11"; classtype:trojan-activity; sid:100000456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"120.7.75.99"; classtype:trojan-activity; sid:100000457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.100.114.164"; classtype:trojan-activity; sid:100000458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.100.96.8"; classtype:trojan-activity; sid:100000459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.121.44.222"; classtype:trojan-activity; sid:100000460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.123.53.25"; classtype:trojan-activity; sid:100000461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.127.155.220"; classtype:trojan-activity; sid:100000462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.141.11.56"; classtype:trojan-activity; sid:100000463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.15.142.137"; classtype:trojan-activity; sid:100000464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.159.22.144"; classtype:trojan-activity; sid:100000465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.170.234.142"; classtype:trojan-activity; sid:100000466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.170.8.146"; classtype:trojan-activity; sid:100000467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.185.31.2"; classtype:trojan-activity; sid:100000468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.190.36.8"; classtype:trojan-activity; sid:100000469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.20.104.26"; classtype:trojan-activity; sid:100000470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.225.11.163"; classtype:trojan-activity; sid:100000471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.237.226.202"; classtype:trojan-activity; sid:100000472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.24.116.173"; classtype:trojan-activity; sid:100000473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.25.54.241"; classtype:trojan-activity; sid:100000474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.254.76.17"; classtype:trojan-activity; sid:100000475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"121.88.99.236"; classtype:trojan-activity; sid:100000476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.100.150.204"; classtype:trojan-activity; sid:100000477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.160.147.53"; classtype:trojan-activity; sid:100000478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.188.86.225"; classtype:trojan-activity; sid:100000479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.199.66.28"; classtype:trojan-activity; sid:100000480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.199.72.23"; classtype:trojan-activity; sid:100000481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.199.79.27"; classtype:trojan-activity; sid:100000482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.202.37.85"; classtype:trojan-activity; sid:100000483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"122.254.33.214"; classtype:trojan-activity; sid:100000484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.0.240.58"; classtype:trojan-activity; sid:100000485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.10.15.35"; classtype:trojan-activity; sid:100000486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.124.244"; classtype:trojan-activity; sid:100000487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.170.237"; classtype:trojan-activity; sid:100000488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.182.187"; classtype:trojan-activity; sid:100000489; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.19.248"; classtype:trojan-activity; sid:100000490; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.200.98"; classtype:trojan-activity; sid:100000491; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.110.238.188"; classtype:trojan-activity; sid:100000492; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.129.2.28"; classtype:trojan-activity; sid:100000493; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.129.84.36"; classtype:trojan-activity; sid:100000494; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.130.208.52"; classtype:trojan-activity; sid:100000495; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.130.27.19"; classtype:trojan-activity; sid:100000496; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.130.37.182"; classtype:trojan-activity; sid:100000497; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.131.186.250"; classtype:trojan-activity; sid:100000498; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.132.219.147"; classtype:trojan-activity; sid:100000499; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.133.98.135"; classtype:trojan-activity; sid:100000500; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.134.14.130"; classtype:trojan-activity; sid:100000501; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.154.236.114"; classtype:trojan-activity; sid:100000502; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.159.8.100"; classtype:trojan-activity; sid:100000503; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.183.16.71"; classtype:trojan-activity; sid:100000504; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.191.164.92"; classtype:trojan-activity; sid:100000505; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.192.101.163"; classtype:trojan-activity; sid:100000506; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.193.53.237"; classtype:trojan-activity; sid:100000507; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.194.235.37"; classtype:trojan-activity; sid:100000508; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.194.35.146"; classtype:trojan-activity; sid:100000509; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.194.52.79"; classtype:trojan-activity; sid:100000510; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.194.60.238"; classtype:trojan-activity; sid:100000511; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.195.112.240"; classtype:trojan-activity; sid:100000512; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.195.184.191"; classtype:trojan-activity; sid:100000513; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.195.98.141"; classtype:trojan-activity; sid:100000514; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.212.29.154"; classtype:trojan-activity; sid:100000515; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.213.225.130"; classtype:trojan-activity; sid:100000516; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.233.130.162"; classtype:trojan-activity; sid:100000517; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.233.152.249"; classtype:trojan-activity; sid:100000518; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.234.116.110"; classtype:trojan-activity; sid:100000519; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.234.184.57"; classtype:trojan-activity; sid:100000520; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.240.103.89"; classtype:trojan-activity; sid:100000521; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.240.181.57"; classtype:trojan-activity; sid:100000522; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.240.79.61"; classtype:trojan-activity; sid:100000523; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.241.11.41"; classtype:trojan-activity; sid:100000524; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.241.148.58"; classtype:trojan-activity; sid:100000525; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.241.184.124"; classtype:trojan-activity; sid:100000526; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.28.217.23"; classtype:trojan-activity; sid:100000527; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.5.5.242"; classtype:trojan-activity; sid:100000528; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"123.9.193.157"; classtype:trojan-activity; sid:100000529; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.129.221.150"; classtype:trojan-activity; sid:100000530; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.129.76.230"; classtype:trojan-activity; sid:100000531; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.129.78.176"; classtype:trojan-activity; sid:100000532; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.130.40.31"; classtype:trojan-activity; sid:100000533; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.104.82"; classtype:trojan-activity; sid:100000534; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.151.135"; classtype:trojan-activity; sid:100000535; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.24.185"; classtype:trojan-activity; sid:100000536; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.26.243"; classtype:trojan-activity; sid:100000537; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.131.54.33"; classtype:trojan-activity; sid:100000538; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.132.110.150"; classtype:trojan-activity; sid:100000539; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.135.34.49"; classtype:trojan-activity; sid:100000540; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.152.26.45"; classtype:trojan-activity; sid:100000541; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.153.136.175"; classtype:trojan-activity; sid:100000542; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.153.236.6"; classtype:trojan-activity; sid:100000543; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.160.126.238"; classtype:trojan-activity; sid:100000544; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.163.65.64"; classtype:trojan-activity; sid:100000545; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.165.123.7"; classtype:trojan-activity; sid:100000546; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.187.111.160"; classtype:trojan-activity; sid:100000547; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.199.56.198"; classtype:trojan-activity; sid:100000548; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.230.174.233"; classtype:trojan-activity; sid:100000549; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.254.251.54"; classtype:trojan-activity; sid:100000550; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.5.112.43"; classtype:trojan-activity; sid:100000551; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.5.92.20"; classtype:trojan-activity; sid:100000552; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.6.0.4"; classtype:trojan-activity; sid:100000553; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.67.89.28"; classtype:trojan-activity; sid:100000554; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.7.254.85"; classtype:trojan-activity; sid:100000555; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.80.46.73"; classtype:trojan-activity; sid:100000556; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"124.93.94.207"; classtype:trojan-activity; sid:100000557; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.105.217.252"; classtype:trojan-activity; sid:100000558; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.128.28.161"; classtype:trojan-activity; sid:100000559; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.142.93.34"; classtype:trojan-activity; sid:100000560; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.191.113.212"; classtype:trojan-activity; sid:100000561; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.40.1.235"; classtype:trojan-activity; sid:100000562; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.40.73.68"; classtype:trojan-activity; sid:100000563; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.43.23.193"; classtype:trojan-activity; sid:100000564; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.46.142.96"; classtype:trojan-activity; sid:100000565; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"125.46.255.38"; classtype:trojan-activity; sid:100000566; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"128.116.133.92"; classtype:trojan-activity; sid:100000567; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"130.255.159.133"; classtype:trojan-activity; sid:100000568; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"134.195.139.4"; classtype:trojan-activity; sid:100000569; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"134.236.252.28"; classtype:trojan-activity; sid:100000570; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"135.148.36.127"; classtype:trojan-activity; sid:100000571; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"138.99.204.224"; classtype:trojan-activity; sid:100000572; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"139.159.226.180"; classtype:trojan-activity; sid:100000573; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"139.170.173.198"; classtype:trojan-activity; sid:100000574; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"139.216.102.151"; classtype:trojan-activity; sid:100000575; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.102.17.222"; classtype:trojan-activity; sid:100000576; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.136.80.242"; classtype:trojan-activity; sid:100000577; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.138.8.51"; classtype:trojan-activity; sid:100000578; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.160.34.50"; classtype:trojan-activity; sid:100000579; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.189.247.118"; classtype:trojan-activity; sid:100000580; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.232.33.212"; classtype:trojan-activity; sid:100000581; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.37.222.190"; classtype:trojan-activity; sid:100000582; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.42.237.237"; classtype:trojan-activity; sid:100000583; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.45.127.110"; classtype:trojan-activity; sid:100000584; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.46.25.17"; classtype:trojan-activity; sid:100000585; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.46.98.241"; classtype:trojan-activity; sid:100000586; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.50.129.248"; classtype:trojan-activity; sid:100000587; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14.55.29.2"; classtype:trojan-activity; sid:100000588; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"142.11.216.5"; classtype:trojan-activity; sid:100000589; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"142.177.56.127"; classtype:trojan-activity; sid:100000590; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"143.198.120.58"; classtype:trojan-activity; sid:100000591; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"146.71.79.230"; classtype:trojan-activity; sid:100000592; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"148.69.108.177"; classtype:trojan-activity; sid:100000593; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"149.255.15.134"; classtype:trojan-activity; sid:100000594; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"149.255.15.184"; classtype:trojan-activity; sid:100000595; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"149.255.15.87"; classtype:trojan-activity; sid:100000596; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"149.255.15.99"; classtype:trojan-activity; sid:100000597; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"14karatvisions.com"; classtype:trojan-activity; sid:100000598; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"150.116.207.99"; classtype:trojan-activity; sid:100000599; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"151.177.163.87"; classtype:trojan-activity; sid:100000600; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"151.33.230.191"; classtype:trojan-activity; sid:100000601; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"153.101.234.167"; classtype:trojan-activity; sid:100000602; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"153.101.47.145"; classtype:trojan-activity; sid:100000603; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"153.3.152.106"; classtype:trojan-activity; sid:100000604; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"153.34.135.92"; classtype:trojan-activity; sid:100000605; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"157.230.219.6"; classtype:trojan-activity; sid:100000606; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"158.101.165.14"; classtype:trojan-activity; sid:100000607; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"158.174.213.128"; classtype:trojan-activity; sid:100000608; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"158.51.125.115"; classtype:trojan-activity; sid:100000609; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"159.224.74.112"; classtype:trojan-activity; sid:100000610; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"162.194.28.60"; classtype:trojan-activity; sid:100000611; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"162.209.98.174"; classtype:trojan-activity; sid:100000612; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"163.53.206.228"; classtype:trojan-activity; sid:100000613; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"165.90.16.5"; classtype:trojan-activity; sid:100000614; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"167.114.172.177"; classtype:trojan-activity; sid:100000615; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"170.81.238.178"; classtype:trojan-activity; sid:100000616; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.120.222.98"; classtype:trojan-activity; sid:100000617; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.121.255.12"; classtype:trojan-activity; sid:100000618; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.123.14.190"; classtype:trojan-activity; sid:100000619; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.34.176.217"; classtype:trojan-activity; sid:100000620; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.34.179.178"; classtype:trojan-activity; sid:100000621; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.35.162.156"; classtype:trojan-activity; sid:100000622; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"171.35.174.198"; classtype:trojan-activity; sid:100000623; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.105.36.168"; classtype:trojan-activity; sid:100000624; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.105.68.51"; classtype:trojan-activity; sid:100000625; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.114.244.127"; classtype:trojan-activity; sid:100000626; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.245.186.107"; classtype:trojan-activity; sid:100000627; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.245.5.185"; classtype:trojan-activity; sid:100000628; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.245.5.190"; classtype:trojan-activity; sid:100000629; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.245.81.19"; classtype:trojan-activity; sid:100000630; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.93.176.142"; classtype:trojan-activity; sid:100000631; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"172.93.194.114"; classtype:trojan-activity; sid:100000632; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.167.85.89"; classtype:trojan-activity; sid:100000633; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.169.46.85"; classtype:trojan-activity; sid:100000634; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.19.58.108"; classtype:trojan-activity; sid:100000635; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.233.85.171"; classtype:trojan-activity; sid:100000636; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.235.209.70"; classtype:trojan-activity; sid:100000637; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.25.113.8"; classtype:trojan-activity; sid:100000638; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.52.95.134"; classtype:trojan-activity; sid:100000639; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.52.97.25"; classtype:trojan-activity; sid:100000640; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.56.119.108"; classtype:trojan-activity; sid:100000641; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.56.92.166"; classtype:trojan-activity; sid:100000642; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"173.63.64.213"; classtype:trojan-activity; sid:100000643; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.61.3.149"; classtype:trojan-activity; sid:100000644; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.73.246.193"; classtype:trojan-activity; sid:100000645; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.81.78.7"; classtype:trojan-activity; sid:100000646; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"174.83.73.163"; classtype:trojan-activity; sid:100000647; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.10.147.167"; classtype:trojan-activity; sid:100000648; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.11.65.112"; classtype:trojan-activity; sid:100000649; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.117.66.74"; classtype:trojan-activity; sid:100000650; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.169.13.182"; classtype:trojan-activity; sid:100000651; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.201.104.192"; classtype:trojan-activity; sid:100000652; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.208.230.8"; classtype:trojan-activity; sid:100000653; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.213.25.192"; classtype:trojan-activity; sid:100000654; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.42.46.118"; classtype:trojan-activity; sid:100000655; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.7.184.32"; classtype:trojan-activity; sid:100000656; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"175.9.24.110"; classtype:trojan-activity; sid:100000657; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.111.174.35"; classtype:trojan-activity; sid:100000658; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.111.174.63"; classtype:trojan-activity; sid:100000659; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.111.174.66"; classtype:trojan-activity; sid:100000660; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.111.174.67"; classtype:trojan-activity; sid:100000661; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.104"; classtype:trojan-activity; sid:100000662; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.113"; classtype:trojan-activity; sid:100000663; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.60"; classtype:trojan-activity; sid:100000664; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.66"; classtype:trojan-activity; sid:100000665; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.76"; classtype:trojan-activity; sid:100000666; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.84"; classtype:trojan-activity; sid:100000667; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.161.91"; classtype:trojan-activity; sid:100000668; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.113.174.139"; classtype:trojan-activity; sid:100000669; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.12.117.70"; classtype:trojan-activity; sid:100000670; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.123.7.115"; classtype:trojan-activity; sid:100000671; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.123.7.127"; classtype:trojan-activity; sid:100000672; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.124.7.225"; classtype:trojan-activity; sid:100000673; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"176.240.84.106"; classtype:trojan-activity; sid:100000674; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"177.11.92.78"; classtype:trojan-activity; sid:100000675; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"177.131.226.235"; classtype:trojan-activity; sid:100000676; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"177.54.82.154"; classtype:trojan-activity; sid:100000677; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.124.182.187"; classtype:trojan-activity; sid:100000678; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.150.174.65"; classtype:trojan-activity; sid:100000679; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.151.143.2"; classtype:trojan-activity; sid:100000680; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.165.122.141"; classtype:trojan-activity; sid:100000681; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.17.171.144"; classtype:trojan-activity; sid:100000682; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.0.143"; classtype:trojan-activity; sid:100000683; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.1.179"; classtype:trojan-activity; sid:100000684; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.10.164"; classtype:trojan-activity; sid:100000685; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.10.76"; classtype:trojan-activity; sid:100000686; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.10.94"; classtype:trojan-activity; sid:100000687; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.101.51"; classtype:trojan-activity; sid:100000688; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.102.138"; classtype:trojan-activity; sid:100000689; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.102.142"; classtype:trojan-activity; sid:100000690; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.102.162"; classtype:trojan-activity; sid:100000691; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.102.25"; classtype:trojan-activity; sid:100000692; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.103.173"; classtype:trojan-activity; sid:100000693; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.103.52"; classtype:trojan-activity; sid:100000694; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.104.112"; classtype:trojan-activity; sid:100000695; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.104.67"; classtype:trojan-activity; sid:100000696; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.104.69"; classtype:trojan-activity; sid:100000697; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.105.213"; classtype:trojan-activity; sid:100000698; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.105.238"; classtype:trojan-activity; sid:100000699; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.105.7"; classtype:trojan-activity; sid:100000700; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.107.0"; classtype:trojan-activity; sid:100000701; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.107.71"; classtype:trojan-activity; sid:100000702; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.108.173"; classtype:trojan-activity; sid:100000703; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.108.87"; classtype:trojan-activity; sid:100000704; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.109.118"; classtype:trojan-activity; sid:100000705; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.110.201"; classtype:trojan-activity; sid:100000706; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.111.135"; classtype:trojan-activity; sid:100000707; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.111.171"; classtype:trojan-activity; sid:100000708; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.111.190"; classtype:trojan-activity; sid:100000709; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.135"; classtype:trojan-activity; sid:100000710; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.159"; classtype:trojan-activity; sid:100000711; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.198"; classtype:trojan-activity; sid:100000712; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.112.85"; classtype:trojan-activity; sid:100000713; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.114.146"; classtype:trojan-activity; sid:100000714; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.114.151"; classtype:trojan-activity; sid:100000715; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.114.57"; classtype:trojan-activity; sid:100000716; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.115.166"; classtype:trojan-activity; sid:100000717; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.116.101"; classtype:trojan-activity; sid:100000718; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.116.138"; classtype:trojan-activity; sid:100000719; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.116.20"; classtype:trojan-activity; sid:100000720; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.116.242"; classtype:trojan-activity; sid:100000721; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.118.112"; classtype:trojan-activity; sid:100000722; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.119.69"; classtype:trojan-activity; sid:100000723; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.12.135"; classtype:trojan-activity; sid:100000724; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.120.154"; classtype:trojan-activity; sid:100000725; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.121.228"; classtype:trojan-activity; sid:100000726; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.121.54"; classtype:trojan-activity; sid:100000727; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.122.28"; classtype:trojan-activity; sid:100000728; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.213"; classtype:trojan-activity; sid:100000729; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.232"; classtype:trojan-activity; sid:100000730; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.248"; classtype:trojan-activity; sid:100000731; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.26"; classtype:trojan-activity; sid:100000732; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.123.91"; classtype:trojan-activity; sid:100000733; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.124.4"; classtype:trojan-activity; sid:100000734; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.125.14"; classtype:trojan-activity; sid:100000735; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.125.149"; classtype:trojan-activity; sid:100000736; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.126.129"; classtype:trojan-activity; sid:100000737; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.126.46"; classtype:trojan-activity; sid:100000738; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.127.202"; classtype:trojan-activity; sid:100000739; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.127.223"; classtype:trojan-activity; sid:100000740; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.14.14"; classtype:trojan-activity; sid:100000741; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.14.155"; classtype:trojan-activity; sid:100000742; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.15.199"; classtype:trojan-activity; sid:100000743; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.15.232"; classtype:trojan-activity; sid:100000744; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.15.44"; classtype:trojan-activity; sid:100000745; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.16.26"; classtype:trojan-activity; sid:100000746; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.17.236"; classtype:trojan-activity; sid:100000747; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.19.160"; classtype:trojan-activity; sid:100000748; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.19.163"; classtype:trojan-activity; sid:100000749; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.158"; classtype:trojan-activity; sid:100000750; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.217"; classtype:trojan-activity; sid:100000751; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.225"; classtype:trojan-activity; sid:100000752; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.254"; classtype:trojan-activity; sid:100000753; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.2.59"; classtype:trojan-activity; sid:100000754; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.20.126"; classtype:trojan-activity; sid:100000755; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.20.7"; classtype:trojan-activity; sid:100000756; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.20.74"; classtype:trojan-activity; sid:100000757; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.21.41"; classtype:trojan-activity; sid:100000758; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.22.120"; classtype:trojan-activity; sid:100000759; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.24.166"; classtype:trojan-activity; sid:100000760; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.24.232"; classtype:trojan-activity; sid:100000761; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.25.129"; classtype:trojan-activity; sid:100000762; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.25.177"; classtype:trojan-activity; sid:100000763; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.27.32"; classtype:trojan-activity; sid:100000764; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.27.46"; classtype:trojan-activity; sid:100000765; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.29.233"; classtype:trojan-activity; sid:100000766; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.3.86"; classtype:trojan-activity; sid:100000767; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.30.109"; classtype:trojan-activity; sid:100000768; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.30.133"; classtype:trojan-activity; sid:100000769; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.30.151"; classtype:trojan-activity; sid:100000770; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.31.55"; classtype:trojan-activity; sid:100000771; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.32.146"; classtype:trojan-activity; sid:100000772; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.32.186"; classtype:trojan-activity; sid:100000773; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.33.179"; classtype:trojan-activity; sid:100000774; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.33.32"; classtype:trojan-activity; sid:100000775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.34.230"; classtype:trojan-activity; sid:100000776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.35.170"; classtype:trojan-activity; sid:100000777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.35.193"; classtype:trojan-activity; sid:100000778; rev:1;) @@ -792,119 +792,119 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.38.12"; classtype:trojan-activity; sid:100000786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.4.227"; classtype:trojan-activity; sid:100000787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.4.29"; classtype:trojan-activity; sid:100000788; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.43.121"; classtype:trojan-activity; sid:100000789; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.43.217"; classtype:trojan-activity; sid:100000790; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.43.238"; classtype:trojan-activity; sid:100000791; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.44.186"; classtype:trojan-activity; sid:100000792; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.44.241"; classtype:trojan-activity; sid:100000793; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.40.209"; classtype:trojan-activity; sid:100000789; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.42.46"; classtype:trojan-activity; sid:100000790; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.43.121"; classtype:trojan-activity; sid:100000791; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.43.217"; classtype:trojan-activity; sid:100000792; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.44.186"; classtype:trojan-activity; sid:100000793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.45.125"; classtype:trojan-activity; sid:100000794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.45.26"; classtype:trojan-activity; sid:100000795; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.46.41"; classtype:trojan-activity; sid:100000796; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.46.59"; classtype:trojan-activity; sid:100000797; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.47.15"; classtype:trojan-activity; sid:100000798; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.47.181"; classtype:trojan-activity; sid:100000799; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.47.222"; classtype:trojan-activity; sid:100000800; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.47.80"; classtype:trojan-activity; sid:100000801; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.48.40"; classtype:trojan-activity; sid:100000802; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.46.59"; classtype:trojan-activity; sid:100000796; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.47.220"; classtype:trojan-activity; sid:100000797; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.47.222"; classtype:trojan-activity; sid:100000798; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.47.80"; classtype:trojan-activity; sid:100000799; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.48.140"; classtype:trojan-activity; sid:100000800; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.48.223"; classtype:trojan-activity; sid:100000801; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.48.67"; classtype:trojan-activity; sid:100000802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.5.254"; classtype:trojan-activity; sid:100000803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.5.44"; classtype:trojan-activity; sid:100000804; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.5.74"; classtype:trojan-activity; sid:100000805; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.50.217"; classtype:trojan-activity; sid:100000806; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.50.42"; classtype:trojan-activity; sid:100000807; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.50.217"; classtype:trojan-activity; sid:100000805; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.50.42"; classtype:trojan-activity; sid:100000806; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.50.54"; classtype:trojan-activity; sid:100000807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.53.101"; classtype:trojan-activity; sid:100000808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.54.186"; classtype:trojan-activity; sid:100000809; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.54.234"; classtype:trojan-activity; sid:100000810; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.54.58"; classtype:trojan-activity; sid:100000811; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.55.99"; classtype:trojan-activity; sid:100000812; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.56.11"; classtype:trojan-activity; sid:100000813; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.56.185"; classtype:trojan-activity; sid:100000814; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.56.56"; classtype:trojan-activity; sid:100000815; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.57.134"; classtype:trojan-activity; sid:100000816; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.57.14"; classtype:trojan-activity; sid:100000817; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.57.183"; classtype:trojan-activity; sid:100000818; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.58.230"; classtype:trojan-activity; sid:100000819; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.58.234"; classtype:trojan-activity; sid:100000820; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.58.235"; classtype:trojan-activity; sid:100000821; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.59.106"; classtype:trojan-activity; sid:100000822; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.60.247"; classtype:trojan-activity; sid:100000823; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.61.103"; classtype:trojan-activity; sid:100000824; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.61.210"; classtype:trojan-activity; sid:100000825; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.62.241"; classtype:trojan-activity; sid:100000826; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.62.60"; classtype:trojan-activity; sid:100000827; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.64.156"; classtype:trojan-activity; sid:100000828; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.64.17"; classtype:trojan-activity; sid:100000829; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.64.35"; classtype:trojan-activity; sid:100000830; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.65.208"; classtype:trojan-activity; sid:100000831; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.68.123"; classtype:trojan-activity; sid:100000832; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.68.209"; classtype:trojan-activity; sid:100000833; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.68.44"; classtype:trojan-activity; sid:100000834; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.68.57"; classtype:trojan-activity; sid:100000835; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.7.156"; classtype:trojan-activity; sid:100000836; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.70.218"; classtype:trojan-activity; sid:100000837; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.70.250"; classtype:trojan-activity; sid:100000838; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.70.74"; classtype:trojan-activity; sid:100000839; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.72.148"; classtype:trojan-activity; sid:100000840; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.72.158"; classtype:trojan-activity; sid:100000841; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.72.75"; classtype:trojan-activity; sid:100000842; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.73.238"; classtype:trojan-activity; sid:100000843; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.75.181"; classtype:trojan-activity; sid:100000844; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.75.205"; classtype:trojan-activity; sid:100000845; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.54.58"; classtype:trojan-activity; sid:100000810; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.55.99"; classtype:trojan-activity; sid:100000811; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.56.185"; classtype:trojan-activity; sid:100000812; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.56.56"; classtype:trojan-activity; sid:100000813; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.56.64"; classtype:trojan-activity; sid:100000814; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.57.14"; classtype:trojan-activity; sid:100000815; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.57.183"; classtype:trojan-activity; sid:100000816; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.57.204"; classtype:trojan-activity; sid:100000817; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.58.230"; classtype:trojan-activity; sid:100000818; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.58.234"; classtype:trojan-activity; sid:100000819; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.58.235"; classtype:trojan-activity; sid:100000820; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.59.106"; classtype:trojan-activity; sid:100000821; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.60.247"; classtype:trojan-activity; sid:100000822; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.61.103"; classtype:trojan-activity; sid:100000823; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.62.60"; classtype:trojan-activity; sid:100000824; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.64.156"; classtype:trojan-activity; sid:100000825; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.64.35"; classtype:trojan-activity; sid:100000826; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.65.189"; classtype:trojan-activity; sid:100000827; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.65.208"; classtype:trojan-activity; sid:100000828; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.66.186"; classtype:trojan-activity; sid:100000829; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.68.123"; classtype:trojan-activity; sid:100000830; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.68.44"; classtype:trojan-activity; sid:100000831; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.68.57"; classtype:trojan-activity; sid:100000832; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.69.79"; classtype:trojan-activity; sid:100000833; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.7.156"; classtype:trojan-activity; sid:100000834; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.70.218"; classtype:trojan-activity; sid:100000835; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.70.250"; classtype:trojan-activity; sid:100000836; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.70.74"; classtype:trojan-activity; sid:100000837; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.72.126"; classtype:trojan-activity; sid:100000838; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.72.158"; classtype:trojan-activity; sid:100000839; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.72.75"; classtype:trojan-activity; sid:100000840; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.73.238"; classtype:trojan-activity; sid:100000841; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.75.181"; classtype:trojan-activity; sid:100000842; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.75.205"; classtype:trojan-activity; sid:100000843; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.75.214"; classtype:trojan-activity; sid:100000844; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.77.248"; classtype:trojan-activity; sid:100000845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.77.47"; classtype:trojan-activity; sid:100000846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.78.2"; classtype:trojan-activity; sid:100000847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.78.242"; classtype:trojan-activity; sid:100000848; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.78.243"; classtype:trojan-activity; sid:100000849; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.79.146"; classtype:trojan-activity; sid:100000850; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.79.146"; classtype:trojan-activity; sid:100000849; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.79.198"; classtype:trojan-activity; sid:100000850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.79.66"; classtype:trojan-activity; sid:100000851; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.8.248"; classtype:trojan-activity; sid:100000852; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.8.85"; classtype:trojan-activity; sid:100000853; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.8.85"; classtype:trojan-activity; sid:100000852; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.8.93"; classtype:trojan-activity; sid:100000853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.80.142"; classtype:trojan-activity; sid:100000854; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.81.185"; classtype:trojan-activity; sid:100000855; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.81.192"; classtype:trojan-activity; sid:100000856; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.81.226"; classtype:trojan-activity; sid:100000857; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.83.224"; classtype:trojan-activity; sid:100000858; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.84.195"; classtype:trojan-activity; sid:100000859; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.84.215"; classtype:trojan-activity; sid:100000860; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.86.182"; classtype:trojan-activity; sid:100000861; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.86.47"; classtype:trojan-activity; sid:100000862; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.86.59"; classtype:trojan-activity; sid:100000863; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.87.146"; classtype:trojan-activity; sid:100000864; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.80.167"; classtype:trojan-activity; sid:100000855; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.81.185"; classtype:trojan-activity; sid:100000856; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.81.192"; classtype:trojan-activity; sid:100000857; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.81.226"; classtype:trojan-activity; sid:100000858; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.81.240"; classtype:trojan-activity; sid:100000859; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.84.195"; classtype:trojan-activity; sid:100000860; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.84.215"; classtype:trojan-activity; sid:100000861; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.86.117"; classtype:trojan-activity; sid:100000862; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.86.182"; classtype:trojan-activity; sid:100000863; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.86.59"; classtype:trojan-activity; sid:100000864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.87.16"; classtype:trojan-activity; sid:100000865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.87.207"; classtype:trojan-activity; sid:100000866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.87.42"; classtype:trojan-activity; sid:100000867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.88.102"; classtype:trojan-activity; sid:100000868; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.88.207"; classtype:trojan-activity; sid:100000869; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.88.85"; classtype:trojan-activity; sid:100000869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.89.121"; classtype:trojan-activity; sid:100000870; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.89.45"; classtype:trojan-activity; sid:100000871; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.89.69"; classtype:trojan-activity; sid:100000872; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.91.223"; classtype:trojan-activity; sid:100000873; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.92.144"; classtype:trojan-activity; sid:100000874; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.92.33"; classtype:trojan-activity; sid:100000875; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.89.132"; classtype:trojan-activity; sid:100000871; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.89.45"; classtype:trojan-activity; sid:100000872; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.89.69"; classtype:trojan-activity; sid:100000873; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.91.223"; classtype:trojan-activity; sid:100000874; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.92.144"; classtype:trojan-activity; sid:100000875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.93.113"; classtype:trojan-activity; sid:100000876; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.93.200"; classtype:trojan-activity; sid:100000877; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.93.234"; classtype:trojan-activity; sid:100000878; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.93.98"; classtype:trojan-activity; sid:100000879; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.94.224"; classtype:trojan-activity; sid:100000880; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.93.234"; classtype:trojan-activity; sid:100000877; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.93.98"; classtype:trojan-activity; sid:100000878; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.94.224"; classtype:trojan-activity; sid:100000879; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.94.248"; classtype:trojan-activity; sid:100000880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.94.27"; classtype:trojan-activity; sid:100000881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.94.32"; classtype:trojan-activity; sid:100000882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.94.40"; classtype:trojan-activity; sid:100000883; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.95.60"; classtype:trojan-activity; sid:100000884; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.96.106"; classtype:trojan-activity; sid:100000885; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.95.105"; classtype:trojan-activity; sid:100000884; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.95.188"; classtype:trojan-activity; sid:100000885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.96.125"; classtype:trojan-activity; sid:100000886; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.97.127"; classtype:trojan-activity; sid:100000887; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.97.227"; classtype:trojan-activity; sid:100000888; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.96.93"; classtype:trojan-activity; sid:100000887; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.97.127"; classtype:trojan-activity; sid:100000888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.99.106"; classtype:trojan-activity; sid:100000889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.99.209"; classtype:trojan-activity; sid:100000890; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.19.183.14"; classtype:trojan-activity; sid:100000891; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.205.101.33"; classtype:trojan-activity; sid:100000892; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.21.164.68"; classtype:trojan-activity; sid:100000893; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.217.8.194"; classtype:trojan-activity; sid:100000894; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.22.117.102"; classtype:trojan-activity; sid:100000895; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.222.252.130"; classtype:trojan-activity; sid:100000896; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.34.183.30"; classtype:trojan-activity; sid:100000897; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.48.235.59"; classtype:trojan-activity; sid:100000898; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.95.136.35"; classtype:trojan-activity; sid:100000899; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"179.159.58.134"; classtype:trojan-activity; sid:100000900; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"179.4.187.39"; classtype:trojan-activity; sid:100000901; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.175.99.21"; classtype:trojan-activity; sid:100000891; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.19.183.14"; classtype:trojan-activity; sid:100000892; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.205.101.33"; classtype:trojan-activity; sid:100000893; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.21.164.68"; classtype:trojan-activity; sid:100000894; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.217.8.194"; classtype:trojan-activity; sid:100000895; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.22.117.102"; classtype:trojan-activity; sid:100000896; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.222.252.130"; classtype:trojan-activity; sid:100000897; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.34.183.30"; classtype:trojan-activity; sid:100000898; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.48.235.59"; classtype:trojan-activity; sid:100000899; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"178.95.136.35"; classtype:trojan-activity; sid:100000900; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"179.159.58.134"; classtype:trojan-activity; sid:100000901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"179.43.176.41"; classtype:trojan-activity; sid:100000902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"179.43.176.48"; classtype:trojan-activity; sid:100000903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"179.60.84.7"; classtype:trojan-activity; sid:100000904; rev:1;) @@ -941,196 +941,196 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"181.49.236.4"; classtype:trojan-activity; sid:100000935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"181.49.59.162"; classtype:trojan-activity; sid:100000936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"181.80.69.94"; classtype:trojan-activity; sid:100000937; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.115.179.201"; classtype:trojan-activity; sid:100000938; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.119.206.219"; classtype:trojan-activity; sid:100000939; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.119.225.221"; classtype:trojan-activity; sid:100000940; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.119.228.125"; classtype:trojan-activity; sid:100000941; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.120.16.22"; classtype:trojan-activity; sid:100000942; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.120.16.46"; classtype:trojan-activity; sid:100000943; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.126.116.209"; classtype:trojan-activity; sid:100000944; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.127.139.169"; classtype:trojan-activity; sid:100000945; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.160.98.250"; classtype:trojan-activity; sid:100000946; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.233.0.252"; classtype:trojan-activity; sid:100000947; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.235.252.31"; classtype:trojan-activity; sid:100000948; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.53.197.62"; classtype:trojan-activity; sid:100000949; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"183.105.104.83"; classtype:trojan-activity; sid:100000950; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.112.177.134"; classtype:trojan-activity; sid:100000938; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.115.179.201"; classtype:trojan-activity; sid:100000939; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.119.206.219"; classtype:trojan-activity; sid:100000940; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.119.225.221"; classtype:trojan-activity; sid:100000941; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.119.228.125"; classtype:trojan-activity; sid:100000942; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.120.16.22"; classtype:trojan-activity; sid:100000943; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.120.16.46"; classtype:trojan-activity; sid:100000944; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.126.116.209"; classtype:trojan-activity; sid:100000945; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.127.139.169"; classtype:trojan-activity; sid:100000946; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.160.98.250"; classtype:trojan-activity; sid:100000947; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.233.0.252"; classtype:trojan-activity; sid:100000948; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.235.252.31"; classtype:trojan-activity; sid:100000949; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"182.53.197.62"; classtype:trojan-activity; sid:100000950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"183.105.225.154"; classtype:trojan-activity; sid:100000951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"183.109.169.45"; classtype:trojan-activity; sid:100000952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"183.143.148.105"; classtype:trojan-activity; sid:100000953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"183.188.50.93"; classtype:trojan-activity; sid:100000954; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"183.83.8.225"; classtype:trojan-activity; sid:100000955; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"184.164.185.41"; classtype:trojan-activity; sid:100000956; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"184.74.149.230"; classtype:trojan-activity; sid:100000957; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"184.82.15.135"; classtype:trojan-activity; sid:100000958; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.106.209.68"; classtype:trojan-activity; sid:100000959; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.107.3.8"; classtype:trojan-activity; sid:100000960; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.117.2.107"; classtype:trojan-activity; sid:100000961; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.172.110.235"; classtype:trojan-activity; sid:100000962; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.174.101.41"; classtype:trojan-activity; sid:100000963; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.181.10.234"; classtype:trojan-activity; sid:100000964; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.21.106.210"; classtype:trojan-activity; sid:100000965; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.215.113.112"; classtype:trojan-activity; sid:100000966; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.215.113.54"; classtype:trojan-activity; sid:100000967; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.215.113.93"; classtype:trojan-activity; sid:100000968; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.221.3.244"; classtype:trojan-activity; sid:100000969; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.222.58.152"; classtype:trojan-activity; sid:100000970; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.224.129.224"; classtype:trojan-activity; sid:100000971; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.228.141.74"; classtype:trojan-activity; sid:100000972; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.233.186.151"; classtype:trojan-activity; sid:100000973; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.245.96.94"; classtype:trojan-activity; sid:100000974; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.26.113.95"; classtype:trojan-activity; sid:100000975; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.34.16.231"; classtype:trojan-activity; sid:100000976; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.38.142.236"; classtype:trojan-activity; sid:100000977; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.55.1.182"; classtype:trojan-activity; sid:100000978; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.68.230.207"; classtype:trojan-activity; sid:100000979; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.8.173.159"; classtype:trojan-activity; sid:100000980; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.81.157.186"; classtype:trojan-activity; sid:100000981; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.217.185"; classtype:trojan-activity; sid:100000982; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.217.213"; classtype:trojan-activity; sid:100000983; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.219.160"; classtype:trojan-activity; sid:100000984; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.219.161"; classtype:trojan-activity; sid:100000985; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.219.219"; classtype:trojan-activity; sid:100000986; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.151.144.85"; classtype:trojan-activity; sid:100000987; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.219.164"; classtype:trojan-activity; sid:100000988; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.243.112"; classtype:trojan-activity; sid:100000989; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.243.77"; classtype:trojan-activity; sid:100000990; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.243.91"; classtype:trojan-activity; sid:100000991; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.253.150"; classtype:trojan-activity; sid:100000992; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.225.120.173"; classtype:trojan-activity; sid:100000993; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.232.44.86"; classtype:trojan-activity; sid:100000994; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.28.60.184"; classtype:trojan-activity; sid:100000995; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.34.4.40"; classtype:trojan-activity; sid:100000996; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.73.188.132"; classtype:trojan-activity; sid:100000997; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"187.12.10.98"; classtype:trojan-activity; sid:100000998; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"187.188.124.229"; classtype:trojan-activity; sid:100000999; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.10.21.14"; classtype:trojan-activity; sid:100001000; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.10.231.246"; classtype:trojan-activity; sid:100001001; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.13.179.87"; classtype:trojan-activity; sid:100001002; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.138.200.32"; classtype:trojan-activity; sid:100001003; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.143.220.152"; classtype:trojan-activity; sid:100001004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.152.41.141"; classtype:trojan-activity; sid:100001005; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.169.178.50"; classtype:trojan-activity; sid:100001006; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.169.179.127"; classtype:trojan-activity; sid:100001007; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.169.36.163"; classtype:trojan-activity; sid:100001008; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.242.167.159"; classtype:trojan-activity; sid:100001009; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.242.242.144"; classtype:trojan-activity; sid:100001010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.83.202.25"; classtype:trojan-activity; sid:100001011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.0.42.106"; classtype:trojan-activity; sid:100001012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.109.178.139"; classtype:trojan-activity; sid:100001013; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.110.161.252"; classtype:trojan-activity; sid:100001014; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.111.151.164"; classtype:trojan-activity; sid:100001015; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.119.207.58"; classtype:trojan-activity; sid:100001016; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.12.99.194"; classtype:trojan-activity; sid:100001017; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.160"; classtype:trojan-activity; sid:100001018; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.3"; classtype:trojan-activity; sid:100001019; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.37"; classtype:trojan-activity; sid:100001020; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.41"; classtype:trojan-activity; sid:100001021; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.42"; classtype:trojan-activity; sid:100001022; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.76"; classtype:trojan-activity; sid:100001023; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.130.15.212"; classtype:trojan-activity; sid:100001024; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.130.20.14"; classtype:trojan-activity; sid:100001025; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.147.16.184"; classtype:trojan-activity; sid:100001026; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.159.240.9"; classtype:trojan-activity; sid:100001027; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.187.55.150"; classtype:trojan-activity; sid:100001028; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.210.214.130"; classtype:trojan-activity; sid:100001029; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.213.177.39"; classtype:trojan-activity; sid:100001030; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.213.226.63"; classtype:trojan-activity; sid:100001031; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.213.49.207"; classtype:trojan-activity; sid:100001032; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.214.24.194"; classtype:trojan-activity; sid:100001033; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.216.140.123"; classtype:trojan-activity; sid:100001034; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.65.206.162"; classtype:trojan-activity; sid:100001035; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.85.213.51"; classtype:trojan-activity; sid:100001036; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.98.37.135"; classtype:trojan-activity; sid:100001037; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.98.37.200"; classtype:trojan-activity; sid:100001038; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.98.41.33"; classtype:trojan-activity; sid:100001039; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"191.255.248.220"; classtype:trojan-activity; sid:100001040; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.153.57.94"; classtype:trojan-activity; sid:100001041; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.210.175.130"; classtype:trojan-activity; sid:100001042; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.185.106"; classtype:trojan-activity; sid:100001043; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.209.27"; classtype:trojan-activity; sid:100001044; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.220.55"; classtype:trojan-activity; sid:100001045; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.228.67"; classtype:trojan-activity; sid:100001046; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.230.72"; classtype:trojan-activity; sid:100001047; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.230.74"; classtype:trojan-activity; sid:100001048; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.230.76"; classtype:trojan-activity; sid:100001049; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.236.147.58"; classtype:trojan-activity; sid:100001050; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.99.240.77"; classtype:trojan-activity; sid:100001051; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.113.107.243"; classtype:trojan-activity; sid:100001052; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.147.142.230"; classtype:trojan-activity; sid:100001053; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.15.36.167"; classtype:trojan-activity; sid:100001054; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.152.35.139"; classtype:trojan-activity; sid:100001055; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.38.20.199"; classtype:trojan-activity; sid:100001056; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"195.139.126.51"; classtype:trojan-activity; sid:100001057; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"195.228.231.218"; classtype:trojan-activity; sid:100001058; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"195.24.94.187"; classtype:trojan-activity; sid:100001059; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"195.5.3.87"; classtype:trojan-activity; sid:100001060; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"196.202.26.182"; classtype:trojan-activity; sid:100001061; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"196.221.148.90"; classtype:trojan-activity; sid:100001062; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"196.221.166.203"; classtype:trojan-activity; sid:100001063; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"197.50.27.115"; classtype:trojan-activity; sid:100001064; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"198.23.133.218"; classtype:trojan-activity; sid:100001065; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"198.23.174.104"; classtype:trojan-activity; sid:100001066; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"198.23.213.61"; classtype:trojan-activity; sid:100001067; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"198.23.251.105"; classtype:trojan-activity; sid:100001068; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"198.46.132.132"; classtype:trojan-activity; sid:100001069; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1am.co.nz"; classtype:trojan-activity; sid:100001070; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.239.22.188"; classtype:trojan-activity; sid:100001071; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.36.231.201"; classtype:trojan-activity; sid:100001072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.37.149.230"; classtype:trojan-activity; sid:100001073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.45.111.158"; classtype:trojan-activity; sid:100001074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.45.4.24"; classtype:trojan-activity; sid:100001075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.55.125.182"; classtype:trojan-activity; sid:100001076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.55.92.184"; classtype:trojan-activity; sid:100001077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.56.8.80"; classtype:trojan-activity; sid:100001078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.57.122.107"; classtype:trojan-activity; sid:100001079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.83.152.16"; classtype:trojan-activity; sid:100001080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"20.185.42.197"; classtype:trojan-activity; sid:100001081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"200.105.167.98"; classtype:trojan-activity; sid:100001082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"200.111.189.70"; classtype:trojan-activity; sid:100001083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"200.194.4.24"; classtype:trojan-activity; sid:100001084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"200.30.132.50"; classtype:trojan-activity; sid:100001085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.170.46.2"; classtype:trojan-activity; sid:100001086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.184.163.170"; classtype:trojan-activity; sid:100001087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.187.102.73"; classtype:trojan-activity; sid:100001088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.200.254.86"; classtype:trojan-activity; sid:100001089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.203.221.20"; classtype:trojan-activity; sid:100001090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.203.27.37"; classtype:trojan-activity; sid:100001091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.107.233.41"; classtype:trojan-activity; sid:100001092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.150.176.100"; classtype:trojan-activity; sid:100001093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.166.217.54"; classtype:trojan-activity; sid:100001094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.175.103.10"; classtype:trojan-activity; sid:100001095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.29.95.12"; classtype:trojan-activity; sid:100001096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.4.124.58"; classtype:trojan-activity; sid:100001097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.51.176.114"; classtype:trojan-activity; sid:100001098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.51.191.174"; classtype:trojan-activity; sid:100001099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.74.236.9"; classtype:trojan-activity; sid:100001100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.109.201.243"; classtype:trojan-activity; sid:100001101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.159.80.128"; classtype:trojan-activity; sid:100001102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.159.80.129"; classtype:trojan-activity; sid:100001103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.170.123.78"; classtype:trojan-activity; sid:100001104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.189.156.107"; classtype:trojan-activity; sid:100001105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.204.232.18"; classtype:trojan-activity; sid:100001106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.229.21.56"; classtype:trojan-activity; sid:100001107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.236.190.28"; classtype:trojan-activity; sid:100001108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.238.86.202"; classtype:trojan-activity; sid:100001109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.243.142.132"; classtype:trojan-activity; sid:100001110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.70.166.107"; classtype:trojan-activity; sid:100001111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.77.80.159"; classtype:trojan-activity; sid:100001112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.80.119.166"; classtype:trojan-activity; sid:100001113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.80.171.138"; classtype:trojan-activity; sid:100001114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.82.36.34"; classtype:trojan-activity; sid:100001115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.93.6.28"; classtype:trojan-activity; sid:100001116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"204.195.116.171"; classtype:trojan-activity; sid:100001117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"206.248.137.132"; classtype:trojan-activity; sid:100001118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"206.47.41.166"; classtype:trojan-activity; sid:100001119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"207.5.32.6"; classtype:trojan-activity; sid:100001120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"208.163.58.18"; classtype:trojan-activity; sid:100001121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"208.75.27.157"; classtype:trojan-activity; sid:100001122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"209.141.40.190"; classtype:trojan-activity; sid:100001123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"209.141.40.31"; classtype:trojan-activity; sid:100001124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"209.146.98.50"; classtype:trojan-activity; sid:100001125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"210.124.149.19"; classtype:trojan-activity; sid:100001126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"210.180.17.140"; classtype:trojan-activity; sid:100001127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"183.83.1.1"; classtype:trojan-activity; sid:100000955; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"183.83.14.20"; classtype:trojan-activity; sid:100000956; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"184.164.185.41"; classtype:trojan-activity; sid:100000957; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"184.175.115.10"; classtype:trojan-activity; sid:100000958; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"184.74.149.230"; classtype:trojan-activity; sid:100000959; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"184.82.15.135"; classtype:trojan-activity; sid:100000960; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.106.209.68"; classtype:trojan-activity; sid:100000961; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.107.3.8"; classtype:trojan-activity; sid:100000962; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.117.2.107"; classtype:trojan-activity; sid:100000963; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.172.110.235"; classtype:trojan-activity; sid:100000964; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.174.101.41"; classtype:trojan-activity; sid:100000965; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.181.10.234"; classtype:trojan-activity; sid:100000966; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.21.106.210"; classtype:trojan-activity; sid:100000967; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.215.113.112"; classtype:trojan-activity; sid:100000968; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.215.113.54"; classtype:trojan-activity; sid:100000969; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.215.113.93"; classtype:trojan-activity; sid:100000970; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.221.3.244"; classtype:trojan-activity; sid:100000971; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.222.58.152"; classtype:trojan-activity; sid:100000972; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.228.141.74"; classtype:trojan-activity; sid:100000973; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.233.186.151"; classtype:trojan-activity; sid:100000974; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.245.96.94"; classtype:trojan-activity; sid:100000975; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.26.113.95"; classtype:trojan-activity; sid:100000976; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.34.16.231"; classtype:trojan-activity; sid:100000977; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.38.142.236"; classtype:trojan-activity; sid:100000978; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.55.1.182"; classtype:trojan-activity; sid:100000979; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.68.230.207"; classtype:trojan-activity; sid:100000980; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.8.173.159"; classtype:trojan-activity; sid:100000981; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.81.154.208"; classtype:trojan-activity; sid:100000982; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.81.157.186"; classtype:trojan-activity; sid:100000983; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.217.185"; classtype:trojan-activity; sid:100000984; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.217.213"; classtype:trojan-activity; sid:100000985; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.219.160"; classtype:trojan-activity; sid:100000986; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.219.161"; classtype:trojan-activity; sid:100000987; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"185.82.219.219"; classtype:trojan-activity; sid:100000988; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.151.144.85"; classtype:trojan-activity; sid:100000989; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.219.164"; classtype:trojan-activity; sid:100000990; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.243.112"; classtype:trojan-activity; sid:100000991; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.243.77"; classtype:trojan-activity; sid:100000992; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.243.91"; classtype:trojan-activity; sid:100000993; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.179.253.150"; classtype:trojan-activity; sid:100000994; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.225.120.173"; classtype:trojan-activity; sid:100000995; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.232.44.86"; classtype:trojan-activity; sid:100000996; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.28.60.184"; classtype:trojan-activity; sid:100000997; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.34.4.40"; classtype:trojan-activity; sid:100000998; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"186.73.188.132"; classtype:trojan-activity; sid:100000999; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"187.12.10.98"; classtype:trojan-activity; sid:100001000; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"187.188.124.229"; classtype:trojan-activity; sid:100001001; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.10.21.14"; classtype:trojan-activity; sid:100001002; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.10.231.246"; classtype:trojan-activity; sid:100001003; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.13.179.87"; classtype:trojan-activity; sid:100001004; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.138.200.32"; classtype:trojan-activity; sid:100001005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.143.220.152"; classtype:trojan-activity; sid:100001006; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.152.41.141"; classtype:trojan-activity; sid:100001007; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.169.178.50"; classtype:trojan-activity; sid:100001008; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.169.179.127"; classtype:trojan-activity; sid:100001009; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.169.199.59"; classtype:trojan-activity; sid:100001010; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.169.30.30"; classtype:trojan-activity; sid:100001011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.169.36.163"; classtype:trojan-activity; sid:100001012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.242.167.159"; classtype:trojan-activity; sid:100001013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.242.242.144"; classtype:trojan-activity; sid:100001014; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"188.83.202.25"; classtype:trojan-activity; sid:100001015; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.0.42.106"; classtype:trojan-activity; sid:100001016; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.109.178.139"; classtype:trojan-activity; sid:100001017; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.110.161.252"; classtype:trojan-activity; sid:100001018; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.111.151.164"; classtype:trojan-activity; sid:100001019; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.119.207.58"; classtype:trojan-activity; sid:100001020; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.12.99.194"; classtype:trojan-activity; sid:100001021; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.160"; classtype:trojan-activity; sid:100001022; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.3"; classtype:trojan-activity; sid:100001023; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.37"; classtype:trojan-activity; sid:100001024; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.41"; classtype:trojan-activity; sid:100001025; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.42"; classtype:trojan-activity; sid:100001026; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.122.112.76"; classtype:trojan-activity; sid:100001027; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.130.15.212"; classtype:trojan-activity; sid:100001028; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.130.20.14"; classtype:trojan-activity; sid:100001029; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.147.16.184"; classtype:trojan-activity; sid:100001030; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.159.240.9"; classtype:trojan-activity; sid:100001031; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.187.55.150"; classtype:trojan-activity; sid:100001032; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.210.214.130"; classtype:trojan-activity; sid:100001033; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.213.177.39"; classtype:trojan-activity; sid:100001034; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.213.226.63"; classtype:trojan-activity; sid:100001035; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.213.49.207"; classtype:trojan-activity; sid:100001036; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.214.24.194"; classtype:trojan-activity; sid:100001037; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.216.140.123"; classtype:trojan-activity; sid:100001038; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.65.206.162"; classtype:trojan-activity; sid:100001039; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.85.213.51"; classtype:trojan-activity; sid:100001040; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.92.4.231"; classtype:trojan-activity; sid:100001041; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.98.37.135"; classtype:trojan-activity; sid:100001042; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.98.37.200"; classtype:trojan-activity; sid:100001043; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"190.98.41.33"; classtype:trojan-activity; sid:100001044; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"191.255.248.220"; classtype:trojan-activity; sid:100001045; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.153.57.94"; classtype:trojan-activity; sid:100001046; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.210.175.130"; classtype:trojan-activity; sid:100001047; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.185.106"; classtype:trojan-activity; sid:100001048; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.209.27"; classtype:trojan-activity; sid:100001049; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.220.55"; classtype:trojan-activity; sid:100001050; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.228.67"; classtype:trojan-activity; sid:100001051; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.230.72"; classtype:trojan-activity; sid:100001052; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.230.74"; classtype:trojan-activity; sid:100001053; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.227.230.76"; classtype:trojan-activity; sid:100001054; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"192.99.240.77"; classtype:trojan-activity; sid:100001055; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.113.107.243"; classtype:trojan-activity; sid:100001056; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.147.142.230"; classtype:trojan-activity; sid:100001057; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.15.36.167"; classtype:trojan-activity; sid:100001058; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.152.35.139"; classtype:trojan-activity; sid:100001059; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"194.38.20.199"; classtype:trojan-activity; sid:100001060; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"195.139.126.51"; classtype:trojan-activity; sid:100001061; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"195.228.231.218"; classtype:trojan-activity; sid:100001062; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"195.24.94.187"; classtype:trojan-activity; sid:100001063; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"195.5.3.87"; classtype:trojan-activity; sid:100001064; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"196.202.26.182"; classtype:trojan-activity; sid:100001065; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"196.218.48.82"; classtype:trojan-activity; sid:100001066; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"196.221.148.90"; classtype:trojan-activity; sid:100001067; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"196.221.166.203"; classtype:trojan-activity; sid:100001068; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"197.50.27.115"; classtype:trojan-activity; sid:100001069; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"198.23.213.61"; classtype:trojan-activity; sid:100001070; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"198.23.251.105"; classtype:trojan-activity; sid:100001071; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"198.46.132.132"; classtype:trojan-activity; sid:100001072; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1am.co.nz"; classtype:trojan-activity; sid:100001073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.239.22.188"; classtype:trojan-activity; sid:100001074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.36.231.201"; classtype:trojan-activity; sid:100001075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.37.149.230"; classtype:trojan-activity; sid:100001076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.37.203.65"; classtype:trojan-activity; sid:100001077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.45.111.158"; classtype:trojan-activity; sid:100001078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.45.4.24"; classtype:trojan-activity; sid:100001079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.55.125.182"; classtype:trojan-activity; sid:100001080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.55.92.184"; classtype:trojan-activity; sid:100001081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.56.8.80"; classtype:trojan-activity; sid:100001082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.57.122.107"; classtype:trojan-activity; sid:100001083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"2.83.152.16"; classtype:trojan-activity; sid:100001084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"20.185.42.197"; classtype:trojan-activity; sid:100001085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"200.105.167.98"; classtype:trojan-activity; sid:100001086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"200.111.189.70"; classtype:trojan-activity; sid:100001087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"200.194.4.24"; classtype:trojan-activity; sid:100001088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"200.30.132.50"; classtype:trojan-activity; sid:100001089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.170.46.2"; classtype:trojan-activity; sid:100001090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.171.40.215"; classtype:trojan-activity; sid:100001091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.184.163.170"; classtype:trojan-activity; sid:100001092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.187.102.73"; classtype:trojan-activity; sid:100001093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.200.254.86"; classtype:trojan-activity; sid:100001094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.203.221.20"; classtype:trojan-activity; sid:100001095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"201.203.27.37"; classtype:trojan-activity; sid:100001096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.107.233.41"; classtype:trojan-activity; sid:100001097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.166.217.54"; classtype:trojan-activity; sid:100001098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.175.103.10"; classtype:trojan-activity; sid:100001099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.29.95.12"; classtype:trojan-activity; sid:100001100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.4.124.58"; classtype:trojan-activity; sid:100001101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.51.176.114"; classtype:trojan-activity; sid:100001102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"202.51.191.174"; classtype:trojan-activity; sid:100001103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.109.201.243"; classtype:trojan-activity; sid:100001104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.159.80.128"; classtype:trojan-activity; sid:100001105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.159.80.129"; classtype:trojan-activity; sid:100001106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.159.80.164"; classtype:trojan-activity; sid:100001107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.170.123.78"; classtype:trojan-activity; sid:100001108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.189.156.107"; classtype:trojan-activity; sid:100001109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.204.232.18"; classtype:trojan-activity; sid:100001110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.229.21.56"; classtype:trojan-activity; sid:100001111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.236.190.28"; classtype:trojan-activity; sid:100001112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.70.166.107"; classtype:trojan-activity; sid:100001113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.80.119.166"; classtype:trojan-activity; sid:100001114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.80.171.138"; classtype:trojan-activity; sid:100001115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.82.36.34"; classtype:trojan-activity; sid:100001116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"203.93.6.28"; classtype:trojan-activity; sid:100001117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"204.195.116.171"; classtype:trojan-activity; sid:100001118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"206.248.137.132"; classtype:trojan-activity; sid:100001119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"206.47.41.166"; classtype:trojan-activity; sid:100001120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"207.5.32.6"; classtype:trojan-activity; sid:100001121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"208.163.58.18"; classtype:trojan-activity; sid:100001122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"208.75.27.157"; classtype:trojan-activity; sid:100001123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"209.141.40.190"; classtype:trojan-activity; sid:100001124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"209.141.40.31"; classtype:trojan-activity; sid:100001125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"209.146.98.50"; classtype:trojan-activity; sid:100001126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"210.124.149.19"; classtype:trojan-activity; sid:100001127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"210.216.152.122"; classtype:trojan-activity; sid:100001128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"210.216.153.142"; classtype:trojan-activity; sid:100001129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"210.57.234.93"; classtype:trojan-activity; sid:100001130; rev:1;) @@ -1139,479 +1139,479 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"210.68.242.114"; classtype:trojan-activity; sid:100001133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.187.132.204"; classtype:trojan-activity; sid:100001134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.187.75.220"; classtype:trojan-activity; sid:100001135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.200.160.239"; classtype:trojan-activity; sid:100001136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.204.215.157"; classtype:trojan-activity; sid:100001137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.210.66.179"; classtype:trojan-activity; sid:100001138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.210.93.93"; classtype:trojan-activity; sid:100001139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.216.66.105"; classtype:trojan-activity; sid:100001140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.237.114.96"; classtype:trojan-activity; sid:100001141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.237.120.13"; classtype:trojan-activity; sid:100001142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.204.215.157"; classtype:trojan-activity; sid:100001136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.210.66.179"; classtype:trojan-activity; sid:100001137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.210.93.93"; classtype:trojan-activity; sid:100001138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.216.66.105"; classtype:trojan-activity; sid:100001139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.237.114.96"; classtype:trojan-activity; sid:100001140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.237.120.13"; classtype:trojan-activity; sid:100001141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.237.246.137"; classtype:trojan-activity; sid:100001142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.238.83.238"; classtype:trojan-activity; sid:100001143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.247.5.96"; classtype:trojan-activity; sid:100001144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.32.122.110"; classtype:trojan-activity; sid:100001145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"211.93.191.153"; classtype:trojan-activity; sid:100001146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"212.122.86.105"; classtype:trojan-activity; sid:100001147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"212.143.227.22"; classtype:trojan-activity; sid:100001148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"212.46.197.114"; classtype:trojan-activity; sid:100001149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"212.56.197.230"; classtype:trojan-activity; sid:100001150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.123.206.197"; classtype:trojan-activity; sid:100001151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.135.178.253"; classtype:trojan-activity; sid:100001152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.14.173.117"; classtype:trojan-activity; sid:100001153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.149.190.193"; classtype:trojan-activity; sid:100001154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.104.12"; classtype:trojan-activity; sid:100001155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.104.99"; classtype:trojan-activity; sid:100001156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.111.201"; classtype:trojan-activity; sid:100001157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.114.136"; classtype:trojan-activity; sid:100001158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.114.165"; classtype:trojan-activity; sid:100001159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.115.104"; classtype:trojan-activity; sid:100001160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.116.153"; classtype:trojan-activity; sid:100001161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.126.20"; classtype:trojan-activity; sid:100001162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.126.201"; classtype:trojan-activity; sid:100001163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.126.243"; classtype:trojan-activity; sid:100001164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"212.156.215.178"; classtype:trojan-activity; sid:100001149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"212.46.197.114"; classtype:trojan-activity; sid:100001150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"212.56.197.230"; classtype:trojan-activity; sid:100001151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.123.206.197"; classtype:trojan-activity; sid:100001152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.135.178.253"; classtype:trojan-activity; sid:100001153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.14.173.117"; classtype:trojan-activity; sid:100001154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.149.190.193"; classtype:trojan-activity; sid:100001155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.104.12"; classtype:trojan-activity; sid:100001156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.104.99"; classtype:trojan-activity; sid:100001157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.111.201"; classtype:trojan-activity; sid:100001158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.114.136"; classtype:trojan-activity; sid:100001159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.116.153"; classtype:trojan-activity; sid:100001160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.118.10"; classtype:trojan-activity; sid:100001161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.118.216"; classtype:trojan-activity; sid:100001162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.126.20"; classtype:trojan-activity; sid:100001163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.126.201"; classtype:trojan-activity; sid:100001164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.163.126.7"; classtype:trojan-activity; sid:100001165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.189.178.163"; classtype:trojan-activity; sid:100001166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.240.218.15"; classtype:trojan-activity; sid:100001167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.249.156.189"; classtype:trojan-activity; sid:100001168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.91.244.58"; classtype:trojan-activity; sid:100001169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.186.69.101"; classtype:trojan-activity; sid:100001166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.189.178.163"; classtype:trojan-activity; sid:100001167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.240.218.15"; classtype:trojan-activity; sid:100001168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.249.156.189"; classtype:trojan-activity; sid:100001169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"213.92.254.52"; classtype:trojan-activity; sid:100001170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"216.158.238.236"; classtype:trojan-activity; sid:100001171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"216.170.240.98"; classtype:trojan-activity; sid:100001172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"216.183.54.169"; classtype:trojan-activity; sid:100001173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"216.36.12.98"; classtype:trojan-activity; sid:100001174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"217.11.75.162"; classtype:trojan-activity; sid:100001175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.12.181.110"; classtype:trojan-activity; sid:100001176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.161.69.135"; classtype:trojan-activity; sid:100001177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.2.40.34"; classtype:trojan-activity; sid:100001178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.234.165.18"; classtype:trojan-activity; sid:100001179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.238.246.3"; classtype:trojan-activity; sid:100001180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.35.207.119"; classtype:trojan-activity; sid:100001181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.35.227.133"; classtype:trojan-activity; sid:100001182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.35.68.35"; classtype:trojan-activity; sid:100001183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.35.81.81"; classtype:trojan-activity; sid:100001184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.56.93.129"; classtype:trojan-activity; sid:100001185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.59.116.203"; classtype:trojan-activity; sid:100001186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.79.103.159"; classtype:trojan-activity; sid:100001187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.93.102.63"; classtype:trojan-activity; sid:100001188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.93.102.75"; classtype:trojan-activity; sid:100001189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.155.29.165"; classtype:trojan-activity; sid:100001190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.155.64.104"; classtype:trojan-activity; sid:100001191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.157.139.165"; classtype:trojan-activity; sid:100001192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.157.202.92"; classtype:trojan-activity; sid:100001193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.157.214.235"; classtype:trojan-activity; sid:100001194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.241.6.180"; classtype:trojan-activity; sid:100001195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.1.148"; classtype:trojan-activity; sid:100001196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.1.84"; classtype:trojan-activity; sid:100001197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.163.7"; classtype:trojan-activity; sid:100001198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.171.144"; classtype:trojan-activity; sid:100001199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.245.63"; classtype:trojan-activity; sid:100001200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.5.140"; classtype:trojan-activity; sid:100001201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.69.71.186"; classtype:trojan-activity; sid:100001202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.80.217.209"; classtype:trojan-activity; sid:100001203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.85.145.194"; classtype:trojan-activity; sid:100001204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"21robo.com"; classtype:trojan-activity; sid:100001205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.118.168.155"; classtype:trojan-activity; sid:100001206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.126.237.74"; classtype:trojan-activity; sid:100001207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.132.89.154"; classtype:trojan-activity; sid:100001208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.200.22.163"; classtype:trojan-activity; sid:100001209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.90.159.188"; classtype:trojan-activity; sid:100001210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.0.133.84"; classtype:trojan-activity; sid:100001211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.124.78.15"; classtype:trojan-activity; sid:100001212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.157.191.178"; classtype:trojan-activity; sid:100001213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.160.136.213"; classtype:trojan-activity; sid:100001214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.201.54.97"; classtype:trojan-activity; sid:100001215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.202.232.230"; classtype:trojan-activity; sid:100001216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.214.130.147"; classtype:trojan-activity; sid:100001217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.214.251.109"; classtype:trojan-activity; sid:100001218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.116.167"; classtype:trojan-activity; sid:100001219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.172.207"; classtype:trojan-activity; sid:100001220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.184.31"; classtype:trojan-activity; sid:100001221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.252.64"; classtype:trojan-activity; sid:100001222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.8.64"; classtype:trojan-activity; sid:100001223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.232.183.167"; classtype:trojan-activity; sid:100001224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.235.137.36"; classtype:trojan-activity; sid:100001225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.3.112.125"; classtype:trojan-activity; sid:100001226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.3.43.223"; classtype:trojan-activity; sid:100001227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.3.68.16"; classtype:trojan-activity; sid:100001228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.108.17.64"; classtype:trojan-activity; sid:100001229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.118.248.149"; classtype:trojan-activity; sid:100001230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.119.65.145"; classtype:trojan-activity; sid:100001231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.132.125.138"; classtype:trojan-activity; sid:100001232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.133.103.120"; classtype:trojan-activity; sid:100001233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.135.9.5"; classtype:trojan-activity; sid:100001234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.137.139.86"; classtype:trojan-activity; sid:100001235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.137.73.214"; classtype:trojan-activity; sid:100001236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.138.201.129"; classtype:trojan-activity; sid:100001237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.140.17.245"; classtype:trojan-activity; sid:100001238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.185.116.233"; classtype:trojan-activity; sid:100001239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.187.9.178"; classtype:trojan-activity; sid:100001240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.211.72.66"; classtype:trojan-activity; sid:100001241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.236.85.220"; classtype:trojan-activity; sid:100001242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.238.230.7"; classtype:trojan-activity; sid:100001243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.239.83.232"; classtype:trojan-activity; sid:100001244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.248.64.253"; classtype:trojan-activity; sid:100001245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.92.9.126"; classtype:trojan-activity; sid:100001246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.95.190.20"; classtype:trojan-activity; sid:100001247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.99.171.192"; classtype:trojan-activity; sid:100001248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.13.87.209"; classtype:trojan-activity; sid:100001249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.131.201.82"; classtype:trojan-activity; sid:100001250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.166.117.210"; classtype:trojan-activity; sid:100001251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.167.118.17"; classtype:trojan-activity; sid:100001252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.212.234.84"; classtype:trojan-activity; sid:100001253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.212.5.29"; classtype:trojan-activity; sid:100001254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.212.73.175"; classtype:trojan-activity; sid:100001255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.115.118.232"; classtype:trojan-activity; sid:100001256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.125.186.135"; classtype:trojan-activity; sid:100001257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.126.120.25"; classtype:trojan-activity; sid:100001258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.24.213.121"; classtype:trojan-activity; sid:100001259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.243.149.13"; classtype:trojan-activity; sid:100001260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.243.21.167"; classtype:trojan-activity; sid:100001261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.95.89.21"; classtype:trojan-activity; sid:100001262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.103.74.180"; classtype:trojan-activity; sid:100001263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.11.141.134"; classtype:trojan-activity; sid:100001264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.119.158.74"; classtype:trojan-activity; sid:100001265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.137.147.95"; classtype:trojan-activity; sid:100001266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.137.233.132"; classtype:trojan-activity; sid:100001267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.158.25.98"; classtype:trojan-activity; sid:100001268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.176.206.12"; classtype:trojan-activity; sid:100001269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.184.1.41"; classtype:trojan-activity; sid:100001270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.192.191.109"; classtype:trojan-activity; sid:100001271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.225.114.161"; classtype:trojan-activity; sid:100001272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.227.190.78"; classtype:trojan-activity; sid:100001273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.35.245.52"; classtype:trojan-activity; sid:100001274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.39.181.18"; classtype:trojan-activity; sid:100001275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.39.34.242"; classtype:trojan-activity; sid:100001276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.42.229.143"; classtype:trojan-activity; sid:100001277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.45.4.1"; classtype:trojan-activity; sid:100001278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.51.91.113"; classtype:trojan-activity; sid:100001279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.53.163.10"; classtype:trojan-activity; sid:100001280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.53.163.9"; classtype:trojan-activity; sid:100001281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.89.140.190"; classtype:trojan-activity; sid:100001282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.1.245.16"; classtype:trojan-activity; sid:100001283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.1.245.7"; classtype:trojan-activity; sid:100001284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.105.106.201"; classtype:trojan-activity; sid:100001285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.105.152.107"; classtype:trojan-activity; sid:100001286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.116.84.57"; classtype:trojan-activity; sid:100001287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.117.105.125"; classtype:trojan-activity; sid:100001288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.14.211.219"; classtype:trojan-activity; sid:100001289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.14.81.201"; classtype:trojan-activity; sid:100001290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.141.218.17"; classtype:trojan-activity; sid:100001291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.147.29.52"; classtype:trojan-activity; sid:100001292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.147.40.128"; classtype:trojan-activity; sid:100001293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.184.251.135"; classtype:trojan-activity; sid:100001294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.193.217.210"; classtype:trojan-activity; sid:100001295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.194.149.142"; classtype:trojan-activity; sid:100001296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.194.192.66"; classtype:trojan-activity; sid:100001297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.197.23.215"; classtype:trojan-activity; sid:100001298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.199.232.65"; classtype:trojan-activity; sid:100001299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.199.34.48"; classtype:trojan-activity; sid:100001300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.200.110.211"; classtype:trojan-activity; sid:100001301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.200.32.146"; classtype:trojan-activity; sid:100001302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.201.183.149"; classtype:trojan-activity; sid:100001303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.202.182.201"; classtype:trojan-activity; sid:100001304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.102.12"; classtype:trojan-activity; sid:100001305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.116.86"; classtype:trojan-activity; sid:100001306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.165.138"; classtype:trojan-activity; sid:100001307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.185.42"; classtype:trojan-activity; sid:100001308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.255.42"; classtype:trojan-activity; sid:100001309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.28.115"; classtype:trojan-activity; sid:100001310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.4.188"; classtype:trojan-activity; sid:100001311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.47.104"; classtype:trojan-activity; sid:100001312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.68.144"; classtype:trojan-activity; sid:100001313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.87.75"; classtype:trojan-activity; sid:100001314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.94.134"; classtype:trojan-activity; sid:100001315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.204.253.74"; classtype:trojan-activity; sid:100001316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.205.178.110"; classtype:trojan-activity; sid:100001317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.206.136.101"; classtype:trojan-activity; sid:100001318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.206.154.122"; classtype:trojan-activity; sid:100001319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.206.80.209"; classtype:trojan-activity; sid:100001320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.119.27"; classtype:trojan-activity; sid:100001321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.237.105"; classtype:trojan-activity; sid:100001322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.247.130"; classtype:trojan-activity; sid:100001323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.25.59"; classtype:trojan-activity; sid:100001324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.34.2"; classtype:trojan-activity; sid:100001325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.209.208.122"; classtype:trojan-activity; sid:100001326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.209.231.15"; classtype:trojan-activity; sid:100001327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.21.151.205"; classtype:trojan-activity; sid:100001328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.107.125"; classtype:trojan-activity; sid:100001329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.234.28"; classtype:trojan-activity; sid:100001330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.236.134"; classtype:trojan-activity; sid:100001331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.32.122"; classtype:trojan-activity; sid:100001332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.63.243"; classtype:trojan-activity; sid:100001333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.104.201"; classtype:trojan-activity; sid:100001334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.109.105"; classtype:trojan-activity; sid:100001335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.110.189"; classtype:trojan-activity; sid:100001336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.175.208"; classtype:trojan-activity; sid:100001337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.255.202"; classtype:trojan-activity; sid:100001338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.66.112"; classtype:trojan-activity; sid:100001339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.84.74"; classtype:trojan-activity; sid:100001340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.214.37.129"; classtype:trojan-activity; sid:100001341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.139.242"; classtype:trojan-activity; sid:100001342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.190.172"; classtype:trojan-activity; sid:100001343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.212.209"; classtype:trojan-activity; sid:100001344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.253.149"; classtype:trojan-activity; sid:100001345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.71.243"; classtype:trojan-activity; sid:100001346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.98.242"; classtype:trojan-activity; sid:100001347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.128.156"; classtype:trojan-activity; sid:100001348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.144.66"; classtype:trojan-activity; sid:100001349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.225.28"; classtype:trojan-activity; sid:100001350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.227.95"; classtype:trojan-activity; sid:100001351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.234.98"; classtype:trojan-activity; sid:100001352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.217.191.58"; classtype:trojan-activity; sid:100001353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.218.248.121"; classtype:trojan-activity; sid:100001354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.132.71"; classtype:trojan-activity; sid:100001355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.151.83"; classtype:trojan-activity; sid:100001356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.160.112"; classtype:trojan-activity; sid:100001357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.176.72"; classtype:trojan-activity; sid:100001358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.83.244"; classtype:trojan-activity; sid:100001359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.220.20.66"; classtype:trojan-activity; sid:100001360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.220.249.0"; classtype:trojan-activity; sid:100001361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.220.85.168"; classtype:trojan-activity; sid:100001362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.221.239.223"; classtype:trojan-activity; sid:100001363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.222.241.223"; classtype:trojan-activity; sid:100001364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.222.76.80"; classtype:trojan-activity; sid:100001365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.223.242.164"; classtype:trojan-activity; sid:100001366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.129.198"; classtype:trojan-activity; sid:100001367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.154.13"; classtype:trojan-activity; sid:100001368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.2.30"; classtype:trojan-activity; sid:100001369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.212.124"; classtype:trojan-activity; sid:100001370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.58.5"; classtype:trojan-activity; sid:100001371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.7.204.255"; classtype:trojan-activity; sid:100001372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.0.98.131"; classtype:trojan-activity; sid:100001373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.11.51.57"; classtype:trojan-activity; sid:100001374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.13.23.180"; classtype:trojan-activity; sid:100001375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.124.130"; classtype:trojan-activity; sid:100001376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.146.199"; classtype:trojan-activity; sid:100001377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.179.83"; classtype:trojan-activity; sid:100001378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.184.59"; classtype:trojan-activity; sid:100001379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.191.243"; classtype:trojan-activity; sid:100001380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.194.67"; classtype:trojan-activity; sid:100001381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.216.132"; classtype:trojan-activity; sid:100001382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.219.28"; classtype:trojan-activity; sid:100001383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.24.115"; classtype:trojan-activity; sid:100001384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.30.65"; classtype:trojan-activity; sid:100001385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.63.203"; classtype:trojan-activity; sid:100001386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.65.233"; classtype:trojan-activity; sid:100001387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.79.66"; classtype:trojan-activity; sid:100001388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.94.16"; classtype:trojan-activity; sid:100001389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.179.201.26"; classtype:trojan-activity; sid:100001390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.195.84.250"; classtype:trojan-activity; sid:100001391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.210.20.138"; classtype:trojan-activity; sid:100001392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.210.20.177"; classtype:trojan-activity; sid:100001393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.210.20.69"; classtype:trojan-activity; sid:100001394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.28.7.159"; classtype:trojan-activity; sid:100001395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.30.119.23"; classtype:trojan-activity; sid:100001396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.32.120.79"; classtype:trojan-activity; sid:100001397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"32.208.157.193"; classtype:trojan-activity; sid:100001398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"32792.prolocksmithwinterpark.com"; classtype:trojan-activity; sid:100001399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"34.122.44.188"; classtype:trojan-activity; sid:100001400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"35.184.169.169"; classtype:trojan-activity; sid:100001401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.108.231.218"; classtype:trojan-activity; sid:100001402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.248.83.98"; classtype:trojan-activity; sid:100001403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.249.49.142"; classtype:trojan-activity; sid:100001404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.250.203.246"; classtype:trojan-activity; sid:100001405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.251.157.225"; classtype:trojan-activity; sid:100001406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.251.18.18"; classtype:trojan-activity; sid:100001407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.251.51.244"; classtype:trojan-activity; sid:100001408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.255.90.219"; classtype:trojan-activity; sid:100001409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.33.160.167"; classtype:trojan-activity; sid:100001410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.34.150.236"; classtype:trojan-activity; sid:100001411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.66.105.159"; classtype:trojan-activity; sid:100001412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.66.133.125"; classtype:trojan-activity; sid:100001413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.66.139.36"; classtype:trojan-activity; sid:100001414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.89.18.133"; classtype:trojan-activity; sid:100001415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.91.89.187"; classtype:trojan-activity; sid:100001416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"360.lcy2zzx.pw"; classtype:trojan-activity; sid:100001417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"360down7.miiyun.cn"; classtype:trojan-activity; sid:100001418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.222.98.51"; classtype:trojan-activity; sid:100001419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.233.60.68"; classtype:trojan-activity; sid:100001420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.34.179.221"; classtype:trojan-activity; sid:100001421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.34.180.172"; classtype:trojan-activity; sid:100001422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.44.238.35"; classtype:trojan-activity; sid:100001423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.52.118.199"; classtype:trojan-activity; sid:100001424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.54.14.36"; classtype:trojan-activity; sid:100001425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.113.245.254"; classtype:trojan-activity; sid:100001426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.113.98.136"; classtype:trojan-activity; sid:100001427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.117.31.162"; classtype:trojan-activity; sid:100001428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.162.104.119"; classtype:trojan-activity; sid:100001429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.162.98.216"; classtype:trojan-activity; sid:100001430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.65.196.34"; classtype:trojan-activity; sid:100001431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.66.44.109"; classtype:trojan-activity; sid:100001432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.104.83"; classtype:trojan-activity; sid:100001433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.125.186"; classtype:trojan-activity; sid:100001434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.146.60"; classtype:trojan-activity; sid:100001435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.206.228"; classtype:trojan-activity; sid:100001436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.92.131"; classtype:trojan-activity; sid:100001437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.68.171.125"; classtype:trojan-activity; sid:100001438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.68.249.255"; classtype:trojan-activity; sid:100001439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.68.60.61"; classtype:trojan-activity; sid:100001440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.72.167.202"; classtype:trojan-activity; sid:100001441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.72.67.64"; classtype:trojan-activity; sid:100001442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.73.10.198"; classtype:trojan-activity; sid:100001443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.73.163.231"; classtype:trojan-activity; sid:100001444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.73.168.234"; classtype:trojan-activity; sid:100001445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.73.203.225"; classtype:trojan-activity; sid:100001446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.76.194.65"; classtype:trojan-activity; sid:100001447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.76.78.251"; classtype:trojan-activity; sid:100001448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.113.201"; classtype:trojan-activity; sid:100001449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.114.45"; classtype:trojan-activity; sid:100001450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.150.203"; classtype:trojan-activity; sid:100001451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.209.209"; classtype:trojan-activity; sid:100001452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.48.213"; classtype:trojan-activity; sid:100001453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.63.152"; classtype:trojan-activity; sid:100001454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.79.166.31"; classtype:trojan-activity; sid:100001455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.79.218.46"; classtype:trojan-activity; sid:100001456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.79.91.244"; classtype:trojan-activity; sid:100001457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.79.93.171"; classtype:trojan-activity; sid:100001458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.127.214"; classtype:trojan-activity; sid:100001459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.18.140"; classtype:trojan-activity; sid:100001460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.191.137"; classtype:trojan-activity; sid:100001461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.205.255"; classtype:trojan-activity; sid:100001462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.24.54"; classtype:trojan-activity; sid:100001463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.36.151"; classtype:trojan-activity; sid:100001464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.37.182"; classtype:trojan-activity; sid:100001465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.81.251.0"; classtype:trojan-activity; sid:100001466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.81.27.15"; classtype:trojan-activity; sid:100001467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.81.29.231"; classtype:trojan-activity; sid:100001468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.81.70.88"; classtype:trojan-activity; sid:100001469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.83.94.11"; classtype:trojan-activity; sid:100001470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.84.115.152"; classtype:trojan-activity; sid:100001471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.85.54.4"; classtype:trojan-activity; sid:100001472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.86.211.20"; classtype:trojan-activity; sid:100001473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.86.234.187"; classtype:trojan-activity; sid:100001474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.86.78.244"; classtype:trojan-activity; sid:100001475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.87.63.58"; classtype:trojan-activity; sid:100001476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.87.93.109"; classtype:trojan-activity; sid:100001477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.143.176"; classtype:trojan-activity; sid:100001478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.155.96"; classtype:trojan-activity; sid:100001479; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.233.131"; classtype:trojan-activity; sid:100001480; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.67.238"; classtype:trojan-activity; sid:100001481; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.72.9"; classtype:trojan-activity; sid:100001482; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.89.145.11"; classtype:trojan-activity; sid:100001483; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.89.146.36"; classtype:trojan-activity; sid:100001484; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.89.63.23"; classtype:trojan-activity; sid:100001485; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.90.176.191"; classtype:trojan-activity; sid:100001486; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.90.86.212"; classtype:trojan-activity; sid:100001487; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"40.88.2.151"; classtype:trojan-activity; sid:100001488; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.139.209.46"; classtype:trojan-activity; sid:100001489; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.165.130.43"; classtype:trojan-activity; sid:100001490; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.190.63.174"; classtype:trojan-activity; sid:100001491; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.193.192.100"; classtype:trojan-activity; sid:100001492; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.219.185.171"; classtype:trojan-activity; sid:100001493; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.226.60.115"; classtype:trojan-activity; sid:100001494; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.72.203.82"; classtype:trojan-activity; sid:100001495; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.76.157.2"; classtype:trojan-activity; sid:100001496; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.86.18.200"; classtype:trojan-activity; sid:100001497; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.86.18.201"; classtype:trojan-activity; sid:100001498; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.86.5.197"; classtype:trojan-activity; sid:100001499; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.202.101.199"; classtype:trojan-activity; sid:100001500; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.228.60.114"; classtype:trojan-activity; sid:100001501; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.229.173.80"; classtype:trojan-activity; sid:100001502; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.230.91.1"; classtype:trojan-activity; sid:100001503; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.231.208.64"; classtype:trojan-activity; sid:100001504; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.56.15.227"; classtype:trojan-activity; sid:100001505; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.61.99.155"; classtype:trojan-activity; sid:100001506; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.82.217.241"; classtype:trojan-activity; sid:100001507; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"43.241.106.183"; classtype:trojan-activity; sid:100001508; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"43.241.108.134"; classtype:trojan-activity; sid:100001509; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"43.252.8.94"; classtype:trojan-activity; sid:100001510; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.133.1.242"; classtype:trojan-activity; sid:100001511; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.133.203.192"; classtype:trojan-activity; sid:100001512; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.135.134.228"; classtype:trojan-activity; sid:100001513; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.14.149.178"; classtype:trojan-activity; sid:100001514; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.14.149.182"; classtype:trojan-activity; sid:100001515; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.14.149.204"; classtype:trojan-activity; sid:100001516; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.141.84.182"; classtype:trojan-activity; sid:100001517; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.141.84.184"; classtype:trojan-activity; sid:100001518; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.118"; classtype:trojan-activity; sid:100001519; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.135"; classtype:trojan-activity; sid:100001520; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.139"; classtype:trojan-activity; sid:100001521; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.213"; classtype:trojan-activity; sid:100001522; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.242"; classtype:trojan-activity; sid:100001523; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.27"; classtype:trojan-activity; sid:100001524; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.148.10.47"; classtype:trojan-activity; sid:100001525; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.148.10.94"; classtype:trojan-activity; sid:100001526; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.176.109.205"; classtype:trojan-activity; sid:100001527; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.176.111.159"; classtype:trojan-activity; sid:100001528; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.176.111.35"; classtype:trojan-activity; sid:100001529; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.201.167.13"; classtype:trojan-activity; sid:100001530; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.22.209.58"; classtype:trojan-activity; sid:100001531; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.232.73.56"; classtype:trojan-activity; sid:100001532; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.248.194.48"; classtype:trojan-activity; sid:100001533; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.27.253.137"; classtype:trojan-activity; sid:100001534; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.51.104.59"; classtype:trojan-activity; sid:100001535; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.6.24.251"; classtype:trojan-activity; sid:100001536; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.85.90.131"; classtype:trojan-activity; sid:100001537; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.85.90.203"; classtype:trojan-activity; sid:100001538; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.89.26.245"; classtype:trojan-activity; sid:100001539; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.9.148.37"; classtype:trojan-activity; sid:100001540; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.92.108.35"; classtype:trojan-activity; sid:100001541; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.95.169.153"; classtype:trojan-activity; sid:100001542; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.114.28.132"; classtype:trojan-activity; sid:100001543; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.161.185.15"; classtype:trojan-activity; sid:100001544; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.172.75.231"; classtype:trojan-activity; sid:100001545; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.20.63.218"; classtype:trojan-activity; sid:100001546; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.214.27.4"; classtype:trojan-activity; sid:100001547; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.214.35.50"; classtype:trojan-activity; sid:100001548; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.236.65.83"; classtype:trojan-activity; sid:100001549; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.24.130.254"; classtype:trojan-activity; sid:100001550; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.241.120.165"; classtype:trojan-activity; sid:100001551; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.243.179.115"; classtype:trojan-activity; sid:100001552; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.249.33.79"; classtype:trojan-activity; sid:100001553; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.25.242.211"; classtype:trojan-activity; sid:100001554; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.42.118.86"; classtype:trojan-activity; sid:100001555; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.42.86.128"; classtype:trojan-activity; sid:100001556; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.97.76.242"; classtype:trojan-activity; sid:100001557; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.103.219.77"; classtype:trojan-activity; sid:100001558; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.145.152.26"; classtype:trojan-activity; sid:100001559; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.151.23.172"; classtype:trojan-activity; sid:100001560; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.157.97.71"; classtype:trojan-activity; sid:100001561; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.16.131.51"; classtype:trojan-activity; sid:100001562; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.21.202.98"; classtype:trojan-activity; sid:100001563; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.46.231.38"; classtype:trojan-activity; sid:100001564; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.142.162.113"; classtype:trojan-activity; sid:100001565; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.142.87.36"; classtype:trojan-activity; sid:100001566; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.143.43.93"; classtype:trojan-activity; sid:100001567; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.156.35.166"; classtype:trojan-activity; sid:100001568; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.158.201.200"; classtype:trojan-activity; sid:100001569; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.159.20.121"; classtype:trojan-activity; sid:100001570; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.159.21.3"; classtype:trojan-activity; sid:100001571; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.174.182.99"; classtype:trojan-activity; sid:100001572; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.213.170.49"; classtype:trojan-activity; sid:100001573; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.213.178.183"; classtype:trojan-activity; sid:100001574; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.213.179.129"; classtype:trojan-activity; sid:100001575; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.14.122.233"; classtype:trojan-activity; sid:100001576; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.188.62.111"; classtype:trojan-activity; sid:100001577; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.2.70.50"; classtype:trojan-activity; sid:100001578; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.53.146.179"; classtype:trojan-activity; sid:100001579; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.95.226.154"; classtype:trojan-activity; sid:100001580; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.115.174.102"; classtype:trojan-activity; sid:100001581; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.115.174.103"; classtype:trojan-activity; sid:100001582; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.115.174.106"; classtype:trojan-activity; sid:100001583; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.121.91.255"; classtype:trojan-activity; sid:100001584; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.247.83.66"; classtype:trojan-activity; sid:100001585; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.252.47.29"; classtype:trojan-activity; sid:100001586; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"54.36.114.136"; classtype:trojan-activity; sid:100001587; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"54.36.180.122"; classtype:trojan-activity; sid:100001588; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.114.246.26"; classtype:trojan-activity; sid:100001589; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.115.162.92"; classtype:trojan-activity; sid:100001590; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.115.174.4"; classtype:trojan-activity; sid:100001591; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.125.191.4"; classtype:trojan-activity; sid:100001592; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.126.247.118"; classtype:trojan-activity; sid:100001593; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.141.122.109"; classtype:trojan-activity; sid:100001594; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.142.166.120"; classtype:trojan-activity; sid:100001595; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.142.200.124"; classtype:trojan-activity; sid:100001596; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.218.67.253"; classtype:trojan-activity; sid:100001597; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.22.212.107"; classtype:trojan-activity; sid:100001598; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.226.129.29"; classtype:trojan-activity; sid:100001599; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.229.194.122"; classtype:trojan-activity; sid:100001600; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.230.89.42"; classtype:trojan-activity; sid:100001601; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.237.125.4"; classtype:trojan-activity; sid:100001602; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.238.42.192"; classtype:trojan-activity; sid:100001603; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.240.147.97"; classtype:trojan-activity; sid:100001604; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.241.78.55"; classtype:trojan-activity; sid:100001605; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.243.126.133"; classtype:trojan-activity; sid:100001606; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.72.165.153"; classtype:trojan-activity; sid:100001607; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.72.165.39"; classtype:trojan-activity; sid:100001608; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"216.183.54.196"; classtype:trojan-activity; sid:100001174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"216.36.12.98"; classtype:trojan-activity; sid:100001175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"217.11.75.162"; classtype:trojan-activity; sid:100001176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"217.12.209.82"; classtype:trojan-activity; sid:100001177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.12.181.110"; classtype:trojan-activity; sid:100001178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.2.40.34"; classtype:trojan-activity; sid:100001179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.234.165.18"; classtype:trojan-activity; sid:100001180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.238.246.3"; classtype:trojan-activity; sid:100001181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.255.226.166"; classtype:trojan-activity; sid:100001182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.32.118.1"; classtype:trojan-activity; sid:100001183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.35.207.119"; classtype:trojan-activity; sid:100001184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.35.227.133"; classtype:trojan-activity; sid:100001185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.35.68.35"; classtype:trojan-activity; sid:100001186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.35.81.81"; classtype:trojan-activity; sid:100001187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.56.93.129"; classtype:trojan-activity; sid:100001188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.59.116.203"; classtype:trojan-activity; sid:100001189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.79.103.159"; classtype:trojan-activity; sid:100001190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.93.102.63"; classtype:trojan-activity; sid:100001191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"218.93.102.75"; classtype:trojan-activity; sid:100001192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.155.234.33"; classtype:trojan-activity; sid:100001193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.155.29.165"; classtype:trojan-activity; sid:100001194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.155.64.104"; classtype:trojan-activity; sid:100001195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.157.139.165"; classtype:trojan-activity; sid:100001196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.241.6.180"; classtype:trojan-activity; sid:100001197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.1.148"; classtype:trojan-activity; sid:100001198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.1.84"; classtype:trojan-activity; sid:100001199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.163.7"; classtype:trojan-activity; sid:100001200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.171.144"; classtype:trojan-activity; sid:100001201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.245.63"; classtype:trojan-activity; sid:100001202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.68.5.140"; classtype:trojan-activity; sid:100001203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.69.71.186"; classtype:trojan-activity; sid:100001204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.80.217.209"; classtype:trojan-activity; sid:100001205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"219.85.145.194"; classtype:trojan-activity; sid:100001206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"21robo.com"; classtype:trojan-activity; sid:100001207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.118.168.155"; classtype:trojan-activity; sid:100001208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.126.237.74"; classtype:trojan-activity; sid:100001209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.200.22.163"; classtype:trojan-activity; sid:100001210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.81.44.181"; classtype:trojan-activity; sid:100001211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"220.90.159.188"; classtype:trojan-activity; sid:100001212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.0.133.84"; classtype:trojan-activity; sid:100001213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.124.78.15"; classtype:trojan-activity; sid:100001214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.157.191.178"; classtype:trojan-activity; sid:100001215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.160.136.213"; classtype:trojan-activity; sid:100001216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.201.54.97"; classtype:trojan-activity; sid:100001217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.202.232.230"; classtype:trojan-activity; sid:100001218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.214.130.147"; classtype:trojan-activity; sid:100001219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.214.251.109"; classtype:trojan-activity; sid:100001220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.116.167"; classtype:trojan-activity; sid:100001221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.172.207"; classtype:trojan-activity; sid:100001222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.184.31"; classtype:trojan-activity; sid:100001223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.252.64"; classtype:trojan-activity; sid:100001224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.215.8.64"; classtype:trojan-activity; sid:100001225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.232.183.167"; classtype:trojan-activity; sid:100001226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.235.137.36"; classtype:trojan-activity; sid:100001227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.3.112.125"; classtype:trojan-activity; sid:100001228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.3.43.223"; classtype:trojan-activity; sid:100001229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"221.3.68.16"; classtype:trojan-activity; sid:100001230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.108.17.64"; classtype:trojan-activity; sid:100001231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.118.248.149"; classtype:trojan-activity; sid:100001232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.119.65.145"; classtype:trojan-activity; sid:100001233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.132.125.138"; classtype:trojan-activity; sid:100001234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.133.103.120"; classtype:trojan-activity; sid:100001235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.135.9.5"; classtype:trojan-activity; sid:100001236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.137.133.125"; classtype:trojan-activity; sid:100001237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.137.139.86"; classtype:trojan-activity; sid:100001238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.137.73.214"; classtype:trojan-activity; sid:100001239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.140.17.245"; classtype:trojan-activity; sid:100001240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.142.210.144"; classtype:trojan-activity; sid:100001241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.185.116.233"; classtype:trojan-activity; sid:100001242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.186.20.19"; classtype:trojan-activity; sid:100001243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.187.9.178"; classtype:trojan-activity; sid:100001244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.211.72.66"; classtype:trojan-activity; sid:100001245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.236.85.220"; classtype:trojan-activity; sid:100001246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.238.230.7"; classtype:trojan-activity; sid:100001247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.239.83.232"; classtype:trojan-activity; sid:100001248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.248.64.253"; classtype:trojan-activity; sid:100001249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.92.9.126"; classtype:trojan-activity; sid:100001250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.95.190.20"; classtype:trojan-activity; sid:100001251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"222.99.171.192"; classtype:trojan-activity; sid:100001252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.13.87.209"; classtype:trojan-activity; sid:100001253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.131.201.82"; classtype:trojan-activity; sid:100001254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.166.117.210"; classtype:trojan-activity; sid:100001255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.167.118.17"; classtype:trojan-activity; sid:100001256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.212.234.84"; classtype:trojan-activity; sid:100001257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.212.5.29"; classtype:trojan-activity; sid:100001258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"223.212.73.175"; classtype:trojan-activity; sid:100001259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.115.118.232"; classtype:trojan-activity; sid:100001260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.125.186.135"; classtype:trojan-activity; sid:100001261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.126.120.25"; classtype:trojan-activity; sid:100001262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.24.213.121"; classtype:trojan-activity; sid:100001263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.243.149.13"; classtype:trojan-activity; sid:100001264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.243.21.167"; classtype:trojan-activity; sid:100001265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.95.122.24"; classtype:trojan-activity; sid:100001266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"23.95.89.21"; classtype:trojan-activity; sid:100001267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.103.74.180"; classtype:trojan-activity; sid:100001268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.11.141.134"; classtype:trojan-activity; sid:100001269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.119.158.74"; classtype:trojan-activity; sid:100001270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.137.147.95"; classtype:trojan-activity; sid:100001271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.137.233.132"; classtype:trojan-activity; sid:100001272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.158.25.98"; classtype:trojan-activity; sid:100001273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.176.206.12"; classtype:trojan-activity; sid:100001274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.184.1.41"; classtype:trojan-activity; sid:100001275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.192.191.109"; classtype:trojan-activity; sid:100001276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.225.114.161"; classtype:trojan-activity; sid:100001277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.227.190.78"; classtype:trojan-activity; sid:100001278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.35.245.52"; classtype:trojan-activity; sid:100001279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.39.181.18"; classtype:trojan-activity; sid:100001280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.39.34.242"; classtype:trojan-activity; sid:100001281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.42.229.143"; classtype:trojan-activity; sid:100001282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.45.4.1"; classtype:trojan-activity; sid:100001283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.51.91.113"; classtype:trojan-activity; sid:100001284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.53.163.10"; classtype:trojan-activity; sid:100001285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.53.163.9"; classtype:trojan-activity; sid:100001286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"24.89.140.190"; classtype:trojan-activity; sid:100001287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.1.245.16"; classtype:trojan-activity; sid:100001288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.1.245.7"; classtype:trojan-activity; sid:100001289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.105.106.201"; classtype:trojan-activity; sid:100001290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.105.152.107"; classtype:trojan-activity; sid:100001291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.116.84.57"; classtype:trojan-activity; sid:100001292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.117.105.125"; classtype:trojan-activity; sid:100001293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.14.211.219"; classtype:trojan-activity; sid:100001294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.14.81.201"; classtype:trojan-activity; sid:100001295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.141.218.17"; classtype:trojan-activity; sid:100001296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.147.29.52"; classtype:trojan-activity; sid:100001297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.147.40.128"; classtype:trojan-activity; sid:100001298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.184.251.135"; classtype:trojan-activity; sid:100001299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.193.217.210"; classtype:trojan-activity; sid:100001300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.194.192.66"; classtype:trojan-activity; sid:100001301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.197.23.215"; classtype:trojan-activity; sid:100001302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.199.232.65"; classtype:trojan-activity; sid:100001303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.199.34.48"; classtype:trojan-activity; sid:100001304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.200.110.211"; classtype:trojan-activity; sid:100001305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.200.32.146"; classtype:trojan-activity; sid:100001306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.201.183.149"; classtype:trojan-activity; sid:100001307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.202.182.201"; classtype:trojan-activity; sid:100001308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.102.12"; classtype:trojan-activity; sid:100001309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.116.86"; classtype:trojan-activity; sid:100001310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.165.138"; classtype:trojan-activity; sid:100001311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.185.42"; classtype:trojan-activity; sid:100001312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.255.42"; classtype:trojan-activity; sid:100001313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.28.115"; classtype:trojan-activity; sid:100001314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.4.188"; classtype:trojan-activity; sid:100001315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.47.104"; classtype:trojan-activity; sid:100001316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.68.144"; classtype:trojan-activity; sid:100001317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.87.75"; classtype:trojan-activity; sid:100001318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.203.94.134"; classtype:trojan-activity; sid:100001319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.204.253.74"; classtype:trojan-activity; sid:100001320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.205.178.110"; classtype:trojan-activity; sid:100001321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.206.136.101"; classtype:trojan-activity; sid:100001322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.206.154.122"; classtype:trojan-activity; sid:100001323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.206.80.209"; classtype:trojan-activity; sid:100001324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.119.27"; classtype:trojan-activity; sid:100001325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.237.105"; classtype:trojan-activity; sid:100001326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.247.130"; classtype:trojan-activity; sid:100001327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.25.59"; classtype:trojan-activity; sid:100001328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.208.34.2"; classtype:trojan-activity; sid:100001329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.209.231.15"; classtype:trojan-activity; sid:100001330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.21.151.205"; classtype:trojan-activity; sid:100001331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.107.125"; classtype:trojan-activity; sid:100001332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.234.28"; classtype:trojan-activity; sid:100001333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.236.134"; classtype:trojan-activity; sid:100001334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.32.122"; classtype:trojan-activity; sid:100001335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.210.63.243"; classtype:trojan-activity; sid:100001336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.104.201"; classtype:trojan-activity; sid:100001337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.109.105"; classtype:trojan-activity; sid:100001338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.110.189"; classtype:trojan-activity; sid:100001339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.175.208"; classtype:trojan-activity; sid:100001340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.255.202"; classtype:trojan-activity; sid:100001341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.66.112"; classtype:trojan-activity; sid:100001342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.213.84.74"; classtype:trojan-activity; sid:100001343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.214.37.129"; classtype:trojan-activity; sid:100001344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.139.242"; classtype:trojan-activity; sid:100001345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.190.172"; classtype:trojan-activity; sid:100001346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.212.209"; classtype:trojan-activity; sid:100001347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.253.149"; classtype:trojan-activity; sid:100001348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.71.243"; classtype:trojan-activity; sid:100001349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.215.98.242"; classtype:trojan-activity; sid:100001350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.128.156"; classtype:trojan-activity; sid:100001351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.144.66"; classtype:trojan-activity; sid:100001352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.225.28"; classtype:trojan-activity; sid:100001353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.227.95"; classtype:trojan-activity; sid:100001354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.216.234.98"; classtype:trojan-activity; sid:100001355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.217.191.58"; classtype:trojan-activity; sid:100001356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.218.248.121"; classtype:trojan-activity; sid:100001357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.132.71"; classtype:trojan-activity; sid:100001358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.151.83"; classtype:trojan-activity; sid:100001359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.160.112"; classtype:trojan-activity; sid:100001360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.176.72"; classtype:trojan-activity; sid:100001361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.219.83.244"; classtype:trojan-activity; sid:100001362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.220.20.66"; classtype:trojan-activity; sid:100001363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.220.249.0"; classtype:trojan-activity; sid:100001364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.220.85.168"; classtype:trojan-activity; sid:100001365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.221.239.223"; classtype:trojan-activity; sid:100001366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.222.241.223"; classtype:trojan-activity; sid:100001367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.222.76.80"; classtype:trojan-activity; sid:100001368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.223.242.164"; classtype:trojan-activity; sid:100001369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.129.198"; classtype:trojan-activity; sid:100001370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.154.13"; classtype:trojan-activity; sid:100001371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.171.36"; classtype:trojan-activity; sid:100001372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.212.124"; classtype:trojan-activity; sid:100001373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.35.58.5"; classtype:trojan-activity; sid:100001374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"27.6.255.101"; classtype:trojan-activity; sid:100001375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.0.98.131"; classtype:trojan-activity; sid:100001376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.11.51.57"; classtype:trojan-activity; sid:100001377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.13.23.180"; classtype:trojan-activity; sid:100001378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.124.130"; classtype:trojan-activity; sid:100001379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.146.199"; classtype:trojan-activity; sid:100001380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.179.83"; classtype:trojan-activity; sid:100001381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.184.59"; classtype:trojan-activity; sid:100001382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.191.243"; classtype:trojan-activity; sid:100001383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.194.67"; classtype:trojan-activity; sid:100001384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.216.132"; classtype:trojan-activity; sid:100001385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.219.28"; classtype:trojan-activity; sid:100001386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.24.115"; classtype:trojan-activity; sid:100001387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.30.65"; classtype:trojan-activity; sid:100001388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.63.203"; classtype:trojan-activity; sid:100001389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.65.233"; classtype:trojan-activity; sid:100001390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.79.66"; classtype:trojan-activity; sid:100001391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.168.94.16"; classtype:trojan-activity; sid:100001392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.179.201.26"; classtype:trojan-activity; sid:100001393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.195.84.250"; classtype:trojan-activity; sid:100001394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.210.20.138"; classtype:trojan-activity; sid:100001395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.210.20.177"; classtype:trojan-activity; sid:100001396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.210.20.69"; classtype:trojan-activity; sid:100001397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.28.7.159"; classtype:trojan-activity; sid:100001398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.30.119.23"; classtype:trojan-activity; sid:100001399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"31.32.120.79"; classtype:trojan-activity; sid:100001400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"32.208.157.193"; classtype:trojan-activity; sid:100001401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"34.122.44.188"; classtype:trojan-activity; sid:100001402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"35.184.169.169"; classtype:trojan-activity; sid:100001403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.108.231.218"; classtype:trojan-activity; sid:100001404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.248.83.98"; classtype:trojan-activity; sid:100001405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.249.49.142"; classtype:trojan-activity; sid:100001406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.250.203.246"; classtype:trojan-activity; sid:100001407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.251.157.225"; classtype:trojan-activity; sid:100001408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.251.18.18"; classtype:trojan-activity; sid:100001409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.251.51.244"; classtype:trojan-activity; sid:100001410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.255.90.219"; classtype:trojan-activity; sid:100001411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.33.160.167"; classtype:trojan-activity; sid:100001412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.34.150.236"; classtype:trojan-activity; sid:100001413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.66.105.159"; classtype:trojan-activity; sid:100001414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.66.133.125"; classtype:trojan-activity; sid:100001415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.66.139.36"; classtype:trojan-activity; sid:100001416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.67.152.161"; classtype:trojan-activity; sid:100001417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.89.18.133"; classtype:trojan-activity; sid:100001418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"36.91.89.187"; classtype:trojan-activity; sid:100001419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"360.lcy2zzx.pw"; classtype:trojan-activity; sid:100001420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"360down7.miiyun.cn"; classtype:trojan-activity; sid:100001421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.222.98.51"; classtype:trojan-activity; sid:100001422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.233.60.68"; classtype:trojan-activity; sid:100001423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.34.179.221"; classtype:trojan-activity; sid:100001424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.34.180.172"; classtype:trojan-activity; sid:100001425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.44.238.35"; classtype:trojan-activity; sid:100001426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.52.118.199"; classtype:trojan-activity; sid:100001427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"37.54.14.36"; classtype:trojan-activity; sid:100001428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.113.245.254"; classtype:trojan-activity; sid:100001429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.113.98.136"; classtype:trojan-activity; sid:100001430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.117.31.162"; classtype:trojan-activity; sid:100001431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.162.104.119"; classtype:trojan-activity; sid:100001432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.162.98.216"; classtype:trojan-activity; sid:100001433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.65.196.34"; classtype:trojan-activity; sid:100001434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.66.44.109"; classtype:trojan-activity; sid:100001435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.104.83"; classtype:trojan-activity; sid:100001436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.125.186"; classtype:trojan-activity; sid:100001437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.146.60"; classtype:trojan-activity; sid:100001438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.206.228"; classtype:trojan-activity; sid:100001439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.67.92.131"; classtype:trojan-activity; sid:100001440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.68.171.125"; classtype:trojan-activity; sid:100001441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.68.249.255"; classtype:trojan-activity; sid:100001442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.68.60.61"; classtype:trojan-activity; sid:100001443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.72.167.202"; classtype:trojan-activity; sid:100001444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.72.67.64"; classtype:trojan-activity; sid:100001445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.73.10.198"; classtype:trojan-activity; sid:100001446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.73.163.231"; classtype:trojan-activity; sid:100001447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.73.168.234"; classtype:trojan-activity; sid:100001448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.73.203.225"; classtype:trojan-activity; sid:100001449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.76.194.65"; classtype:trojan-activity; sid:100001450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.76.78.251"; classtype:trojan-activity; sid:100001451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.113.201"; classtype:trojan-activity; sid:100001452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.114.45"; classtype:trojan-activity; sid:100001453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.150.203"; classtype:trojan-activity; sid:100001454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.209.209"; classtype:trojan-activity; sid:100001455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.48.213"; classtype:trojan-activity; sid:100001456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.77.63.152"; classtype:trojan-activity; sid:100001457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.79.166.31"; classtype:trojan-activity; sid:100001458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.79.218.46"; classtype:trojan-activity; sid:100001459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.79.91.244"; classtype:trojan-activity; sid:100001460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.79.93.171"; classtype:trojan-activity; sid:100001461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.127.214"; classtype:trojan-activity; sid:100001462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.18.140"; classtype:trojan-activity; sid:100001463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.191.137"; classtype:trojan-activity; sid:100001464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.205.255"; classtype:trojan-activity; sid:100001465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.24.54"; classtype:trojan-activity; sid:100001466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.36.151"; classtype:trojan-activity; sid:100001467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.80.37.182"; classtype:trojan-activity; sid:100001468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.81.251.0"; classtype:trojan-activity; sid:100001469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.81.27.15"; classtype:trojan-activity; sid:100001470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.81.29.231"; classtype:trojan-activity; sid:100001471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.81.70.88"; classtype:trojan-activity; sid:100001472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.83.94.11"; classtype:trojan-activity; sid:100001473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.84.115.152"; classtype:trojan-activity; sid:100001474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.85.54.4"; classtype:trojan-activity; sid:100001475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.86.211.20"; classtype:trojan-activity; sid:100001476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.86.234.187"; classtype:trojan-activity; sid:100001477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.86.78.244"; classtype:trojan-activity; sid:100001478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.87.63.58"; classtype:trojan-activity; sid:100001479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.87.93.109"; classtype:trojan-activity; sid:100001480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.143.176"; classtype:trojan-activity; sid:100001481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.155.96"; classtype:trojan-activity; sid:100001482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.233.131"; classtype:trojan-activity; sid:100001483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.67.238"; classtype:trojan-activity; sid:100001484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.88.72.9"; classtype:trojan-activity; sid:100001485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.89.145.11"; classtype:trojan-activity; sid:100001486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.89.146.36"; classtype:trojan-activity; sid:100001487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.89.63.23"; classtype:trojan-activity; sid:100001488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.90.176.191"; classtype:trojan-activity; sid:100001489; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"39.90.86.212"; classtype:trojan-activity; sid:100001490; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"40.88.2.151"; classtype:trojan-activity; sid:100001491; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.139.209.46"; classtype:trojan-activity; sid:100001492; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.165.130.43"; classtype:trojan-activity; sid:100001493; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.193.192.100"; classtype:trojan-activity; sid:100001494; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.219.185.171"; classtype:trojan-activity; sid:100001495; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.226.60.115"; classtype:trojan-activity; sid:100001496; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.72.203.82"; classtype:trojan-activity; sid:100001497; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.76.157.2"; classtype:trojan-activity; sid:100001498; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.86.18.200"; classtype:trojan-activity; sid:100001499; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.86.5.164"; classtype:trojan-activity; sid:100001500; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"41.86.5.197"; classtype:trojan-activity; sid:100001501; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.202.101.118"; classtype:trojan-activity; sid:100001502; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.202.101.199"; classtype:trojan-activity; sid:100001503; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.224.51.229"; classtype:trojan-activity; sid:100001504; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.228.60.114"; classtype:trojan-activity; sid:100001505; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.229.173.80"; classtype:trojan-activity; sid:100001506; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.230.91.1"; classtype:trojan-activity; sid:100001507; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.231.208.64"; classtype:trojan-activity; sid:100001508; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.236.212.157"; classtype:trojan-activity; sid:100001509; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.56.15.227"; classtype:trojan-activity; sid:100001510; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"42.61.99.155"; classtype:trojan-activity; sid:100001511; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"43.230.207.204"; classtype:trojan-activity; sid:100001512; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"43.241.106.183"; classtype:trojan-activity; sid:100001513; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.133.1.242"; classtype:trojan-activity; sid:100001514; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.133.203.192"; classtype:trojan-activity; sid:100001515; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.135.134.228"; classtype:trojan-activity; sid:100001516; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.14.149.178"; classtype:trojan-activity; sid:100001517; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.14.149.182"; classtype:trojan-activity; sid:100001518; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.14.149.204"; classtype:trojan-activity; sid:100001519; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.141.84.184"; classtype:trojan-activity; sid:100001520; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.118"; classtype:trojan-activity; sid:100001521; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.135"; classtype:trojan-activity; sid:100001522; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.139"; classtype:trojan-activity; sid:100001523; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.213"; classtype:trojan-activity; sid:100001524; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.242"; classtype:trojan-activity; sid:100001525; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.144.225.27"; classtype:trojan-activity; sid:100001526; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.148.10.47"; classtype:trojan-activity; sid:100001527; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.148.10.94"; classtype:trojan-activity; sid:100001528; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.156.22.230"; classtype:trojan-activity; sid:100001529; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.176.109.205"; classtype:trojan-activity; sid:100001530; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.176.111.159"; classtype:trojan-activity; sid:100001531; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.176.111.35"; classtype:trojan-activity; sid:100001532; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.201.167.13"; classtype:trojan-activity; sid:100001533; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.22.209.58"; classtype:trojan-activity; sid:100001534; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.232.73.56"; classtype:trojan-activity; sid:100001535; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.248.194.48"; classtype:trojan-activity; sid:100001536; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.27.253.137"; classtype:trojan-activity; sid:100001537; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.51.104.59"; classtype:trojan-activity; sid:100001538; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.6.24.251"; classtype:trojan-activity; sid:100001539; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.85.90.131"; classtype:trojan-activity; sid:100001540; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.85.90.203"; classtype:trojan-activity; sid:100001541; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.89.26.245"; classtype:trojan-activity; sid:100001542; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.9.148.37"; classtype:trojan-activity; sid:100001543; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.92.108.35"; classtype:trojan-activity; sid:100001544; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"45.95.169.153"; classtype:trojan-activity; sid:100001545; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.114.28.132"; classtype:trojan-activity; sid:100001546; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.172.75.231"; classtype:trojan-activity; sid:100001547; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.20.63.218"; classtype:trojan-activity; sid:100001548; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.214.27.4"; classtype:trojan-activity; sid:100001549; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.214.35.50"; classtype:trojan-activity; sid:100001550; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.236.65.83"; classtype:trojan-activity; sid:100001551; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.24.130.254"; classtype:trojan-activity; sid:100001552; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.241.120.165"; classtype:trojan-activity; sid:100001553; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.243.179.115"; classtype:trojan-activity; sid:100001554; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.249.33.79"; classtype:trojan-activity; sid:100001555; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.25.242.211"; classtype:trojan-activity; sid:100001556; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.42.118.86"; classtype:trojan-activity; sid:100001557; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.42.86.128"; classtype:trojan-activity; sid:100001558; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"46.97.76.242"; classtype:trojan-activity; sid:100001559; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.103.219.77"; classtype:trojan-activity; sid:100001560; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.145.152.26"; classtype:trojan-activity; sid:100001561; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.151.23.172"; classtype:trojan-activity; sid:100001562; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.157.97.71"; classtype:trojan-activity; sid:100001563; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.16.131.51"; classtype:trojan-activity; sid:100001564; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.21.202.98"; classtype:trojan-activity; sid:100001565; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"47.46.231.38"; classtype:trojan-activity; sid:100001566; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.142.162.113"; classtype:trojan-activity; sid:100001567; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.142.87.36"; classtype:trojan-activity; sid:100001568; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.143.43.93"; classtype:trojan-activity; sid:100001569; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.156.35.166"; classtype:trojan-activity; sid:100001570; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.158.201.200"; classtype:trojan-activity; sid:100001571; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.159.20.121"; classtype:trojan-activity; sid:100001572; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.159.21.3"; classtype:trojan-activity; sid:100001573; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.174.182.99"; classtype:trojan-activity; sid:100001574; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.213.170.49"; classtype:trojan-activity; sid:100001575; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.213.178.183"; classtype:trojan-activity; sid:100001576; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"49.213.179.129"; classtype:trojan-activity; sid:100001577; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"4et3ja.am.files.1drv.com"; classtype:trojan-activity; sid:100001578; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.14.122.233"; classtype:trojan-activity; sid:100001579; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.188.62.111"; classtype:trojan-activity; sid:100001580; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.2.70.50"; classtype:trojan-activity; sid:100001581; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.53.146.179"; classtype:trojan-activity; sid:100001582; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"5.95.226.154"; classtype:trojan-activity; sid:100001583; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.115.174.102"; classtype:trojan-activity; sid:100001584; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.115.174.103"; classtype:trojan-activity; sid:100001585; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.115.174.106"; classtype:trojan-activity; sid:100001586; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.121.91.255"; classtype:trojan-activity; sid:100001587; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.247.83.66"; classtype:trojan-activity; sid:100001588; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"50.252.47.29"; classtype:trojan-activity; sid:100001589; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"54.36.114.136"; classtype:trojan-activity; sid:100001590; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"54.36.180.122"; classtype:trojan-activity; sid:100001591; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.114.246.26"; classtype:trojan-activity; sid:100001592; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.115.162.92"; classtype:trojan-activity; sid:100001593; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.115.174.4"; classtype:trojan-activity; sid:100001594; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.125.191.4"; classtype:trojan-activity; sid:100001595; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.126.247.118"; classtype:trojan-activity; sid:100001596; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.142.166.120"; classtype:trojan-activity; sid:100001597; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.142.200.124"; classtype:trojan-activity; sid:100001598; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.22.212.107"; classtype:trojan-activity; sid:100001599; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.226.129.29"; classtype:trojan-activity; sid:100001600; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.229.194.122"; classtype:trojan-activity; sid:100001601; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.230.89.42"; classtype:trojan-activity; sid:100001602; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.237.125.4"; classtype:trojan-activity; sid:100001603; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.238.42.192"; classtype:trojan-activity; sid:100001604; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.240.147.97"; classtype:trojan-activity; sid:100001605; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.241.78.55"; classtype:trojan-activity; sid:100001606; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.243.126.133"; classtype:trojan-activity; sid:100001607; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.72.165.153"; classtype:trojan-activity; sid:100001608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.76.151.51"; classtype:trojan-activity; sid:100001609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"58.97.206.33"; classtype:trojan-activity; sid:100001610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"59.0.211.161"; classtype:trojan-activity; sid:100001611; rev:1;) @@ -1622,30 +1622,30 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"59.151.246.125"; classtype:trojan-activity; sid:100001616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"59.173.193.208"; classtype:trojan-activity; sid:100001617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"59.23.114.97"; classtype:trojan-activity; sid:100001618; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"59.30.12.254"; classtype:trojan-activity; sid:100001619; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.13.61.12"; classtype:trojan-activity; sid:100001620; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.208.135.42"; classtype:trojan-activity; sid:100001621; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.209.122.57"; classtype:trojan-activity; sid:100001622; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.209.186.185"; classtype:trojan-activity; sid:100001623; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.209.216.23"; classtype:trojan-activity; sid:100001624; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.209.233.94"; classtype:trojan-activity; sid:100001625; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.211.6.112"; classtype:trojan-activity; sid:100001626; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.100.83"; classtype:trojan-activity; sid:100001627; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.111.39"; classtype:trojan-activity; sid:100001628; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.206.246"; classtype:trojan-activity; sid:100001629; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.218.31"; classtype:trojan-activity; sid:100001630; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.220.167"; classtype:trojan-activity; sid:100001631; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.254.178"; classtype:trojan-activity; sid:100001632; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.213.83.55"; classtype:trojan-activity; sid:100001633; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.215.195.111"; classtype:trojan-activity; sid:100001634; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.217.177.196"; classtype:trojan-activity; sid:100001635; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.217.86.208"; classtype:trojan-activity; sid:100001636; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.15.104"; classtype:trojan-activity; sid:100001637; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.4.72"; classtype:trojan-activity; sid:100001638; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.44.99"; classtype:trojan-activity; sid:100001639; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.51.127"; classtype:trojan-activity; sid:100001640; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.60.174"; classtype:trojan-activity; sid:100001641; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.8.81"; classtype:trojan-activity; sid:100001642; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"59.26.181.228"; classtype:trojan-activity; sid:100001619; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"59.30.12.254"; classtype:trojan-activity; sid:100001620; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.13.61.12"; classtype:trojan-activity; sid:100001621; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.208.135.42"; classtype:trojan-activity; sid:100001622; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.209.122.57"; classtype:trojan-activity; sid:100001623; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.209.186.185"; classtype:trojan-activity; sid:100001624; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.209.216.23"; classtype:trojan-activity; sid:100001625; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.209.233.94"; classtype:trojan-activity; sid:100001626; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.211.6.112"; classtype:trojan-activity; sid:100001627; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.100.83"; classtype:trojan-activity; sid:100001628; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.111.39"; classtype:trojan-activity; sid:100001629; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.206.246"; classtype:trojan-activity; sid:100001630; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.218.31"; classtype:trojan-activity; sid:100001631; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.220.167"; classtype:trojan-activity; sid:100001632; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.212.254.178"; classtype:trojan-activity; sid:100001633; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.213.83.55"; classtype:trojan-activity; sid:100001634; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.215.195.111"; classtype:trojan-activity; sid:100001635; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.217.177.196"; classtype:trojan-activity; sid:100001636; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.217.86.208"; classtype:trojan-activity; sid:100001637; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.15.104"; classtype:trojan-activity; sid:100001638; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.4.72"; classtype:trojan-activity; sid:100001639; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.44.99"; classtype:trojan-activity; sid:100001640; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.51.127"; classtype:trojan-activity; sid:100001641; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.253.60.174"; classtype:trojan-activity; sid:100001642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.7.10.121"; classtype:trojan-activity; sid:100001643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"60.7.8.43"; classtype:trojan-activity; sid:100001644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"61.164.96.98"; classtype:trojan-activity; sid:100001645; rev:1;) @@ -1676,928 +1676,928 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.141.73.58"; classtype:trojan-activity; sid:100001670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.219.131.205"; classtype:trojan-activity; sid:100001671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.219.143.46"; classtype:trojan-activity; sid:100001672; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.219.227.31"; classtype:trojan-activity; sid:100001673; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.31.126.33"; classtype:trojan-activity; sid:100001674; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.38.149.66"; classtype:trojan-activity; sid:100001675; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.38.222.98"; classtype:trojan-activity; sid:100001676; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.43.207.148"; classtype:trojan-activity; sid:100001677; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.90.165.236"; classtype:trojan-activity; sid:100001678; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"63.245.122.93"; classtype:trojan-activity; sid:100001679; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.125.128.196"; classtype:trojan-activity; sid:100001680; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.21.58.252"; classtype:trojan-activity; sid:100001681; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.26.155.131"; classtype:trojan-activity; sid:100001682; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.35.61.255"; classtype:trojan-activity; sid:100001683; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.229.214.115"; classtype:trojan-activity; sid:100001684; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.57.55.210"; classtype:trojan-activity; sid:100001685; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.74.7.197"; classtype:trojan-activity; sid:100001686; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.97.181.196"; classtype:trojan-activity; sid:100001687; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"67.245.151.203"; classtype:trojan-activity; sid:100001688; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"67.8.138.101"; classtype:trojan-activity; sid:100001689; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"67.83.49.234"; classtype:trojan-activity; sid:100001690; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"67.84.138.165"; classtype:trojan-activity; sid:100001691; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.148.103.248"; classtype:trojan-activity; sid:100001692; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.174.182.226"; classtype:trojan-activity; sid:100001693; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.175.107.153"; classtype:trojan-activity; sid:100001694; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.188.144.143"; classtype:trojan-activity; sid:100001695; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.204.88.29"; classtype:trojan-activity; sid:100001696; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.205.106.84"; classtype:trojan-activity; sid:100001697; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.205.119.241"; classtype:trojan-activity; sid:100001698; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.78.33.33"; classtype:trojan-activity; sid:100001699; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.115.37.205"; classtype:trojan-activity; sid:100001700; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.120.237.255"; classtype:trojan-activity; sid:100001701; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.123.245.151"; classtype:trojan-activity; sid:100001702; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.124.231.110"; classtype:trojan-activity; sid:100001703; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.127.214.47"; classtype:trojan-activity; sid:100001704; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.146.232.34"; classtype:trojan-activity; sid:100001705; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.165.173.49"; classtype:trojan-activity; sid:100001706; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.196.158.227"; classtype:trojan-activity; sid:100001707; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.222.157.166"; classtype:trojan-activity; sid:100001708; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.229.0.133"; classtype:trojan-activity; sid:100001709; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.63.73.234"; classtype:trojan-activity; sid:100001710; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.75.115.194"; classtype:trojan-activity; sid:100001711; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.75.227.186"; classtype:trojan-activity; sid:100001712; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.76.240.206"; classtype:trojan-activity; sid:100001713; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.115.31.30"; classtype:trojan-activity; sid:100001714; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.118.240.88"; classtype:trojan-activity; sid:100001715; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.167.10.180"; classtype:trojan-activity; sid:100001716; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.236.190.250"; classtype:trojan-activity; sid:100001717; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.25.5.105"; classtype:trojan-activity; sid:100001718; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.93.129.118"; classtype:trojan-activity; sid:100001719; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.127.148.69"; classtype:trojan-activity; sid:100001720; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.146.190.91"; classtype:trojan-activity; sid:100001721; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.204.63.239"; classtype:trojan-activity; sid:100001722; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.29.48.164"; classtype:trojan-activity; sid:100001723; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.34.191.213"; classtype:trojan-activity; sid:100001724; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.40.234.166"; classtype:trojan-activity; sid:100001725; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.43.106.142"; classtype:trojan-activity; sid:100001726; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.43.2.122"; classtype:trojan-activity; sid:100001727; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.43.235.106"; classtype:trojan-activity; sid:100001728; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.47.133.58"; classtype:trojan-activity; sid:100001729; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.71.60.69"; classtype:trojan-activity; sid:100001730; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.85.106.211"; classtype:trojan-activity; sid:100001731; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.17.22.30"; classtype:trojan-activity; sid:100001732; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.189.180.98"; classtype:trojan-activity; sid:100001733; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.189.200.62"; classtype:trojan-activity; sid:100001734; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.202.249.109"; classtype:trojan-activity; sid:100001735; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.214.69.226"; classtype:trojan-activity; sid:100001736; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.229.230.118"; classtype:trojan-activity; sid:100001737; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.31.40.122"; classtype:trojan-activity; sid:100001738; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"73.112.123.203"; classtype:trojan-activity; sid:100001739; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"73.204.216.103"; classtype:trojan-activity; sid:100001740; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"73.70.164.42"; classtype:trojan-activity; sid:100001741; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.101.1.159"; classtype:trojan-activity; sid:100001742; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.108.224.112"; classtype:trojan-activity; sid:100001743; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.119.195.101"; classtype:trojan-activity; sid:100001744; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.194.117.165"; classtype:trojan-activity; sid:100001745; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.195.115.176"; classtype:trojan-activity; sid:100001746; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.199.84.77"; classtype:trojan-activity; sid:100001747; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.64.139.223"; classtype:trojan-activity; sid:100001748; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.75.165.81"; classtype:trojan-activity; sid:100001749; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"75.127.141.52"; classtype:trojan-activity; sid:100001750; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"75.83.102.27"; classtype:trojan-activity; sid:100001751; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"75.99.213.61"; classtype:trojan-activity; sid:100001752; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.170.11.82"; classtype:trojan-activity; sid:100001753; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.178.22.145"; classtype:trojan-activity; sid:100001754; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.217.92.231"; classtype:trojan-activity; sid:100001755; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.250.199.133"; classtype:trojan-activity; sid:100001756; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.254.129.227"; classtype:trojan-activity; sid:100001757; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.84.134.33"; classtype:trojan-activity; sid:100001758; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.95.12.137"; classtype:trojan-activity; sid:100001759; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.111.182.31"; classtype:trojan-activity; sid:100001760; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.237.25.210"; classtype:trojan-activity; sid:100001761; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.71.50.153"; classtype:trojan-activity; sid:100001762; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.71.52.220"; classtype:trojan-activity; sid:100001763; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.89.203.238"; classtype:trojan-activity; sid:100001764; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77st.net"; classtype:trojan-activity; sid:100001765; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.145.224.45"; classtype:trojan-activity; sid:100001766; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.187.141.144"; classtype:trojan-activity; sid:100001767; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.187.240.125"; classtype:trojan-activity; sid:100001768; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.187.41.200"; classtype:trojan-activity; sid:100001769; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.188.106.235"; classtype:trojan-activity; sid:100001770; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.188.168.64"; classtype:trojan-activity; sid:100001771; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.188.188.141"; classtype:trojan-activity; sid:100001772; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.189.104.157"; classtype:trojan-activity; sid:100001773; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.189.176.163"; classtype:trojan-activity; sid:100001774; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.23.172.81"; classtype:trojan-activity; sid:100001775; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.8.225.77"; classtype:trojan-activity; sid:100001776; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.11.195.121"; classtype:trojan-activity; sid:100001777; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.130.253.13"; classtype:trojan-activity; sid:100001778; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.147.123.48"; classtype:trojan-activity; sid:100001779; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.167.189.236"; classtype:trojan-activity; sid:100001780; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.175.42.244"; classtype:trojan-activity; sid:100001781; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.21.84.63"; classtype:trojan-activity; sid:100001782; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.7.170.58"; classtype:trojan-activity; sid:100001783; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.79.58.94"; classtype:trojan-activity; sid:100001784; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.8.70.162"; classtype:trojan-activity; sid:100001785; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.9.88.185"; classtype:trojan-activity; sid:100001786; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.107.89.207"; classtype:trojan-activity; sid:100001787; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.19.101.218"; classtype:trojan-activity; sid:100001788; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.211.181.77"; classtype:trojan-activity; sid:100001789; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.217.12.7"; classtype:trojan-activity; sid:100001790; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.99.128.61"; classtype:trojan-activity; sid:100001791; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.136.146.213"; classtype:trojan-activity; sid:100001792; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.165.44.109"; classtype:trojan-activity; sid:100001793; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.191.40.58"; classtype:trojan-activity; sid:100001794; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.213.141.184"; classtype:trojan-activity; sid:100001795; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.215.199.29"; classtype:trojan-activity; sid:100001796; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.218.187.113"; classtype:trojan-activity; sid:100001797; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.218.195.216"; classtype:trojan-activity; sid:100001798; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.237.128.200"; classtype:trojan-activity; sid:100001799; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.244.219.41"; classtype:trojan-activity; sid:100001800; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.246.225.203"; classtype:trojan-activity; sid:100001801; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.92.36.96"; classtype:trojan-activity; sid:100001802; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.103.108.72"; classtype:trojan-activity; sid:100001803; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.135.196.130"; classtype:trojan-activity; sid:100001804; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.166.212.178"; classtype:trojan-activity; sid:100001805; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.166.85.112"; classtype:trojan-activity; sid:100001806; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.207.61.194"; classtype:trojan-activity; sid:100001807; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.209.250.155"; classtype:trojan-activity; sid:100001808; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.211.156.38"; classtype:trojan-activity; sid:100001809; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.59.31.181"; classtype:trojan-activity; sid:100001810; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.62.110.252"; classtype:trojan-activity; sid:100001811; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.62.53.77"; classtype:trojan-activity; sid:100001812; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.80.138.72"; classtype:trojan-activity; sid:100001813; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.80.139.92"; classtype:trojan-activity; sid:100001814; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.80.154.214"; classtype:trojan-activity; sid:100001815; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.80.187.109"; classtype:trojan-activity; sid:100001816; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.100.54"; classtype:trojan-activity; sid:100001817; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.106.65"; classtype:trojan-activity; sid:100001818; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.108.172"; classtype:trojan-activity; sid:100001819; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.131.158"; classtype:trojan-activity; sid:100001820; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.134.66"; classtype:trojan-activity; sid:100001821; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.19.42"; classtype:trojan-activity; sid:100001822; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.197.254"; classtype:trojan-activity; sid:100001823; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.215.149"; classtype:trojan-activity; sid:100001824; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.232.68"; classtype:trojan-activity; sid:100001825; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.234.195"; classtype:trojan-activity; sid:100001826; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.246.96"; classtype:trojan-activity; sid:100001827; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.28.57"; classtype:trojan-activity; sid:100001828; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.4.57"; classtype:trojan-activity; sid:100001829; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.55.84"; classtype:trojan-activity; sid:100001830; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.73.245"; classtype:trojan-activity; sid:100001831; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.98.51"; classtype:trojan-activity; sid:100001832; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.165.237.163"; classtype:trojan-activity; sid:100001833; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.234.147.99"; classtype:trojan-activity; sid:100001834; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.234.218.42"; classtype:trojan-activity; sid:100001835; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.242.253.154"; classtype:trojan-activity; sid:100001836; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.252.9.37"; classtype:trojan-activity; sid:100001837; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.210.219.213"; classtype:trojan-activity; sid:100001838; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.228.50.118"; classtype:trojan-activity; sid:100001839; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.228.95.204"; classtype:trojan-activity; sid:100001840; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.238.24.35"; classtype:trojan-activity; sid:100001841; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.247.83.74"; classtype:trojan-activity; sid:100001842; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.254.39.129"; classtype:trojan-activity; sid:100001843; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.33.111.227"; classtype:trojan-activity; sid:100001844; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.40.127.242"; classtype:trojan-activity; sid:100001845; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.42.20.217"; classtype:trojan-activity; sid:100001846; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com"; classtype:trojan-activity; sid:100001847; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.123.251"; classtype:trojan-activity; sid:100001848; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.135.187"; classtype:trojan-activity; sid:100001849; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.180.33"; classtype:trojan-activity; sid:100001850; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.208.25"; classtype:trojan-activity; sid:100001851; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.224.141"; classtype:trojan-activity; sid:100001852; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.241.2"; classtype:trojan-activity; sid:100001853; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.214.149.236"; classtype:trojan-activity; sid:100001854; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.241.39.182"; classtype:trojan-activity; sid:100001855; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.64.181.50"; classtype:trojan-activity; sid:100001856; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.74.215.180"; classtype:trojan-activity; sid:100001857; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.97.130.227"; classtype:trojan-activity; sid:100001858; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"86.35.43.220"; classtype:trojan-activity; sid:100001859; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"87.110.105.250"; classtype:trojan-activity; sid:100001860; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"87.172.19.130"; classtype:trojan-activity; sid:100001861; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"87.61.89.40"; classtype:trojan-activity; sid:100001862; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"87du.vip"; classtype:trojan-activity; sid:100001863; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.119.171.253"; classtype:trojan-activity; sid:100001864; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.2.208.71"; classtype:trojan-activity; sid:100001865; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.2.219.179"; classtype:trojan-activity; sid:100001866; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.218.17.149"; classtype:trojan-activity; sid:100001867; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.225.222.128"; classtype:trojan-activity; sid:100001868; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.247.96.19"; classtype:trojan-activity; sid:100001869; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.248.136.231"; classtype:trojan-activity; sid:100001870; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.248.51.139"; classtype:trojan-activity; sid:100001871; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.249.244.180"; classtype:trojan-activity; sid:100001872; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.250.204.12"; classtype:trojan-activity; sid:100001873; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.250.226.26"; classtype:trojan-activity; sid:100001874; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.250.254.90"; classtype:trojan-activity; sid:100001875; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.122.183.130"; classtype:trojan-activity; sid:100001876; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.136.197.170"; classtype:trojan-activity; sid:100001877; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.22.152.244"; classtype:trojan-activity; sid:100001878; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.29.213.33"; classtype:trojan-activity; sid:100001879; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.40.85.166"; classtype:trojan-activity; sid:100001880; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"8poieq.bn.files.1drv.com"; classtype:trojan-activity; sid:100001881; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"90.152.144.139"; classtype:trojan-activity; sid:100001882; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"90.63.176.144"; classtype:trojan-activity; sid:100001883; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.124.126.133"; classtype:trojan-activity; sid:100001884; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.132.197.39"; classtype:trojan-activity; sid:100001885; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.138.215.5"; classtype:trojan-activity; sid:100001886; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.177.139.132"; classtype:trojan-activity; sid:100001887; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.187.103.32"; classtype:trojan-activity; sid:100001888; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.212.150.241"; classtype:trojan-activity; sid:100001889; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.214.124.141"; classtype:trojan-activity; sid:100001890; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.217.104.185"; classtype:trojan-activity; sid:100001891; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.233.112.188"; classtype:trojan-activity; sid:100001892; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.234.60.94"; classtype:trojan-activity; sid:100001893; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.244.169.139"; classtype:trojan-activity; sid:100001894; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.92.16.244"; classtype:trojan-activity; sid:100001895; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.114.191.82"; classtype:trojan-activity; sid:100001896; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.241.78.114"; classtype:trojan-activity; sid:100001897; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.27.246.202"; classtype:trojan-activity; sid:100001898; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.83.62.139"; classtype:trojan-activity; sid:100001899; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.85.18.138"; classtype:trojan-activity; sid:100001900; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.157.63.244"; classtype:trojan-activity; sid:100001901; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.159.169.190"; classtype:trojan-activity; sid:100001902; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.21.224.154"; classtype:trojan-activity; sid:100001903; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.39.115.176"; classtype:trojan-activity; sid:100001904; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.39.79.41"; classtype:trojan-activity; sid:100001905; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.41.137.16"; classtype:trojan-activity; sid:100001906; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.41.182.249"; classtype:trojan-activity; sid:100001907; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.41.206.56"; classtype:trojan-activity; sid:100001908; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.57.43.233"; classtype:trojan-activity; sid:100001909; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.73.99.102"; classtype:trojan-activity; sid:100001910; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.136.69.199"; classtype:trojan-activity; sid:100001911; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.143.53.34"; classtype:trojan-activity; sid:100001912; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.154.17.170"; classtype:trojan-activity; sid:100001913; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.200.16.22"; classtype:trojan-activity; sid:100001914; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.224.83.208"; classtype:trojan-activity; sid:100001915; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.53.120.109"; classtype:trojan-activity; sid:100001916; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.85.0.3"; classtype:trojan-activity; sid:100001917; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.132.129.250"; classtype:trojan-activity; sid:100001918; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.133.158.20"; classtype:trojan-activity; sid:100001919; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.154.20.231"; classtype:trojan-activity; sid:100001920; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.158.19.130"; classtype:trojan-activity; sid:100001921; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.170.113.227"; classtype:trojan-activity; sid:100001922; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.170.113.52"; classtype:trojan-activity; sid:100001923; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.170.201.34"; classtype:trojan-activity; sid:100001924; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.60.146.134"; classtype:trojan-activity; sid:100001925; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.66.196.63"; classtype:trojan-activity; sid:100001926; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.9.120.40"; classtype:trojan-activity; sid:100001927; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"96.239.73.246"; classtype:trojan-activity; sid:100001928; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"96.47.147.169"; classtype:trojan-activity; sid:100001929; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"97.68.140.254"; classtype:trojan-activity; sid:100001930; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"97.96.199.75"; classtype:trojan-activity; sid:100001931; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.0.210.218"; classtype:trojan-activity; sid:100001932; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.0.239.142"; classtype:trojan-activity; sid:100001933; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.113.239.207"; classtype:trojan-activity; sid:100001934; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.116.72.119"; classtype:trojan-activity; sid:100001935; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.128.147.115"; classtype:trojan-activity; sid:100001936; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.178.207.205"; classtype:trojan-activity; sid:100001937; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.178.242.44"; classtype:trojan-activity; sid:100001938; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.30.24.54"; classtype:trojan-activity; sid:100001939; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"99.150.245.203"; classtype:trojan-activity; sid:100001940; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"99.33.195.164"; classtype:trojan-activity; sid:100001941; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aatreefelling.co.za"; classtype:trojan-activity; sid:100001942; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"abcd.bg"; classtype:trojan-activity; sid:100001943; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"abissnet.net"; classtype:trojan-activity; sid:100001944; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aboveandbelow.com.au"; classtype:trojan-activity; sid:100001945; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"absoftechworld.com"; classtype:trojan-activity; sid:100001946; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"abyssos.eu"; classtype:trojan-activity; sid:100001947; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"academyshademani.com"; classtype:trojan-activity; sid:100001948; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"acbick.com"; classtype:trojan-activity; sid:100001949; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"accesslinksgroup.com"; classtype:trojan-activity; sid:100001950; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aceeprc.com.aceeprc.com"; classtype:trojan-activity; sid:100001951; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"acellr.co.uk"; classtype:trojan-activity; sid:100001952; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"acteon.com.ar"; classtype:trojan-activity; sid:100001953; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"activecost.com.au"; classtype:trojan-activity; sid:100001954; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"addahealingmusic.com"; classtype:trojan-activity; sid:100001955; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"adithimedia.com"; classtype:trojan-activity; sid:100001956; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"adithimedia.memengers.com"; classtype:trojan-activity; sid:100001957; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"admin.erapor.smk-alasror.net"; classtype:trojan-activity; sid:100001958; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"admin.gentbcn.org"; classtype:trojan-activity; sid:100001959; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"admin.grandoceanvilla.com"; classtype:trojan-activity; sid:100001960; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"admission.kmctartskuttippuram.org"; classtype:trojan-activity; sid:100001961; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"adventureexplorer.in"; classtype:trojan-activity; sid:100001962; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aeropilates.cl"; classtype:trojan-activity; sid:100001963; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"afnan-amc.com"; classtype:trojan-activity; sid:100001964; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"afrimedspecialist.com"; classtype:trojan-activity; sid:100001965; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"agemn.co.za"; classtype:trojan-activity; sid:100001966; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"agenciadigitalwdys.com"; classtype:trojan-activity; sid:100001967; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"agenda.gmelloinformatica.com.br"; classtype:trojan-activity; sid:100001968; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"agile8studio.com"; classtype:trojan-activity; sid:100001969; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aiecons.com"; classtype:trojan-activity; sid:100001970; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aimnaukri.com"; classtype:trojan-activity; sid:100001971; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aiqtest.com"; classtype:trojan-activity; sid:100001972; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ajpharmaholding.com"; classtype:trojan-activity; sid:100001973; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"akdvidyalaya.com"; classtype:trojan-activity; sid:100001974; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"al-wahd.com"; classtype:trojan-activity; sid:100001975; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alasdemariposas.org"; classtype:trojan-activity; sid:100001976; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alberts.diamondrelationscrm.us"; classtype:trojan-activity; sid:100001977; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alemelektronik.com"; classtype:trojan-activity; sid:100001978; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alena1971.es"; classtype:trojan-activity; sid:100001979; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alexdubai.com.aldiabsteel.com"; classtype:trojan-activity; sid:100001980; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alka.institute"; classtype:trojan-activity; sid:100001981; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"allforcreative.com.au"; classtype:trojan-activity; sid:100001982; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alltheway.travel"; classtype:trojan-activity; sid:100001983; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alpaylar.com.tr"; classtype:trojan-activity; sid:100001984; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alumni.hildred.ibbott@46.249.33.79"; classtype:trojan-activity; sid:100001985; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"am-concepts.ca"; classtype:trojan-activity; sid:100001986; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amamontajes.com"; classtype:trojan-activity; sid:100001987; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amarresdeamorymaestroshechiceros.com"; classtype:trojan-activity; sid:100001988; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amarteargentina.com.ar"; classtype:trojan-activity; sid:100001989; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amos524.org"; classtype:trojan-activity; sid:100001990; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ams.alvinasschools.org.ng"; classtype:trojan-activity; sid:100001991; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anadelgbt.org"; classtype:trojan-activity; sid:100001992; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anantam.net.in"; classtype:trojan-activity; sid:100001993; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"andreelapeyre.com"; classtype:trojan-activity; sid:100001994; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"andremaraisbeleggings.co.za"; classtype:trojan-activity; sid:100001995; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"andreshconcejal.solucioneslink.com"; classtype:trojan-activity; sid:100001996; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"angelazgheibld.com"; classtype:trojan-activity; sid:100001997; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"angelsdetour.com"; classtype:trojan-activity; sid:100001998; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anhung1102.vn"; classtype:trojan-activity; sid:100001999; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anurontv.com"; classtype:trojan-activity; sid:100002000; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anysbergbiltong.co.za"; classtype:trojan-activity; sid:100002001; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apartamentoscitta.com"; classtype:trojan-activity; sid:100002002; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"api-ms.cobainaja.id"; classtype:trojan-activity; sid:100002003; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"api.cstdevs.com"; classtype:trojan-activity; sid:100002004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apoolcondo.com"; classtype:trojan-activity; sid:100002005; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"app.adsensearticle.com"; classtype:trojan-activity; sid:100002006; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"app.explicitsurveys.co.uk"; classtype:trojan-activity; sid:100002007; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"app.prerana.info"; classtype:trojan-activity; sid:100002008; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apps.saintsoporte.com"; classtype:trojan-activity; sid:100002009; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aps-scribe.com"; classtype:trojan-activity; sid:100002010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aps-sv.com"; classtype:trojan-activity; sid:100002011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"artedibujoyarquitectura.com"; classtype:trojan-activity; sid:100002012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"arwenyapi.com"; classtype:trojan-activity; sid:100002013; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ask-regard.call-save.biz"; classtype:trojan-activity; sid:100002014; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"atfile.com"; classtype:trojan-activity; sid:100002015; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"athenacapsg.com"; classtype:trojan-activity; sid:100002016; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"attach.66rpg.com"; classtype:trojan-activity; sid:100002017; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"atteuqpotentialunlimited.com"; classtype:trojan-activity; sid:100002018; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"augustair.com"; classtype:trojan-activity; sid:100002019; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"automaticrefreshments.com"; classtype:trojan-activity; sid:100002020; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"avadhanagames.com"; classtype:trojan-activity; sid:100002021; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ayahuascasp.com.br"; classtype:trojan-activity; sid:100002022; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ayamallah.com"; classtype:trojan-activity; sid:100002023; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aycconsultoriaempresarial.com"; classtype:trojan-activity; sid:100002024; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"azmeasurement.com"; classtype:trojan-activity; sid:100002025; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"azraktours.com"; classtype:trojan-activity; sid:100002026; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"b2b.toptanakaryakit.com.tr"; classtype:trojan-activity; sid:100002027; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"badeggdesign.com"; classtype:trojan-activity; sid:100002028; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"balealgodon.mx"; classtype:trojan-activity; sid:100002029; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bangkok-orchids.com"; classtype:trojan-activity; sid:100002030; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bangladeshunbound.com"; classtype:trojan-activity; sid:100002031; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bary.sz4h.com"; classtype:trojan-activity; sid:100002032; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bash.givemexyz.in"; classtype:trojan-activity; sid:100002033; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bausch.kr-atlas.monaxikoslykos@zytrox.tk"; classtype:trojan-activity; sid:100002034; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bbia.co.uk"; classtype:trojan-activity; sid:100002035; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bcmt.elin.co.za"; classtype:trojan-activity; sid:100002036; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bcrg.co.za"; classtype:trojan-activity; sid:100002037; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bdnextrend.xyz"; classtype:trojan-activity; sid:100002038; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beanx88.xyz"; classtype:trojan-activity; sid:100002039; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bearcatpumps.com.cn"; classtype:trojan-activity; sid:100002040; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beautincollagen.rs"; classtype:trojan-activity; sid:100002041; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beautymomentsgt.de"; classtype:trojan-activity; sid:100002042; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bekape.co.id"; classtype:trojan-activity; sid:100002043; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beor360.com"; classtype:trojan-activity; sid:100002044; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bespokeweddings.ie"; classtype:trojan-activity; sid:100002045; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestcarenepal.com"; classtype:trojan-activity; sid:100002046; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betone.co.kr"; classtype:trojan-activity; sid:100002047; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betycopaints.com"; classtype:trojan-activity; sid:100002048; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beveragesmiami.solucioneslink.com"; classtype:trojan-activity; sid:100002049; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bhavaniengineering.com"; classtype:trojan-activity; sid:100002050; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigmikesupplies.co.za"; classtype:trojan-activity; sid:100002051; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bilhen.co.za"; classtype:trojan-activity; sid:100002052; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"billing.rahitechnosoft.com"; classtype:trojan-activity; sid:100002053; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"binoy.stalphonsamissionva.org"; classtype:trojan-activity; sid:100002054; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"biometrico.gpotecnosystems.com"; classtype:trojan-activity; sid:100002055; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bioskey.com"; classtype:trojan-activity; sid:100002056; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"birdi.elin.co.za"; classtype:trojan-activity; sid:100002057; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"birminghamlink.org"; classtype:trojan-activity; sid:100002058; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bizztradingbot.nl"; classtype:trojan-activity; sid:100002059; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bl4n3.zadns.co.za"; classtype:trojan-activity; sid:100002060; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blog.callensaxen.com"; classtype:trojan-activity; sid:100002061; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blog.difusodesign.com"; classtype:trojan-activity; sid:100002062; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blog.oyinblogs.com"; classtype:trojan-activity; sid:100002063; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blog.takbelit.com"; classtype:trojan-activity; sid:100002064; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bmlifestyle.co.uk"; classtype:trojan-activity; sid:100002065; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boatpecas.com.br"; classtype:trojan-activity; sid:100002066; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodenstein.co.za"; classtype:trojan-activity; sid:100002067; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodylanguage.santulan.co.in"; classtype:trojan-activity; sid:100002068; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"booksearch.com"; classtype:trojan-activity; sid:100002069; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bophelocare.co.za"; classtype:trojan-activity; sid:100002070; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bounces.mi-fs.com"; classtype:trojan-activity; sid:100002071; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boutiqueofferte.com"; classtype:trojan-activity; sid:100002072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bpo.correct.go.th"; classtype:trojan-activity; sid:100002073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bradleyinstitute.co.za"; classtype:trojan-activity; sid:100002074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brandtrust.com.pk"; classtype:trojan-activity; sid:100002075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"braunfinancial.com.au"; classtype:trojan-activity; sid:100002076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brendanquine.com"; classtype:trojan-activity; sid:100002077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brideofmessiah.com"; classtype:trojan-activity; sid:100002078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brightaffiliatesales.org"; classtype:trojan-activity; sid:100002079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brightmega.com"; classtype:trojan-activity; sid:100002080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brightstarshop.com"; classtype:trojan-activity; sid:100002081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"browardinsurancemiami.solucioneslink.com"; classtype:trojan-activity; sid:100002082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bt2.elin.co.za"; classtype:trojan-activity; sid:100002083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"btdapi.robotake.com"; classtype:trojan-activity; sid:100002084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"buigiaphat.com.vn"; classtype:trojan-activity; sid:100002085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bulkyfoodja.com"; classtype:trojan-activity; sid:100002086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bullseyemedia.in"; classtype:trojan-activity; sid:100002087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"busandvanrentalmalaysia.com"; classtype:trojan-activity; sid:100002088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"buscascolegios.diit.cl"; classtype:trojan-activity; sid:100002089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"business.softberg.ro"; classtype:trojan-activity; sid:100002090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"business2.softberg.ro"; classtype:trojan-activity; sid:100002091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bydspa.cl"; classtype:trojan-activity; sid:100002092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"c.oooooooooo.ga"; classtype:trojan-activity; sid:100002093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"c0140529.ferozo.com"; classtype:trojan-activity; sid:100002094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"caballo.com.au"; classtype:trojan-activity; sid:100002095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cacaoprojects.com"; classtype:trojan-activity; sid:100002096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"calgaryautorepairservice.com"; classtype:trojan-activity; sid:100002097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"callbury.in"; classtype:trojan-activity; sid:100002098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"camminachetipassa.it"; classtype:trojan-activity; sid:100002099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"canadianwork.cc"; classtype:trojan-activity; sid:100002100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"capitalgroup-kw.com"; classtype:trojan-activity; sid:100002101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"capoeiraventrelivre.com"; classtype:trojan-activity; sid:100002102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carlsbadre.com"; classtype:trojan-activity; sid:100002103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"carsidecor.com"; classtype:trojan-activity; sid:100002104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cashyinvestment.org"; classtype:trojan-activity; sid:100002105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"catchperch.com"; classtype:trojan-activity; sid:100002106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"catchpoolshetlands.co.uk"; classtype:trojan-activity; sid:100002107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cazyacustomfurniture.com"; classtype:trojan-activity; sid:100002108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cbn.hypervoizd.com"; classtype:trojan-activity; sid:100002109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ccauthority.net"; classtype:trojan-activity; sid:100002110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cdaonline.com.ar"; classtype:trojan-activity; sid:100002111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cec.asso.ac-amiens.fr"; classtype:trojan-activity; sid:100002112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cecra.cl"; classtype:trojan-activity; sid:100002113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cellas.sk"; classtype:trojan-activity; sid:100002114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cendekiabinaaksara.com"; classtype:trojan-activity; sid:100002115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cfs5.tistory.com"; classtype:trojan-activity; sid:100002116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ch.rmu.ac.th"; classtype:trojan-activity; sid:100002117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"changematterscounselling.com"; classtype:trojan-activity; sid:100002118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"chardhamdodham.com"; classtype:trojan-activity; sid:100002119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"chezalice.co.za"; classtype:trojan-activity; sid:100002120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"childselect.com"; classtype:trojan-activity; sid:100002121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"chinhdropfile.myvnc.com"; classtype:trojan-activity; sid:100002122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"chinhdropfile80.myvnc.com"; classtype:trojan-activity; sid:100002123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cible-energy.com"; classtype:trojan-activity; sid:100002124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cifeer.net"; classtype:trojan-activity; sid:100002125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"citiconstructioncorp.com"; classtype:trojan-activity; sid:100002126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"citihits.lk"; classtype:trojan-activity; sid:100002127; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"citssolutions.co.za"; classtype:trojan-activity; sid:100002128; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"citycapproperty.ru"; classtype:trojan-activity; sid:100002129; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cityglobalgospel.com"; classtype:trojan-activity; sid:100002130; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"civi.istmejia.com"; classtype:trojan-activity; sid:100002131; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cleanbydesignllc.com"; classtype:trojan-activity; sid:100002132; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloud.fc.co.mz"; classtype:trojan-activity; sid:100002133; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cm-arquitetos.com"; classtype:trojan-activity; sid:100002134; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cnc.tacobelllover.tk"; classtype:trojan-activity; sid:100002135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"codsambal.com"; classtype:trojan-activity; sid:100002136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"colinde.pricesne.com"; classtype:trojan-activity; sid:100002137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"colorpak.pl"; classtype:trojan-activity; sid:100002138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"columbia.aula-web.net"; classtype:trojan-activity; sid:100002139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"community.reimclub.com"; classtype:trojan-activity; sid:100002140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"comosairdoburaco.com.br"; classtype:trojan-activity; sid:100002141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"competancy.indigoconsult.net"; classtype:trojan-activity; sid:100002142; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conceptimagine.ro"; classtype:trojan-activity; sid:100002143; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"config.cqhbkjzx.com"; classtype:trojan-activity; sid:100002144; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"connectcapital.com.br"; classtype:trojan-activity; sid:100002145; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"constructoralyon.com"; classtype:trojan-activity; sid:100002146; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"consulateins.solucioneslink.com"; classtype:trojan-activity; sid:100002147; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contributeindustry.com"; classtype:trojan-activity; sid:100002148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"copelandscapes.com"; classtype:trojan-activity; sid:100002149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"coulsongraphics.com"; classtype:trojan-activity; sid:100002150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"count.mail.163.com.impactmedfoundation.com"; classtype:trojan-activity; sid:100002151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"covid19.cyberschool.or.id"; classtype:trojan-activity; sid:100002152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cpanel.shivay.net"; classtype:trojan-activity; sid:100002153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cr-sq.com"; classtype:trojan-activity; sid:100002154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"craftech.nxtnet.ga"; classtype:trojan-activity; sid:100002155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"creationskateboards.com"; classtype:trojan-activity; sid:100002156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crecerco.com"; classtype:trojan-activity; sid:100002157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crittersbythebay.com"; classtype:trojan-activity; sid:100002158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crm.notariavieitoyvelamazan.com"; classtype:trojan-activity; sid:100002159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crmfarko.manivelasst.com"; classtype:trojan-activity; sid:100002160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crmroche.manivelasst.com"; classtype:trojan-activity; sid:100002161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crscorretordeimoveis.com.br"; classtype:trojan-activity; sid:100002162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cse-engineer.com"; classtype:trojan-activity; sid:100002163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"csnserver.com"; classtype:trojan-activity; sid:100002164; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cubescargoexpress.com"; classtype:trojan-activity; sid:100002165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"curasoles.co.za"; classtype:trojan-activity; sid:100002166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"currantmedia.com"; classtype:trojan-activity; sid:100002167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cwa.mx"; classtype:trojan-activity; sid:100002168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cyclomove.com"; classtype:trojan-activity; sid:100002169; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cynkon.kairoscs.net"; classtype:trojan-activity; sid:100002170; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"czsl.91756.cn"; classtype:trojan-activity; sid:100002171; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"d.powerofwish.com"; classtype:trojan-activity; sid:100002172; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"d9.99ddd.com"; classtype:trojan-activity; sid:100002173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"da.alibuf.com"; classtype:trojan-activity; sid:100002174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"danaevara.com"; classtype:trojan-activity; sid:100002175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dartoonpictures.com"; classtype:trojan-activity; sid:100002176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"data.cdevelop.org"; classtype:trojan-activity; sid:100002177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"data.over-blog-kiwi.com"; classtype:trojan-activity; sid:100002178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"datapolish.com"; classtype:trojan-activity; sid:100002179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dating.khokhas.co.za"; classtype:trojan-activity; sid:100002180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"datsom.vn"; classtype:trojan-activity; sid:100002181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"davethompson.me.uk"; classtype:trojan-activity; sid:100002182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"davidmcguinness.info"; classtype:trojan-activity; sid:100002183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dayspringdaisies.com"; classtype:trojan-activity; sid:100002184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dd.qiyuea.cn"; classtype:trojan-activity; sid:100002185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ddns.cyberium.cc"; classtype:trojan-activity; sid:100002186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"de.gsearch.com.de"; classtype:trojan-activity; sid:100002187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"decifrar.com.br"; classtype:trojan-activity; sid:100002188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"deigratia2.elin.co.za"; classtype:trojan-activity; sid:100002189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dekovizyon.com"; classtype:trojan-activity; sid:100002190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"demo-cliente.mindcreative.com.br"; classtype:trojan-activity; sid:100002191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"demo.glassforcars.com.au"; classtype:trojan-activity; sid:100002192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"demo6.hiites.com"; classtype:trojan-activity; sid:100002193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dent-estet.com"; classtype:trojan-activity; sid:100002194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dental.xiaoxiao.media"; classtype:trojan-activity; sid:100002195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dentalalliance.se"; classtype:trojan-activity; sid:100002196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"desertlandtrd.com"; classtype:trojan-activity; sid:100002197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"designerliving.co.za"; classtype:trojan-activity; sid:100002198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"despertaresi.com.br"; classtype:trojan-activity; sid:100002199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"destinymc.co.za"; classtype:trojan-activity; sid:100002200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"detorre.es"; classtype:trojan-activity; sid:100002201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dev.sebpo.net"; classtype:trojan-activity; sid:100002202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dev.watch-store.eu"; classtype:trojan-activity; sid:100002203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dezcom.com"; classtype:trojan-activity; sid:100002204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dfcf.91756.cn"; classtype:trojan-activity; sid:100002205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"diamantenegro.mi-fs.com"; classtype:trojan-activity; sid:100002206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dienmayminhhung.com"; classtype:trojan-activity; sid:100002207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"digilib.dianhusada.ac.id"; classtype:trojan-activity; sid:100002208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"digisails.org"; classtype:trojan-activity; sid:100002209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"disinfection-cleaning.co.za"; classtype:trojan-activity; sid:100002210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"djking.f3322.net"; classtype:trojan-activity; sid:100002211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.1003b.56a.com"; classtype:trojan-activity; sid:100002212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.198424.com"; classtype:trojan-activity; sid:100002213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.installcdn-aws.com"; classtype:trojan-activity; sid:100002214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.packetstormsecurity.net"; classtype:trojan-activity; sid:100002215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.rina-roleplay.com"; classtype:trojan-activity; sid:100002216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dnn.alibuf.com"; classtype:trojan-activity; sid:100002217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dns.alibuf.com"; classtype:trojan-activity; sid:100002218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dockerupdate.anondns.net"; classtype:trojan-activity; sid:100002219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"docman.orientalservices.in"; classtype:trojan-activity; sid:100002220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dodsonimaging.com"; classtype:trojan-activity; sid:100002221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"doitunlimited.com"; classtype:trojan-activity; sid:100002222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dokan.blueberrytec.com"; classtype:trojan-activity; sid:100002223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dom-chel74.ru"; classtype:trojan-activity; sid:100002224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dom.daf.free.fr"; classtype:trojan-activity; sid:100002225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"doncedyhall.com"; classtype:trojan-activity; sid:100002226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"donghobinhminh.com"; classtype:trojan-activity; sid:100002227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dongphuctop.com"; classtype:trojan-activity; sid:100002228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"donwnloasecury.ath.cx"; classtype:trojan-activity; sid:100002229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dosame.com"; classtype:trojan-activity; sid:100002230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dosman.pl"; classtype:trojan-activity; sid:100002231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dovberger.com"; classtype:trojan-activity; sid:100002232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"down.pcclear.com"; classtype:trojan-activity; sid:100002233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"down.webbora.com"; classtype:trojan-activity; sid:100002234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"down1.arpun.com"; classtype:trojan-activity; sid:100002235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.caihong.com"; classtype:trojan-activity; sid:100002236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.doumaibiji.cn"; classtype:trojan-activity; sid:100002237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.exrnybuf.cn"; classtype:trojan-activity; sid:100002238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.kaobeitu.com"; classtype:trojan-activity; sid:100002239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.pdf00.cn"; classtype:trojan-activity; sid:100002240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.rising.com.cn"; classtype:trojan-activity; sid:100002241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.skycn.com"; classtype:trojan-activity; sid:100002242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.zjsyawqj.cn"; classtype:trojan-activity; sid:100002243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dragonsknot.com"; classtype:trojan-activity; sid:100002244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"drbaby.com.sa"; classtype:trojan-activity; sid:100002245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dream.pics"; classtype:trojan-activity; sid:100002246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"drgroup.co.za"; classtype:trojan-activity; sid:100002247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"drools-moved.46999.n3.nabble.com"; classtype:trojan-activity; sid:100002248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"drsha.innovativesolutions.mobi"; classtype:trojan-activity; sid:100002249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dsenterprize.co.za"; classtype:trojan-activity; sid:100002250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dsspainting.com"; classtype:trojan-activity; sid:100002251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"du-wizards.com"; classtype:trojan-activity; sid:100002252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"duque.guantanameratravel.com"; classtype:trojan-activity; sid:100002253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dutapp.wisolve.co.za"; classtype:trojan-activity; sid:100002254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"duvalcharter.dekitout.com"; classtype:trojan-activity; sid:100002255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dw2.co.id"; classtype:trojan-activity; sid:100002256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dx.qqyewu.com"; classtype:trojan-activity; sid:100002257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dzinestudio87.co.uk"; classtype:trojan-activity; sid:100002258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"e-commerce.saleensuporte.com.br"; classtype:trojan-activity; sid:100002259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"e.sldov.ru"; classtype:trojan-activity; sid:100002260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eandgdesign.com.ng"; classtype:trojan-activity; sid:100002261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eastsheen-glaziers.co.uk"; classtype:trojan-activity; sid:100002262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ebruyatkin.com"; classtype:trojan-activity; sid:100002263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eedo.ee"; classtype:trojan-activity; sid:100002264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"efficientegroup.com"; classtype:trojan-activity; sid:100002265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"elbauldenora.com"; classtype:trojan-activity; sid:100002266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"emaids.co.za"; classtype:trojan-activity; sid:100002267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"emaz.pk"; classtype:trojan-activity; sid:100002268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"en.baoend.com"; classtype:trojan-activity; sid:100002269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"enc-tech.com"; classtype:trojan-activity; sid:100002270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"endurotanzania.co.tz"; classtype:trojan-activity; sid:100002271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ennovate.elin.co.za"; classtype:trojan-activity; sid:100002272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"equimination.ee"; classtype:trojan-activity; sid:100002273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"erp.nanotechproautocare.com"; classtype:trojan-activity; sid:100002274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"erp.zilymax.com"; classtype:trojan-activity; sid:100002275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"escola.probommar.org.br"; classtype:trojan-activity; sid:100002276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"esnconsultants.com"; classtype:trojan-activity; sid:100002277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"esrhf04.top"; classtype:trojan-activity; sid:100002278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"essentia.org.br"; classtype:trojan-activity; sid:100002279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ethereality.info"; classtype:trojan-activity; sid:100002280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eubanks7.com"; classtype:trojan-activity; sid:100002281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"europeanzonexxi.com"; classtype:trojan-activity; sid:100002282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"exilum.com"; classtype:trojan-activity; sid:100002283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"exitoalfaomega.co"; classtype:trojan-activity; sid:100002284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"extrovertoffers.com"; classtype:trojan-activity; sid:100002285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"f1sol.com"; classtype:trojan-activity; sid:100002286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"familydentist.site"; classtype:trojan-activity; sid:100002287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"faveraprojects.com"; classtype:trojan-activity; sid:100002288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fc.co.mz"; classtype:trojan-activity; sid:100002289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"felicienne.nl"; classtype:trojan-activity; sid:100002290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"files.martellexpress.us"; classtype:trojan-activity; sid:100002291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"files6.uludagbilisim.com"; classtype:trojan-activity; sid:100002292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"final.makkahkmcc.com"; classtype:trojan-activity; sid:100002293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fineartgallerym.com"; classtype:trojan-activity; sid:100002294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fisconline.bar"; classtype:trojan-activity; sid:100002295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fisconline.casa"; classtype:trojan-activity; sid:100002296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fix-america-now.org"; classtype:trojan-activity; sid:100002297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fixauto.illumetechnology.com"; classtype:trojan-activity; sid:100002298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fixturegovernment.com"; classtype:trojan-activity; sid:100002299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fkd.derpcity.ru"; classtype:trojan-activity; sid:100002300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flexypay.dsquaregroup.com"; classtype:trojan-activity; sid:100002301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flintspin.com"; classtype:trojan-activity; sid:100002302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flyingbuddhadesign.com"; classtype:trojan-activity; sid:100002303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fmjplastering.co.uk"; classtype:trojan-activity; sid:100002304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"follower.instantcashback.in"; classtype:trojan-activity; sid:100002305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foothills.com.br"; classtype:trojan-activity; sid:100002306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"footweardirect.elin.co.za"; classtype:trojan-activity; sid:100002307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"forum.mdb.nu"; classtype:trojan-activity; sid:100002308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fotoobjetivo.com"; classtype:trojan-activity; sid:100002309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foundationrepairhoustontx.net"; classtype:trojan-activity; sid:100002310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foxeps.com.br"; classtype:trojan-activity; sid:100002311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freecnetdownload.com"; classtype:trojan-activity; sid:100002312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freisites.com.br"; classtype:trojan-activity; sid:100002313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ftp.n3twork30cm.ml"; classtype:trojan-activity; sid:100002314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fullelectronica.com.ar"; classtype:trojan-activity; sid:100002315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funletters.net"; classtype:trojan-activity; sid:100002316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fusionfiresolutions.com"; classtype:trojan-activity; sid:100002317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"futbolpr.com"; classtype:trojan-activity; sid:100002318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"futuregraphics.com.ar"; classtype:trojan-activity; sid:100002319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"g.pinmonkey.xyz"; classtype:trojan-activity; sid:100002320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gaditastour.com"; classtype:trojan-activity; sid:100002321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gametwogame.com"; classtype:trojan-activity; sid:100002322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"garciadogshow.com"; classtype:trojan-activity; sid:100002323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"garenanow.myvnc.com"; classtype:trojan-activity; sid:100002324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"garenanow4.myvnc.com"; classtype:trojan-activity; sid:100002325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gastoudergonny.nl"; classtype:trojan-activity; sid:100002326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gbbulls.co.uk"; classtype:trojan-activity; sid:100002327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gcpc.co.id.chronoscurtain.com"; classtype:trojan-activity; sid:100002328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"generaldeviales.com"; classtype:trojan-activity; sid:100002329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gfmodd1.webselffiles01.com"; classtype:trojan-activity; sid:100002330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gfold1.webselffiles01.com"; classtype:trojan-activity; sid:100002331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ghettohub.co.za"; classtype:trojan-activity; sid:100002332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ghislain.dartois.pagesperso-orange.fr"; classtype:trojan-activity; sid:100002333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"giadungg7.com"; classtype:trojan-activity; sid:100002334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"giddos.ga"; classtype:trojan-activity; sid:100002335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"giteletropical.com"; classtype:trojan-activity; sid:100002336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"glowinmedia.co.ke"; classtype:trojan-activity; sid:100002337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gmtransformationacademy.com"; classtype:trojan-activity; sid:100002338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gmvadmission.org"; classtype:trojan-activity; sid:100002339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gnimelf.net"; classtype:trojan-activity; sid:100002340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gnscrew.ro"; classtype:trojan-activity; sid:100002341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gold.investforex.id"; classtype:trojan-activity; sid:100002342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldcake.co.id"; classtype:trojan-activity; sid:100002343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldcoastoffice365.com"; classtype:trojan-activity; sid:100002344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldcoastoffice365.com.au"; classtype:trojan-activity; sid:100002345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"golden-memories-funerals.yourpageserver.com"; classtype:trojan-activity; sid:100002346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldenasiacapital.com"; classtype:trojan-activity; sid:100002347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gpotecnosystems.com"; classtype:trojan-activity; sid:100002348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gracejukes.com"; classtype:trojan-activity; sid:100002349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"grupoinmare.com"; classtype:trojan-activity; sid:100002350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gs.monerorx.com"; classtype:trojan-activity; sid:100002351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"guide-to-cell-phones.com"; classtype:trojan-activity; sid:100002352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gulfac-house.com"; classtype:trojan-activity; sid:100002353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gvpcdpgc.edu.in"; classtype:trojan-activity; sid:100002354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"habbotips.free.fr"; classtype:trojan-activity; sid:100002355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hagebakken.no"; classtype:trojan-activity; sid:100002356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hamptonpartyoffive.com"; classtype:trojan-activity; sid:100002357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hashmati.com"; classtype:trojan-activity; sid:100002358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hassanproduct.com"; classtype:trojan-activity; sid:100002359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hchfug.org"; classtype:trojan-activity; sid:100002360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hd11315.com"; classtype:trojan-activity; sid:100002361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hdkamera2003.hu"; classtype:trojan-activity; sid:100002362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hds.sz4h.com"; classtype:trojan-activity; sid:100002363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"heavymaq.cl"; classtype:trojan-activity; sid:100002364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hellogorgeous.com.au"; classtype:trojan-activity; sid:100002365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"help.hizuko.com"; classtype:trojan-activity; sid:100002366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"herchinfitout.com.sg"; classtype:trojan-activity; sid:100002367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hhaward.org"; classtype:trojan-activity; sid:100002368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"highlandroadcoc.com"; classtype:trojan-activity; sid:100002369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"highlandslasvegas.atakdev.com"; classtype:trojan-activity; sid:100002370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hindi.factsriver.com"; classtype:trojan-activity; sid:100002371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hiptool.net"; classtype:trojan-activity; sid:100002372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hitpe.com"; classtype:trojan-activity; sid:100002373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hitstation.nl"; classtype:trojan-activity; sid:100002374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hmpmall.co.kr"; classtype:trojan-activity; sid:100002375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hoagietesting10.com"; classtype:trojan-activity; sid:100002376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hoayeuthuong-my.sharepoint.com"; classtype:trojan-activity; sid:100002377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"homefindersolutions.com"; classtype:trojan-activity; sid:100002378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hongluosi.com"; classtype:trojan-activity; sid:100002379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hookedupboatclub.com"; classtype:trojan-activity; sid:100002380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hostingparacolombia.com"; classtype:trojan-activity; sid:100002381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hostzaa.com"; classtype:trojan-activity; sid:100002382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"houstonshutters.site"; classtype:trojan-activity; sid:100002383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hr2019.vrcom7.com"; classtype:trojan-activity; sid:100002384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hseda.com"; classtype:trojan-activity; sid:100002385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hsmwebapp.com"; classtype:trojan-activity; sid:100002386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"htownbars.com"; classtype:trojan-activity; sid:100002387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hubtech.co.za"; classtype:trojan-activity; sid:100002388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"huellacero.cl"; classtype:trojan-activity; sid:100002389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hunggiang.vn"; classtype:trojan-activity; sid:100002390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"husamiyahschool.com"; classtype:trojan-activity; sid:100002391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iabmixx2020.rayadigital.online"; classtype:trojan-activity; sid:100002392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iam313.com"; classtype:trojan-activity; sid:100002393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"icon.shatangmu.cn"; classtype:trojan-activity; sid:100002394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idea-secure-login.com"; classtype:trojan-activity; sid:100002395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idilsoft.com"; classtype:trojan-activity; sid:100002396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idj.no"; classtype:trojan-activity; sid:100002397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idvindia.com"; classtype:trojan-activity; sid:100002398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ieclb.com.br"; classtype:trojan-activity; sid:100002399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ikexpert.com"; classtype:trojan-activity; sid:100002400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ilrafrica.com"; classtype:trojan-activity; sid:100002401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"images.jermiau.com"; classtype:trojan-activity; sid:100002402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"imbueautoworx.co.za"; classtype:trojan-activity; sid:100002403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"in-tune2016.com"; classtype:trojan-activity; sid:100002404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"incrediblepixels.com"; classtype:trojan-activity; sid:100002405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"incredicole.com"; classtype:trojan-activity; sid:100002406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"indrasbikaner.com"; classtype:trojan-activity; sid:100002407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"infair.vn"; classtype:trojan-activity; sid:100002408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"infovator.com"; classtype:trojan-activity; sid:100002409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"initialnetworks.com"; classtype:trojan-activity; sid:100002410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inodesthetotaldesigners.com"; classtype:trojan-activity; sid:100002411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inrajahmundry.co.in"; classtype:trojan-activity; sid:100002412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"instantindialoan.com"; classtype:trojan-activity; sid:100002413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"intellectsmart.in"; classtype:trojan-activity; sid:100002414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"intersel-idf.org"; classtype:trojan-activity; sid:100002415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"intuitiveideas.com.my"; classtype:trojan-activity; sid:100002416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inversiones.arrayanfinanciero.cl"; classtype:trojan-activity; sid:100002417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"invest.xpcorporative.com.br"; classtype:trojan-activity; sid:100002418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ipmes.ma"; classtype:trojan-activity; sid:100002419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iremart.es"; classtype:trojan-activity; sid:100002420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iris101.co.uk"; classtype:trojan-activity; sid:100002421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"isaac.mikhailmotoringschool.com"; classtype:trojan-activity; sid:100002422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iscamenabe.com"; classtype:trojan-activity; sid:100002423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"isiphephelocon.co.za"; classtype:trojan-activity; sid:100002424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ismf.com.ng"; classtype:trojan-activity; sid:100002425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iso-dubai.net"; classtype:trojan-activity; sid:100002426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"israrulhaq.me"; classtype:trojan-activity; sid:100002427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"isrorg.com"; classtype:trojan-activity; sid:100002428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"isso.ps"; classtype:trojan-activity; sid:100002429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ist-security.com"; classtype:trojan-activity; sid:100002430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"it123.ru"; classtype:trojan-activity; sid:100002431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"italiandirezione.casa"; classtype:trojan-activity; sid:100002432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"itc-demo.softgig.co.ke"; classtype:trojan-activity; sid:100002433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"itmotasaciones.com"; classtype:trojan-activity; sid:100002434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jamiekaylive.com"; classtype:trojan-activity; sid:100002435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jansen-heesch.nl"; classtype:trojan-activity; sid:100002436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jathra.co.uk"; classtype:trojan-activity; sid:100002437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jay.diamondrelationscrm.us"; classtype:trojan-activity; sid:100002438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jebs.net.au"; classtype:trojan-activity; sid:100002439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jeffdahlke.com"; classtype:trojan-activity; sid:100002440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jhayesconsulting.com"; classtype:trojan-activity; sid:100002441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jiaoyuzixun.cn"; classtype:trojan-activity; sid:100002442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jing-da.com.tw"; classtype:trojan-activity; sid:100002443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jmtc.91756.cn"; classtype:trojan-activity; sid:100002444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jnanbharati.com"; classtype:trojan-activity; sid:100002445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jobs.thebeessolution.com"; classtype:trojan-activity; sid:100002446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joelbonissilver.com"; classtype:trojan-activity; sid:100002447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"join.cl8movement.co.za"; classtype:trojan-activity; sid:100002448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"josegene.com"; classtype:trojan-activity; sid:100002449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jpwoodfordco.com"; classtype:trojan-activity; sid:100002450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jumpmanualjacobhiller.com"; classtype:trojan-activity; sid:100002451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jupiter.toxsl.in"; classtype:trojan-activity; sid:100002452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"justinscott.com.au"; classtype:trojan-activity; sid:100002453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kadigital.co.uk"; classtype:trojan-activity; sid:100002454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kaizenjanitorial.com"; classtype:trojan-activity; sid:100002455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kalawatihomes.com"; classtype:trojan-activity; sid:100002456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kalogirosfinance.com"; classtype:trojan-activity; sid:100002457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kaptaanchapal.com"; classtype:trojan-activity; sid:100002458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"karer.by"; classtype:trojan-activity; sid:100002459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"katanvetov.co.il"; classtype:trojan-activity; sid:100002460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"katelynn9506a.ru.com"; classtype:trojan-activity; sid:100002461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kensingtondriving.com"; classtype:trojan-activity; sid:100002462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ketofitnessexpert.com"; classtype:trojan-activity; sid:100002463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kevinjewelry.com.co"; classtype:trojan-activity; sid:100002464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"keywatch.yourpageserver.com"; classtype:trojan-activity; sid:100002465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"khmerosja.net"; classtype:trojan-activity; sid:100002466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kingssa.co.za"; classtype:trojan-activity; sid:100002467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kizitox.ga"; classtype:trojan-activity; sid:100002468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kjcpromo.com"; classtype:trojan-activity; sid:100002469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kldatabase.com"; classtype:trojan-activity; sid:100002470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kleinendeli.co.za"; classtype:trojan-activity; sid:100002471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"korrectconceptservices.com"; classtype:trojan-activity; sid:100002472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"krisbadminton.com"; classtype:trojan-activity; sid:100002473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ktb.sch.id"; classtype:trojan-activity; sid:100002474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kubatoglubaklava.com.tr"; classtype:trojan-activity; sid:100002475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kullumanalitours.com"; classtype:trojan-activity; sid:100002476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kwanfromhongkong.com"; classtype:trojan-activity; sid:100002477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kz.sldov.ru"; classtype:trojan-activity; sid:100002478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lacasadelosalebrijes.com"; classtype:trojan-activity; sid:100002479; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ladylabonde.com"; classtype:trojan-activity; sid:100002480; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lameguard.ru"; classtype:trojan-activity; sid:100002481; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"laodongnhat.vn"; classtype:trojan-activity; sid:100002482; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"laravel.pointersoftwares.com.br"; classtype:trojan-activity; sid:100002483; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lasermobilesounds.co.uk"; classtype:trojan-activity; sid:100002484; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"laura9630fr.com"; classtype:trojan-activity; sid:100002485; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lauratomismith.com"; classtype:trojan-activity; sid:100002486; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lautarosanmiguel.com"; classtype:trojan-activity; sid:100002487; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lawforall.edu.lk"; classtype:trojan-activity; sid:100002488; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lawschoolideas.xyz"; classtype:trojan-activity; sid:100002489; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lceventos.net"; classtype:trojan-activity; sid:100002490; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ld.mediaget.com"; classtype:trojan-activity; sid:100002491; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ldgcorp.com"; classtype:trojan-activity; sid:100002492; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"learning.real-academy.net"; classtype:trojan-activity; sid:100002493; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leasiacherise.com"; classtype:trojan-activity; sid:100002494; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leczkregoslup.acelero.pl"; classtype:trojan-activity; sid:100002495; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legend.nu"; classtype:trojan-activity; sid:100002496; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leluibuffet.com.br"; classtype:trojan-activity; sid:100002497; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lestesteux.ca"; classtype:trojan-activity; sid:100002498; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"library.arihantmbainstitute.ac.in"; classtype:trojan-activity; sid:100002499; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"library.uib.ac.id"; classtype:trojan-activity; sid:100002500; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lidoraggiodisole.it"; classtype:trojan-activity; sid:100002501; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lifebeam.elin.co.za"; classtype:trojan-activity; sid:100002502; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lindnerelektroanlagen.de"; classtype:trojan-activity; sid:100002503; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"linkintec.cn"; classtype:trojan-activity; sid:100002504; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"liquidaz.casa"; classtype:trojan-activity; sid:100002505; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livetrack.in"; classtype:trojan-activity; sid:100002506; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lloydsindian.co.uk"; classtype:trojan-activity; sid:100002507; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lm.stagingarea.co.za"; classtype:trojan-activity; sid:100002508; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lmaancha.co.il"; classtype:trojan-activity; sid:100002509; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lms.cstdevs.com"; classtype:trojan-activity; sid:100002510; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lms.login2.in"; classtype:trojan-activity; sid:100002511; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"location-voitures.ma"; classtype:trojan-activity; sid:100002512; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"login.trezor.com.stockfootagesindia.com"; classtype:trojan-activity; sid:100002513; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"logotypfabriken.se"; classtype:trojan-activity; sid:100002514; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lotix.de"; classtype:trojan-activity; sid:100002515; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lotusanddragonfly.com"; classtype:trojan-activity; sid:100002516; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lp.definerisco.com"; classtype:trojan-activity; sid:100002517; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lp.difusodesign.com"; classtype:trojan-activity; sid:100002518; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ltc.typoten.com"; classtype:trojan-activity; sid:100002519; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luckybrownie.com"; classtype:trojan-activity; sid:100002520; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luminouspneuma.com"; classtype:trojan-activity; sid:100002521; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luxomodels.com"; classtype:trojan-activity; sid:100002522; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"m-technics.kz"; classtype:trojan-activity; sid:100002523; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"m.estudiomoros.com.ar"; classtype:trojan-activity; sid:100002524; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"m.softsharks.com"; classtype:trojan-activity; sid:100002525; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"madicon.co.za"; classtype:trojan-activity; sid:100002526; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"magianegramagiablancayamarres.com"; classtype:trojan-activity; sid:100002527; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mail.bs-eiendomme.co.za"; classtype:trojan-activity; sid:100002528; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mail.golimoapp.com"; classtype:trojan-activity; sid:100002529; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mail.jeffsono.org"; classtype:trojan-activity; sid:100002530; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"maksi.feb.unib.ac.id"; classtype:trojan-activity; sid:100002531; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"malaya.tv"; classtype:trojan-activity; sid:100002532; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"malwarecoding.github.io"; classtype:trojan-activity; sid:100002533; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"managed.oss-cn-beijing.aliyuncs.com"; classtype:trojan-activity; sid:100002534; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"managemysalon.in"; classtype:trojan-activity; sid:100002535; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manantialesdelnorte.uy"; classtype:trojan-activity; sid:100002536; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manhtien.net"; classtype:trojan-activity; sid:100002537; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mario-sunjic.com"; classtype:trojan-activity; sid:100002538; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mariobrown.net"; classtype:trojan-activity; sid:100002539; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mariotessarollo.com"; classtype:trojan-activity; sid:100002540; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"marketinfosales.com"; classtype:trojan-activity; sid:100002541; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"marketing.enexusgroup.com.au"; classtype:trojan-activity; sid:100002542; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"marksidfgs.ug"; classtype:trojan-activity; sid:100002543; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"masjidhabeebiyarazviya.mysunni.com"; classtype:trojan-activity; sid:100002544; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mastersofclientretention.com.au"; classtype:trojan-activity; sid:100002545; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"materialescantu.com"; classtype:trojan-activity; sid:100002546; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"matruchhaya.co.in"; classtype:trojan-activity; sid:100002547; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"maxiquim.cl"; classtype:trojan-activity; sid:100002548; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"maxtox.com.pk"; classtype:trojan-activity; sid:100002549; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mbgrm.com"; classtype:trojan-activity; sid:100002550; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mbjtimes.com"; classtype:trojan-activity; sid:100002551; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mbsolutions.ge"; classtype:trojan-activity; sid:100002552; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mbx.com.au"; classtype:trojan-activity; sid:100002553; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mdasa.elin.co.za"; classtype:trojan-activity; sid:100002554; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medevlb.org"; classtype:trojan-activity; sid:100002555; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"media-server.skyinternet.com.pk"; classtype:trojan-activity; sid:100002556; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medianews.ge"; classtype:trojan-activity; sid:100002557; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mediawaysnews.com"; classtype:trojan-activity; sid:100002558; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medistaffconsulting.com"; classtype:trojan-activity; sid:100002559; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"meeweb.com"; classtype:trojan-activity; sid:100002560; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"megagynreformas.com.br"; classtype:trojan-activity; sid:100002561; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"megamart.afnan-amc.com"; classtype:trojan-activity; sid:100002562; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mehainteriors.com"; classtype:trojan-activity; sid:100002563; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mercabits.com"; classtype:trojan-activity; sid:100002564; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"merkathink.com"; classtype:trojan-activity; sid:100002565; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mertlog.com"; classtype:trojan-activity; sid:100002566; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"metalin-cr.com"; classtype:trojan-activity; sid:100002567; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mettaanand.org"; classtype:trojan-activity; sid:100002568; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"meuoculosnanet.com.br"; classtype:trojan-activity; sid:100002569; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mfevr.com"; classtype:trojan-activity; sid:100002570; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mhkdhotbot.myvnc.com"; classtype:trojan-activity; sid:100002571; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mhkdhotbot80.myvnc.com"; classtype:trojan-activity; sid:100002572; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"micalle.com.au"; classtype:trojan-activity; sid:100002573; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"michaelphilip.com"; classtype:trojan-activity; sid:100002574; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"michimal2.000webhostapp.com"; classtype:trojan-activity; sid:100002575; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"microblading.mirliandias.com.br"; classtype:trojan-activity; sid:100002576; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"microcomm-group.com"; classtype:trojan-activity; sid:100002577; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mikhailmotoringschool.com"; classtype:trojan-activity; sid:100002578; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mills-skyla30ec.com"; classtype:trojan-activity; sid:100002579; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mingguanwms.com"; classtype:trojan-activity; sid:100002580; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"minuevavida.org"; classtype:trojan-activity; sid:100002581; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mirror.mypage.sk"; classtype:trojan-activity; sid:100002582; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mis.nbcc.ac.th"; classtype:trojan-activity; sid:100002583; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"misterson.com"; classtype:trojan-activity; sid:100002584; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mkontakt.az"; classtype:trojan-activity; sid:100002585; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mktf.mx"; classtype:trojan-activity; sid:100002586; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mmdx.com"; classtype:trojan-activity; sid:100002587; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mmogollon.com.mx"; classtype:trojan-activity; sid:100002588; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mncarteam.com"; classtype:trojan-activity; sid:100002589; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"modelhouseturkey.com"; classtype:trojan-activity; sid:100002590; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"modernmanna.org"; classtype:trojan-activity; sid:100002591; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"monetization.business"; classtype:trojan-activity; sid:100002592; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"moninediy.com"; classtype:trojan-activity; sid:100002593; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mopai.sg"; classtype:trojan-activity; sid:100002594; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.31.126.33"; classtype:trojan-activity; sid:100001673; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.38.149.66"; classtype:trojan-activity; sid:100001674; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.38.222.98"; classtype:trojan-activity; sid:100001675; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.43.207.148"; classtype:trojan-activity; sid:100001676; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"62.90.165.236"; classtype:trojan-activity; sid:100001677; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"63.245.122.93"; classtype:trojan-activity; sid:100001678; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"64.233.154.99"; classtype:trojan-activity; sid:100001679; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.0.168.152"; classtype:trojan-activity; sid:100001680; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.125.128.196"; classtype:trojan-activity; sid:100001681; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.21.58.252"; classtype:trojan-activity; sid:100001682; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.26.155.131"; classtype:trojan-activity; sid:100001683; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"65.35.61.255"; classtype:trojan-activity; sid:100001684; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.108.199.144"; classtype:trojan-activity; sid:100001685; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.229.214.115"; classtype:trojan-activity; sid:100001686; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.57.55.210"; classtype:trojan-activity; sid:100001687; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.74.7.197"; classtype:trojan-activity; sid:100001688; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"66.97.181.196"; classtype:trojan-activity; sid:100001689; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"67.245.151.203"; classtype:trojan-activity; sid:100001690; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"67.8.138.101"; classtype:trojan-activity; sid:100001691; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"67.83.49.234"; classtype:trojan-activity; sid:100001692; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"67.84.138.165"; classtype:trojan-activity; sid:100001693; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.148.103.248"; classtype:trojan-activity; sid:100001694; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.174.182.226"; classtype:trojan-activity; sid:100001695; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.175.107.153"; classtype:trojan-activity; sid:100001696; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.188.144.143"; classtype:trojan-activity; sid:100001697; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.204.88.29"; classtype:trojan-activity; sid:100001698; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.205.106.84"; classtype:trojan-activity; sid:100001699; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.205.119.241"; classtype:trojan-activity; sid:100001700; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"68.78.33.33"; classtype:trojan-activity; sid:100001701; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.115.37.205"; classtype:trojan-activity; sid:100001702; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.120.237.255"; classtype:trojan-activity; sid:100001703; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.123.245.151"; classtype:trojan-activity; sid:100001704; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.124.231.110"; classtype:trojan-activity; sid:100001705; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.127.214.47"; classtype:trojan-activity; sid:100001706; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.146.232.34"; classtype:trojan-activity; sid:100001707; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.165.173.49"; classtype:trojan-activity; sid:100001708; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.196.158.227"; classtype:trojan-activity; sid:100001709; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.222.157.166"; classtype:trojan-activity; sid:100001710; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.229.0.133"; classtype:trojan-activity; sid:100001711; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.63.73.234"; classtype:trojan-activity; sid:100001712; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.75.115.194"; classtype:trojan-activity; sid:100001713; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.75.227.186"; classtype:trojan-activity; sid:100001714; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"69.76.240.206"; classtype:trojan-activity; sid:100001715; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.115.31.30"; classtype:trojan-activity; sid:100001716; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.118.240.88"; classtype:trojan-activity; sid:100001717; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.167.10.180"; classtype:trojan-activity; sid:100001718; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.236.190.250"; classtype:trojan-activity; sid:100001719; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.25.5.105"; classtype:trojan-activity; sid:100001720; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"70.93.129.118"; classtype:trojan-activity; sid:100001721; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.127.148.69"; classtype:trojan-activity; sid:100001722; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.146.190.91"; classtype:trojan-activity; sid:100001723; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.204.63.239"; classtype:trojan-activity; sid:100001724; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.29.48.164"; classtype:trojan-activity; sid:100001725; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.34.191.213"; classtype:trojan-activity; sid:100001726; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.40.234.166"; classtype:trojan-activity; sid:100001727; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.43.106.142"; classtype:trojan-activity; sid:100001728; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.43.2.122"; classtype:trojan-activity; sid:100001729; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.43.235.106"; classtype:trojan-activity; sid:100001730; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.47.133.58"; classtype:trojan-activity; sid:100001731; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.71.60.69"; classtype:trojan-activity; sid:100001732; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"71.85.106.211"; classtype:trojan-activity; sid:100001733; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.17.22.30"; classtype:trojan-activity; sid:100001734; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.189.180.98"; classtype:trojan-activity; sid:100001735; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.189.200.62"; classtype:trojan-activity; sid:100001736; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.202.249.109"; classtype:trojan-activity; sid:100001737; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.214.69.226"; classtype:trojan-activity; sid:100001738; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.229.230.118"; classtype:trojan-activity; sid:100001739; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"72.31.40.122"; classtype:trojan-activity; sid:100001740; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"73.112.123.203"; classtype:trojan-activity; sid:100001741; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"73.204.216.103"; classtype:trojan-activity; sid:100001742; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"73.70.164.42"; classtype:trojan-activity; sid:100001743; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.101.1.159"; classtype:trojan-activity; sid:100001744; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.108.224.112"; classtype:trojan-activity; sid:100001745; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.194.117.165"; classtype:trojan-activity; sid:100001746; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.195.115.176"; classtype:trojan-activity; sid:100001747; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.199.84.77"; classtype:trojan-activity; sid:100001748; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.64.139.223"; classtype:trojan-activity; sid:100001749; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"74.75.165.81"; classtype:trojan-activity; sid:100001750; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"75.127.141.52"; classtype:trojan-activity; sid:100001751; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"75.83.102.27"; classtype:trojan-activity; sid:100001752; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"75.99.213.61"; classtype:trojan-activity; sid:100001753; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.170.11.82"; classtype:trojan-activity; sid:100001754; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.178.22.145"; classtype:trojan-activity; sid:100001755; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.217.92.231"; classtype:trojan-activity; sid:100001756; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.250.199.133"; classtype:trojan-activity; sid:100001757; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.254.129.227"; classtype:trojan-activity; sid:100001758; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.84.134.33"; classtype:trojan-activity; sid:100001759; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"76.95.12.137"; classtype:trojan-activity; sid:100001760; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.111.182.31"; classtype:trojan-activity; sid:100001761; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.237.25.210"; classtype:trojan-activity; sid:100001762; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.71.50.153"; classtype:trojan-activity; sid:100001763; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.71.52.220"; classtype:trojan-activity; sid:100001764; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77.89.203.238"; classtype:trojan-activity; sid:100001765; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"77st.net"; classtype:trojan-activity; sid:100001766; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.145.224.45"; classtype:trojan-activity; sid:100001767; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.187.141.144"; classtype:trojan-activity; sid:100001768; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.187.240.125"; classtype:trojan-activity; sid:100001769; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.187.41.200"; classtype:trojan-activity; sid:100001770; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.188.106.235"; classtype:trojan-activity; sid:100001771; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.188.168.64"; classtype:trojan-activity; sid:100001772; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.188.188.141"; classtype:trojan-activity; sid:100001773; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.189.104.157"; classtype:trojan-activity; sid:100001774; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.189.176.163"; classtype:trojan-activity; sid:100001775; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.23.172.81"; classtype:trojan-activity; sid:100001776; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"78.8.225.77"; classtype:trojan-activity; sid:100001777; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.11.195.121"; classtype:trojan-activity; sid:100001778; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.130.253.13"; classtype:trojan-activity; sid:100001779; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.147.123.48"; classtype:trojan-activity; sid:100001780; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.167.189.236"; classtype:trojan-activity; sid:100001781; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.175.42.244"; classtype:trojan-activity; sid:100001782; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.21.84.63"; classtype:trojan-activity; sid:100001783; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.7.170.58"; classtype:trojan-activity; sid:100001784; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.79.58.94"; classtype:trojan-activity; sid:100001785; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.8.70.162"; classtype:trojan-activity; sid:100001786; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"79.9.88.185"; classtype:trojan-activity; sid:100001787; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.107.89.207"; classtype:trojan-activity; sid:100001788; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.19.101.218"; classtype:trojan-activity; sid:100001789; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.211.181.77"; classtype:trojan-activity; sid:100001790; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.217.12.7"; classtype:trojan-activity; sid:100001791; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"80.99.128.61"; classtype:trojan-activity; sid:100001792; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.136.146.213"; classtype:trojan-activity; sid:100001793; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.165.44.109"; classtype:trojan-activity; sid:100001794; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.191.40.58"; classtype:trojan-activity; sid:100001795; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.213.141.184"; classtype:trojan-activity; sid:100001796; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.215.199.29"; classtype:trojan-activity; sid:100001797; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.218.187.113"; classtype:trojan-activity; sid:100001798; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.218.195.216"; classtype:trojan-activity; sid:100001799; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.237.128.200"; classtype:trojan-activity; sid:100001800; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.244.219.41"; classtype:trojan-activity; sid:100001801; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.246.225.203"; classtype:trojan-activity; sid:100001802; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"81.92.36.96"; classtype:trojan-activity; sid:100001803; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.103.108.72"; classtype:trojan-activity; sid:100001804; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.135.196.130"; classtype:trojan-activity; sid:100001805; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.166.212.178"; classtype:trojan-activity; sid:100001806; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.166.85.112"; classtype:trojan-activity; sid:100001807; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.207.61.194"; classtype:trojan-activity; sid:100001808; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.209.250.155"; classtype:trojan-activity; sid:100001809; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.211.156.38"; classtype:trojan-activity; sid:100001810; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.59.31.181"; classtype:trojan-activity; sid:100001811; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.62.110.252"; classtype:trojan-activity; sid:100001812; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.62.53.77"; classtype:trojan-activity; sid:100001813; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.80.138.72"; classtype:trojan-activity; sid:100001814; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.80.139.92"; classtype:trojan-activity; sid:100001815; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.80.154.214"; classtype:trojan-activity; sid:100001816; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.80.187.109"; classtype:trojan-activity; sid:100001817; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.100.54"; classtype:trojan-activity; sid:100001818; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.106.65"; classtype:trojan-activity; sid:100001819; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.108.172"; classtype:trojan-activity; sid:100001820; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.131.158"; classtype:trojan-activity; sid:100001821; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.134.66"; classtype:trojan-activity; sid:100001822; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.19.42"; classtype:trojan-activity; sid:100001823; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.197.254"; classtype:trojan-activity; sid:100001824; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.215.149"; classtype:trojan-activity; sid:100001825; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.232.68"; classtype:trojan-activity; sid:100001826; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.234.195"; classtype:trojan-activity; sid:100001827; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.246.96"; classtype:trojan-activity; sid:100001828; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.28.57"; classtype:trojan-activity; sid:100001829; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.4.57"; classtype:trojan-activity; sid:100001830; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.55.84"; classtype:trojan-activity; sid:100001831; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.73.245"; classtype:trojan-activity; sid:100001832; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"82.81.98.51"; classtype:trojan-activity; sid:100001833; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.165.237.163"; classtype:trojan-activity; sid:100001834; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.234.147.99"; classtype:trojan-activity; sid:100001835; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.234.218.42"; classtype:trojan-activity; sid:100001836; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.242.253.154"; classtype:trojan-activity; sid:100001837; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"83.252.9.37"; classtype:trojan-activity; sid:100001838; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.210.219.213"; classtype:trojan-activity; sid:100001839; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.228.50.118"; classtype:trojan-activity; sid:100001840; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.228.95.204"; classtype:trojan-activity; sid:100001841; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.238.24.35"; classtype:trojan-activity; sid:100001842; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.247.83.74"; classtype:trojan-activity; sid:100001843; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.254.39.129"; classtype:trojan-activity; sid:100001844; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.33.111.227"; classtype:trojan-activity; sid:100001845; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.40.127.242"; classtype:trojan-activity; sid:100001846; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"84.42.20.217"; classtype:trojan-activity; sid:100001847; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com"; classtype:trojan-activity; sid:100001848; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.11.216"; classtype:trojan-activity; sid:100001849; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.123.251"; classtype:trojan-activity; sid:100001850; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.135.187"; classtype:trojan-activity; sid:100001851; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.180.33"; classtype:trojan-activity; sid:100001852; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.208.25"; classtype:trojan-activity; sid:100001853; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.224.141"; classtype:trojan-activity; sid:100001854; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.105.241.2"; classtype:trojan-activity; sid:100001855; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.214.149.236"; classtype:trojan-activity; sid:100001856; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.241.39.182"; classtype:trojan-activity; sid:100001857; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.64.181.50"; classtype:trojan-activity; sid:100001858; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.74.215.180"; classtype:trojan-activity; sid:100001859; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"85.97.130.227"; classtype:trojan-activity; sid:100001860; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"86.35.43.220"; classtype:trojan-activity; sid:100001861; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"87.117.11.46"; classtype:trojan-activity; sid:100001862; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"87.172.19.130"; classtype:trojan-activity; sid:100001863; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"87.61.89.40"; classtype:trojan-activity; sid:100001864; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.119.171.253"; classtype:trojan-activity; sid:100001865; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.2.208.71"; classtype:trojan-activity; sid:100001866; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.2.219.179"; classtype:trojan-activity; sid:100001867; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.218.17.110"; classtype:trojan-activity; sid:100001868; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.218.17.149"; classtype:trojan-activity; sid:100001869; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.225.222.128"; classtype:trojan-activity; sid:100001870; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.247.96.19"; classtype:trojan-activity; sid:100001871; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.248.136.231"; classtype:trojan-activity; sid:100001872; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.248.51.139"; classtype:trojan-activity; sid:100001873; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.249.244.180"; classtype:trojan-activity; sid:100001874; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.250.204.12"; classtype:trojan-activity; sid:100001875; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.250.226.26"; classtype:trojan-activity; sid:100001876; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.250.240.245"; classtype:trojan-activity; sid:100001877; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"88.250.254.90"; classtype:trojan-activity; sid:100001878; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.122.183.130"; classtype:trojan-activity; sid:100001879; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.136.197.170"; classtype:trojan-activity; sid:100001880; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.22.152.244"; classtype:trojan-activity; sid:100001881; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.248.112.202"; classtype:trojan-activity; sid:100001882; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.29.213.33"; classtype:trojan-activity; sid:100001883; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"89.40.85.166"; classtype:trojan-activity; sid:100001884; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"8poieq.bn.files.1drv.com"; classtype:trojan-activity; sid:100001885; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"90.152.144.139"; classtype:trojan-activity; sid:100001886; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"90.63.176.144"; classtype:trojan-activity; sid:100001887; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.124.126.133"; classtype:trojan-activity; sid:100001888; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.132.197.39"; classtype:trojan-activity; sid:100001889; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.138.215.5"; classtype:trojan-activity; sid:100001890; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.177.139.132"; classtype:trojan-activity; sid:100001891; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.187.103.32"; classtype:trojan-activity; sid:100001892; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.212.150.241"; classtype:trojan-activity; sid:100001893; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.214.124.141"; classtype:trojan-activity; sid:100001894; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.217.104.185"; classtype:trojan-activity; sid:100001895; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.233.112.188"; classtype:trojan-activity; sid:100001896; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.234.60.94"; classtype:trojan-activity; sid:100001897; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.244.169.139"; classtype:trojan-activity; sid:100001898; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"91.92.16.244"; classtype:trojan-activity; sid:100001899; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.114.191.82"; classtype:trojan-activity; sid:100001900; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.241.78.114"; classtype:trojan-activity; sid:100001901; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.27.246.202"; classtype:trojan-activity; sid:100001902; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.83.62.139"; classtype:trojan-activity; sid:100001903; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"92.85.18.138"; classtype:trojan-activity; sid:100001904; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.157.63.244"; classtype:trojan-activity; sid:100001905; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.159.169.190"; classtype:trojan-activity; sid:100001906; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.21.224.154"; classtype:trojan-activity; sid:100001907; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.39.115.176"; classtype:trojan-activity; sid:100001908; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.39.79.41"; classtype:trojan-activity; sid:100001909; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.41.137.16"; classtype:trojan-activity; sid:100001910; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.41.182.249"; classtype:trojan-activity; sid:100001911; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.41.206.56"; classtype:trojan-activity; sid:100001912; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.57.43.233"; classtype:trojan-activity; sid:100001913; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"93.73.99.102"; classtype:trojan-activity; sid:100001914; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.136.69.199"; classtype:trojan-activity; sid:100001915; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.143.53.34"; classtype:trojan-activity; sid:100001916; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.154.17.170"; classtype:trojan-activity; sid:100001917; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.200.16.22"; classtype:trojan-activity; sid:100001918; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.224.83.208"; classtype:trojan-activity; sid:100001919; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.53.120.109"; classtype:trojan-activity; sid:100001920; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"94.85.0.3"; classtype:trojan-activity; sid:100001921; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.132.129.250"; classtype:trojan-activity; sid:100001922; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.133.158.20"; classtype:trojan-activity; sid:100001923; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.154.20.231"; classtype:trojan-activity; sid:100001924; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.158.19.130"; classtype:trojan-activity; sid:100001925; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.170.113.227"; classtype:trojan-activity; sid:100001926; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.170.113.52"; classtype:trojan-activity; sid:100001927; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.170.201.34"; classtype:trojan-activity; sid:100001928; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.60.146.134"; classtype:trojan-activity; sid:100001929; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.66.196.63"; classtype:trojan-activity; sid:100001930; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"95.9.120.40"; classtype:trojan-activity; sid:100001931; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"96.239.73.246"; classtype:trojan-activity; sid:100001932; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"96.47.147.169"; classtype:trojan-activity; sid:100001933; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"97.68.140.254"; classtype:trojan-activity; sid:100001934; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"97.96.199.75"; classtype:trojan-activity; sid:100001935; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.0.210.218"; classtype:trojan-activity; sid:100001936; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.0.239.142"; classtype:trojan-activity; sid:100001937; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.113.239.207"; classtype:trojan-activity; sid:100001938; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.116.72.119"; classtype:trojan-activity; sid:100001939; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.128.147.115"; classtype:trojan-activity; sid:100001940; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.178.207.205"; classtype:trojan-activity; sid:100001941; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.178.242.44"; classtype:trojan-activity; sid:100001942; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"98.30.24.54"; classtype:trojan-activity; sid:100001943; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"99.150.245.203"; classtype:trojan-activity; sid:100001944; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"99.33.195.164"; classtype:trojan-activity; sid:100001945; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aatreefelling.co.za"; classtype:trojan-activity; sid:100001946; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"abcd.bg"; classtype:trojan-activity; sid:100001947; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"abissnet.net"; classtype:trojan-activity; sid:100001948; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aboveandbelow.com.au"; classtype:trojan-activity; sid:100001949; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"absoftechworld.com"; classtype:trojan-activity; sid:100001950; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"abyssos.eu"; classtype:trojan-activity; sid:100001951; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"academyshademani.com"; classtype:trojan-activity; sid:100001952; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"acbick.com"; classtype:trojan-activity; sid:100001953; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"accesslinksgroup.com"; classtype:trojan-activity; sid:100001954; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aceeprc.com.aceeprc.com"; classtype:trojan-activity; sid:100001955; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"acellr.co.uk"; classtype:trojan-activity; sid:100001956; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"acteon.com.ar"; classtype:trojan-activity; sid:100001957; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"addahealingmusic.com"; classtype:trojan-activity; sid:100001958; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"adithimedia.com"; classtype:trojan-activity; sid:100001959; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"adithimedia.memengers.com"; classtype:trojan-activity; sid:100001960; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"admin.erapor.smk-alasror.net"; classtype:trojan-activity; sid:100001961; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"admin.gentbcn.org"; classtype:trojan-activity; sid:100001962; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"admin.grandoceanvilla.com"; classtype:trojan-activity; sid:100001963; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"admission.kmctartskuttippuram.org"; classtype:trojan-activity; sid:100001964; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"adventureexplorer.in"; classtype:trojan-activity; sid:100001965; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aeropilates.cl"; classtype:trojan-activity; sid:100001966; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"afnan-amc.com"; classtype:trojan-activity; sid:100001967; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"afrimedspecialist.com"; classtype:trojan-activity; sid:100001968; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"agemn.co.za"; classtype:trojan-activity; sid:100001969; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"agenciadigitalwdys.com"; classtype:trojan-activity; sid:100001970; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"agenda.gmelloinformatica.com.br"; classtype:trojan-activity; sid:100001971; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"agile8studio.com"; classtype:trojan-activity; sid:100001972; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aiecons.com"; classtype:trojan-activity; sid:100001973; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aimnaukri.com"; classtype:trojan-activity; sid:100001974; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aiqtest.com"; classtype:trojan-activity; sid:100001975; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ajpharmaholding.com"; classtype:trojan-activity; sid:100001976; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"akdvidyalaya.com"; classtype:trojan-activity; sid:100001977; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"al-wahd.com"; classtype:trojan-activity; sid:100001978; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alasdemariposas.org"; classtype:trojan-activity; sid:100001979; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alberts.diamondrelationscrm.us"; classtype:trojan-activity; sid:100001980; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alemelektronik.com"; classtype:trojan-activity; sid:100001981; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alena1971.es"; classtype:trojan-activity; sid:100001982; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alexdubai.com.aldiabsteel.com"; classtype:trojan-activity; sid:100001983; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alka.institute"; classtype:trojan-activity; sid:100001984; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"allforcreative.com.au"; classtype:trojan-activity; sid:100001985; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alltheway.travel"; classtype:trojan-activity; sid:100001986; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alpaylar.com.tr"; classtype:trojan-activity; sid:100001987; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"alumni.hildred.ibbott@46.249.33.79"; classtype:trojan-activity; sid:100001988; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"am-concepts.ca"; classtype:trojan-activity; sid:100001989; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amamontajes.com"; classtype:trojan-activity; sid:100001990; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amarresdeamorymaestroshechiceros.com"; classtype:trojan-activity; sid:100001991; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amarteargentina.com.ar"; classtype:trojan-activity; sid:100001992; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"amos524.org"; classtype:trojan-activity; sid:100001993; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ams.alvinasschools.org.ng"; classtype:trojan-activity; sid:100001994; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anadelgbt.org"; classtype:trojan-activity; sid:100001995; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anantam.net.in"; classtype:trojan-activity; sid:100001996; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"andreelapeyre.com"; classtype:trojan-activity; sid:100001997; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"andremaraisbeleggings.co.za"; classtype:trojan-activity; sid:100001998; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"andreshconcejal.solucioneslink.com"; classtype:trojan-activity; sid:100001999; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"angelazgheibld.com"; classtype:trojan-activity; sid:100002000; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"angelsdetour.com"; classtype:trojan-activity; sid:100002001; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anhung1102.vn"; classtype:trojan-activity; sid:100002002; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anurontv.com"; classtype:trojan-activity; sid:100002003; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"anysbergbiltong.co.za"; classtype:trojan-activity; sid:100002004; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apartamentoscitta.com"; classtype:trojan-activity; sid:100002005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"api-ms.cobainaja.id"; classtype:trojan-activity; sid:100002006; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"api.cstdevs.com"; classtype:trojan-activity; sid:100002007; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apoolcondo.com"; classtype:trojan-activity; sid:100002008; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"app.adsensearticle.com"; classtype:trojan-activity; sid:100002009; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"app.explicitsurveys.co.uk"; classtype:trojan-activity; sid:100002010; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"app.prerana.info"; classtype:trojan-activity; sid:100002011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"apps.saintsoporte.com"; classtype:trojan-activity; sid:100002012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aps-scribe.com"; classtype:trojan-activity; sid:100002013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aps-sv.com"; classtype:trojan-activity; sid:100002014; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"artedibujoyarquitectura.com"; classtype:trojan-activity; sid:100002015; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"arwenyapi.com"; classtype:trojan-activity; sid:100002016; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ask-regard.call-save.biz"; classtype:trojan-activity; sid:100002017; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"asucssa.live"; classtype:trojan-activity; sid:100002018; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"atfile.com"; classtype:trojan-activity; sid:100002019; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"athenacapsg.com"; classtype:trojan-activity; sid:100002020; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"atlasconcreteworks.com"; classtype:trojan-activity; sid:100002021; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"attach.66rpg.com"; classtype:trojan-activity; sid:100002022; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"atteuqpotentialunlimited.com"; classtype:trojan-activity; sid:100002023; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"augustair.com"; classtype:trojan-activity; sid:100002024; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aulist.com"; classtype:trojan-activity; sid:100002025; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"automaticrefreshments.com"; classtype:trojan-activity; sid:100002026; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"avadhanagames.com"; classtype:trojan-activity; sid:100002027; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ayahuascasp.com.br"; classtype:trojan-activity; sid:100002028; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ayamallah.com"; classtype:trojan-activity; sid:100002029; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"aycconsultoriaempresarial.com"; classtype:trojan-activity; sid:100002030; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"azmeasurement.com"; classtype:trojan-activity; sid:100002031; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"azraktours.com"; classtype:trojan-activity; sid:100002032; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"b2b.toptanakaryakit.com.tr"; classtype:trojan-activity; sid:100002033; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"badeggdesign.com"; classtype:trojan-activity; sid:100002034; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"balealgodon.mx"; classtype:trojan-activity; sid:100002035; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bangkok-orchids.com"; classtype:trojan-activity; sid:100002036; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bangladeshunbound.com"; classtype:trojan-activity; sid:100002037; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bary.sz4h.com"; classtype:trojan-activity; sid:100002038; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bash.givemexyz.in"; classtype:trojan-activity; sid:100002039; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bausch.kr-atlas.monaxikoslykos@zytrox.tk"; classtype:trojan-activity; sid:100002040; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bavhome.com"; classtype:trojan-activity; sid:100002041; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bbia.co.uk"; classtype:trojan-activity; sid:100002042; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bcmt.elin.co.za"; classtype:trojan-activity; sid:100002043; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bcrg.co.za"; classtype:trojan-activity; sid:100002044; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bdnextrend.xyz"; classtype:trojan-activity; sid:100002045; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beanx88.xyz"; classtype:trojan-activity; sid:100002046; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bearcatpumps.com.cn"; classtype:trojan-activity; sid:100002047; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beautincollagen.rs"; classtype:trojan-activity; sid:100002048; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beautymomentsgt.de"; classtype:trojan-activity; sid:100002049; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bekape.co.id"; classtype:trojan-activity; sid:100002050; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beor360.com"; classtype:trojan-activity; sid:100002051; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bespokeweddings.ie"; classtype:trojan-activity; sid:100002052; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bestcarenepal.com"; classtype:trojan-activity; sid:100002053; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betone.co.kr"; classtype:trojan-activity; sid:100002054; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"betycopaints.com"; classtype:trojan-activity; sid:100002055; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"beveragesmiami.solucioneslink.com"; classtype:trojan-activity; sid:100002056; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bhavaniengineering.com"; classtype:trojan-activity; sid:100002057; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bigmikesupplies.co.za"; classtype:trojan-activity; sid:100002058; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bilhen.co.za"; classtype:trojan-activity; sid:100002059; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"billing.rahitechnosoft.com"; classtype:trojan-activity; sid:100002060; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"binoy.stalphonsamissionva.org"; classtype:trojan-activity; sid:100002061; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"biometrico.gpotecnosystems.com"; classtype:trojan-activity; sid:100002062; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bioskey.com"; classtype:trojan-activity; sid:100002063; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"birdi.elin.co.za"; classtype:trojan-activity; sid:100002064; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"birminghamlink.org"; classtype:trojan-activity; sid:100002065; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bizztradingbot.nl"; classtype:trojan-activity; sid:100002066; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bl4n3.zadns.co.za"; classtype:trojan-activity; sid:100002067; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blog.callensaxen.com"; classtype:trojan-activity; sid:100002068; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blog.difusodesign.com"; classtype:trojan-activity; sid:100002069; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blog.oyinblogs.com"; classtype:trojan-activity; sid:100002070; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"blog.takbelit.com"; classtype:trojan-activity; sid:100002071; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bmlifestyle.co.uk"; classtype:trojan-activity; sid:100002072; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boatpecas.com.br"; classtype:trojan-activity; sid:100002073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodenstein.co.za"; classtype:trojan-activity; sid:100002074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bodylanguage.santulan.co.in"; classtype:trojan-activity; sid:100002075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"booksearch.com"; classtype:trojan-activity; sid:100002076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bophelocare.co.za"; classtype:trojan-activity; sid:100002077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bounces.mi-fs.com"; classtype:trojan-activity; sid:100002078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"boutiqueofferte.com"; classtype:trojan-activity; sid:100002079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bpo.correct.go.th"; classtype:trojan-activity; sid:100002080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bradleyinstitute.co.za"; classtype:trojan-activity; sid:100002081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brandtrust.com.pk"; classtype:trojan-activity; sid:100002082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"braunfinancial.com.au"; classtype:trojan-activity; sid:100002083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brendanquine.com"; classtype:trojan-activity; sid:100002084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brideofmessiah.com"; classtype:trojan-activity; sid:100002085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brightaffiliatesales.org"; classtype:trojan-activity; sid:100002086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brightmega.com"; classtype:trojan-activity; sid:100002087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"brightstarshop.com"; classtype:trojan-activity; sid:100002088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"browardinsurancemiami.solucioneslink.com"; classtype:trojan-activity; sid:100002089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bt2.elin.co.za"; classtype:trojan-activity; sid:100002090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"btdapi.robotake.com"; classtype:trojan-activity; sid:100002091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"buigiaphat.com.vn"; classtype:trojan-activity; sid:100002092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bullseyemedia.in"; classtype:trojan-activity; sid:100002093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"busandvanrentalmalaysia.com"; classtype:trojan-activity; sid:100002094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"buscascolegios.diit.cl"; classtype:trojan-activity; sid:100002095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"business.softberg.ro"; classtype:trojan-activity; sid:100002096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"business2.softberg.ro"; classtype:trojan-activity; sid:100002097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"bydspa.cl"; classtype:trojan-activity; sid:100002098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"c.oooooooooo.ga"; classtype:trojan-activity; sid:100002099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"c0140529.ferozo.com"; classtype:trojan-activity; sid:100002100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"caballo.com.au"; classtype:trojan-activity; sid:100002101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cacaoprojects.com"; classtype:trojan-activity; sid:100002102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"calgaryautorepairservice.com"; classtype:trojan-activity; sid:100002103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"callbury.in"; classtype:trojan-activity; sid:100002104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"camminachetipassa.it"; classtype:trojan-activity; sid:100002105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"capitalgroup-kw.com"; classtype:trojan-activity; sid:100002106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"capoeiraventrelivre.com"; classtype:trojan-activity; sid:100002107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cashyinvestment.org"; classtype:trojan-activity; sid:100002108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"catchperch.com"; classtype:trojan-activity; sid:100002109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"catchpoolshetlands.co.uk"; classtype:trojan-activity; sid:100002110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cazyacustomfurniture.com"; classtype:trojan-activity; sid:100002111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cbn.hypervoizd.com"; classtype:trojan-activity; sid:100002112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ccauthority.net"; classtype:trojan-activity; sid:100002113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cdaonline.com.ar"; classtype:trojan-activity; sid:100002114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cec.asso.ac-amiens.fr"; classtype:trojan-activity; sid:100002115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cecra.cl"; classtype:trojan-activity; sid:100002116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cellas.sk"; classtype:trojan-activity; sid:100002117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cendekiabinaaksara.com"; classtype:trojan-activity; sid:100002118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cfs5.tistory.com"; classtype:trojan-activity; sid:100002119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ch.rmu.ac.th"; classtype:trojan-activity; sid:100002120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"changematterscounselling.com"; classtype:trojan-activity; sid:100002121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"chardhamdodham.com"; classtype:trojan-activity; sid:100002122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"chezalice.co.za"; classtype:trojan-activity; sid:100002123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"childselect.com"; classtype:trojan-activity; sid:100002124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"chinhdropfile.myvnc.com"; classtype:trojan-activity; sid:100002125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"chinhdropfile80.myvnc.com"; classtype:trojan-activity; sid:100002126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cible-energy.com"; classtype:trojan-activity; sid:100002127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cifeer.net"; classtype:trojan-activity; sid:100002128; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"citiconstructioncorp.com"; classtype:trojan-activity; sid:100002129; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"citihits.lk"; classtype:trojan-activity; sid:100002130; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"citssolutions.co.za"; classtype:trojan-activity; sid:100002131; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"citycapproperty.ru"; classtype:trojan-activity; sid:100002132; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cityglobalgospel.com"; classtype:trojan-activity; sid:100002133; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"civi.istmejia.com"; classtype:trojan-activity; sid:100002134; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cleanbydesignllc.com"; classtype:trojan-activity; sid:100002135; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cloud.fc.co.mz"; classtype:trojan-activity; sid:100002136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cm-arquitetos.com"; classtype:trojan-activity; sid:100002137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cnc.tacobelllover.tk"; classtype:trojan-activity; sid:100002138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"codsambal.com"; classtype:trojan-activity; sid:100002139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"colinde.pricesne.com"; classtype:trojan-activity; sid:100002140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"colorpak.pl"; classtype:trojan-activity; sid:100002141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"columbia.aula-web.net"; classtype:trojan-activity; sid:100002142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"community.reimclub.com"; classtype:trojan-activity; sid:100002143; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"competancy.indigoconsult.net"; classtype:trojan-activity; sid:100002144; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"conceptimagine.ro"; classtype:trojan-activity; sid:100002145; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"config.cqhbkjzx.com"; classtype:trojan-activity; sid:100002146; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"connectcapital.com.br"; classtype:trojan-activity; sid:100002147; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"constructoralyon.com"; classtype:trojan-activity; sid:100002148; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"consulateins.solucioneslink.com"; classtype:trojan-activity; sid:100002149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"contributeindustry.com"; classtype:trojan-activity; sid:100002150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"copelandscapes.com"; classtype:trojan-activity; sid:100002151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"corwin-tommie06f.ru.com"; classtype:trojan-activity; sid:100002152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"coulsongraphics.com"; classtype:trojan-activity; sid:100002153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"count.mail.163.com.impactmedfoundation.com"; classtype:trojan-activity; sid:100002154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"covid19.cyberschool.or.id"; classtype:trojan-activity; sid:100002155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cpanel.shivay.net"; classtype:trojan-activity; sid:100002156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cr-sq.com"; classtype:trojan-activity; sid:100002157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"craftech.nxtnet.ga"; classtype:trojan-activity; sid:100002158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crearechile.cl"; classtype:trojan-activity; sid:100002159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"creationskateboards.com"; classtype:trojan-activity; sid:100002160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crecerco.com"; classtype:trojan-activity; sid:100002161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crittersbythebay.com"; classtype:trojan-activity; sid:100002162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crm.notariavieitoyvelamazan.com"; classtype:trojan-activity; sid:100002163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crmfarko.manivelasst.com"; classtype:trojan-activity; sid:100002164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crmroche.manivelasst.com"; classtype:trojan-activity; sid:100002165; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"crscorretordeimoveis.com.br"; classtype:trojan-activity; sid:100002166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cse-engineer.com"; classtype:trojan-activity; sid:100002167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"csnserver.com"; classtype:trojan-activity; sid:100002168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ctracknxt.in"; classtype:trojan-activity; sid:100002169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cubescargoexpress.com"; classtype:trojan-activity; sid:100002170; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"curasoles.co.za"; classtype:trojan-activity; sid:100002171; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"currantmedia.com"; classtype:trojan-activity; sid:100002172; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cwa.mx"; classtype:trojan-activity; sid:100002173; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cyclomove.com"; classtype:trojan-activity; sid:100002174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"cynkon.kairoscs.net"; classtype:trojan-activity; sid:100002175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"czsl.91756.cn"; classtype:trojan-activity; sid:100002176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"d.powerofwish.com"; classtype:trojan-activity; sid:100002177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"d9.99ddd.com"; classtype:trojan-activity; sid:100002178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"da.alibuf.com"; classtype:trojan-activity; sid:100002179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"danaevara.com"; classtype:trojan-activity; sid:100002180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dartoonpictures.com"; classtype:trojan-activity; sid:100002181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"data.cdevelop.org"; classtype:trojan-activity; sid:100002182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"data.over-blog-kiwi.com"; classtype:trojan-activity; sid:100002183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"datapolish.com"; classtype:trojan-activity; sid:100002184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dating.khokhas.co.za"; classtype:trojan-activity; sid:100002185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"datsom.vn"; classtype:trojan-activity; sid:100002186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"davethompson.me.uk"; classtype:trojan-activity; sid:100002187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dayspringdaisies.com"; classtype:trojan-activity; sid:100002188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dd.qiyuea.cn"; classtype:trojan-activity; sid:100002189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ddns.cyberium.cc"; classtype:trojan-activity; sid:100002190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"de.gsearch.com.de"; classtype:trojan-activity; sid:100002191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"decifrar.com.br"; classtype:trojan-activity; sid:100002192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"deigratia2.elin.co.za"; classtype:trojan-activity; sid:100002193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dekovizyon.com"; classtype:trojan-activity; sid:100002194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"demo-cliente.mindcreative.com.br"; classtype:trojan-activity; sid:100002195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"demo.glassforcars.com.au"; classtype:trojan-activity; sid:100002196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"demo6.hiites.com"; classtype:trojan-activity; sid:100002197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dent-estet.com"; classtype:trojan-activity; sid:100002198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dental.xiaoxiao.media"; classtype:trojan-activity; sid:100002199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dentalalliance.se"; classtype:trojan-activity; sid:100002200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"desertlandtrd.com"; classtype:trojan-activity; sid:100002201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"designerliving.co.za"; classtype:trojan-activity; sid:100002202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"despertaresi.com.br"; classtype:trojan-activity; sid:100002203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"destinymc.co.za"; classtype:trojan-activity; sid:100002204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"detorre.es"; classtype:trojan-activity; sid:100002205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dev.sebpo.net"; classtype:trojan-activity; sid:100002206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dev.watch-store.eu"; classtype:trojan-activity; sid:100002207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dezcom.com"; classtype:trojan-activity; sid:100002208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dfcf.91756.cn"; classtype:trojan-activity; sid:100002209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"diamantenegro.mi-fs.com"; classtype:trojan-activity; sid:100002210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dienmayminhhung.com"; classtype:trojan-activity; sid:100002211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"digilib.dianhusada.ac.id"; classtype:trojan-activity; sid:100002212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"digisails.org"; classtype:trojan-activity; sid:100002213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"disinfection-cleaning.co.za"; classtype:trojan-activity; sid:100002214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"djking.f3322.net"; classtype:trojan-activity; sid:100002215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.1003b.56a.com"; classtype:trojan-activity; sid:100002216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.198424.com"; classtype:trojan-activity; sid:100002217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.installcdn-aws.com"; classtype:trojan-activity; sid:100002218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.packetstormsecurity.net"; classtype:trojan-activity; sid:100002219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dl.rina-roleplay.com"; classtype:trojan-activity; sid:100002220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dockerupdate.anondns.net"; classtype:trojan-activity; sid:100002221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"docman.orientalservices.in"; classtype:trojan-activity; sid:100002222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dodsonimaging.com"; classtype:trojan-activity; sid:100002223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"doitunlimited.com"; classtype:trojan-activity; sid:100002224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dokan.blueberrytec.com"; classtype:trojan-activity; sid:100002225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dom.daf.free.fr"; classtype:trojan-activity; sid:100002226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"doncedyhall.com"; classtype:trojan-activity; sid:100002227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"donghobinhminh.com"; classtype:trojan-activity; sid:100002228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dongphuctop.com"; classtype:trojan-activity; sid:100002229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"donwnloasecury.ath.cx"; classtype:trojan-activity; sid:100002230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dosame.com"; classtype:trojan-activity; sid:100002231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dosman.pl"; classtype:trojan-activity; sid:100002232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dovberger.com"; classtype:trojan-activity; sid:100002233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"down.pcclear.com"; classtype:trojan-activity; sid:100002234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"down.udashi.com"; classtype:trojan-activity; sid:100002235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"down.webbora.com"; classtype:trojan-activity; sid:100002236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"down1.arpun.com"; classtype:trojan-activity; sid:100002237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.caihong.com"; classtype:trojan-activity; sid:100002238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.doumaibiji.cn"; classtype:trojan-activity; sid:100002239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.exrnybuf.cn"; classtype:trojan-activity; sid:100002240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.kaobeitu.com"; classtype:trojan-activity; sid:100002241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.pdf00.cn"; classtype:trojan-activity; sid:100002242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.rising.com.cn"; classtype:trojan-activity; sid:100002243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.skycn.com"; classtype:trojan-activity; sid:100002244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"download.zjsyawqj.cn"; classtype:trojan-activity; sid:100002245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dragonsknot.com"; classtype:trojan-activity; sid:100002246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"drbaby.com.sa"; classtype:trojan-activity; sid:100002247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dream.pics"; classtype:trojan-activity; sid:100002248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"drgroup.co.za"; classtype:trojan-activity; sid:100002249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"drools-moved.46999.n3.nabble.com"; classtype:trojan-activity; sid:100002250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"drsha.innovativesolutions.mobi"; classtype:trojan-activity; sid:100002251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dsenterprize.co.za"; classtype:trojan-activity; sid:100002252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dsspainting.com"; classtype:trojan-activity; sid:100002253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"du-wizards.com"; classtype:trojan-activity; sid:100002254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"duque.guantanameratravel.com"; classtype:trojan-activity; sid:100002255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dutapp.wisolve.co.za"; classtype:trojan-activity; sid:100002256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"duvalcharter.dekitout.com"; classtype:trojan-activity; sid:100002257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dw2.co.id"; classtype:trojan-activity; sid:100002258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dx.qqyewu.com"; classtype:trojan-activity; sid:100002259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"dzinestudio87.co.uk"; classtype:trojan-activity; sid:100002260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"e-commerce.saleensuporte.com.br"; classtype:trojan-activity; sid:100002261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"e.sldov.ru"; classtype:trojan-activity; sid:100002262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eandgdesign.com.ng"; classtype:trojan-activity; sid:100002263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eastsheen-glaziers.co.uk"; classtype:trojan-activity; sid:100002264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ebruyatkin.com"; classtype:trojan-activity; sid:100002265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"edu.saicraftsman.com"; classtype:trojan-activity; sid:100002266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eedo.ee"; classtype:trojan-activity; sid:100002267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"efficientegroup.com"; classtype:trojan-activity; sid:100002268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"elbauldenora.com"; classtype:trojan-activity; sid:100002269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"emaids.co.za"; classtype:trojan-activity; sid:100002270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"emaz.pk"; classtype:trojan-activity; sid:100002271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"en.baoend.com"; classtype:trojan-activity; sid:100002272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"enc-tech.com"; classtype:trojan-activity; sid:100002273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"endurotanzania.co.tz"; classtype:trojan-activity; sid:100002274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ennovate.elin.co.za"; classtype:trojan-activity; sid:100002275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"equimination.ee"; classtype:trojan-activity; sid:100002276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"erp.nanotechproautocare.com"; classtype:trojan-activity; sid:100002277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"erp.zilymax.com"; classtype:trojan-activity; sid:100002278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"escola.probommar.org.br"; classtype:trojan-activity; sid:100002279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"esnconsultants.com"; classtype:trojan-activity; sid:100002280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"essentia.org.br"; classtype:trojan-activity; sid:100002281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"estjh05.top"; classtype:trojan-activity; sid:100002282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ethereality.info"; classtype:trojan-activity; sid:100002283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"eubanks7.com"; classtype:trojan-activity; sid:100002284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"europeanzonexxi.com"; classtype:trojan-activity; sid:100002285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"exilum.com"; classtype:trojan-activity; sid:100002286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"exitoalfaomega.co"; classtype:trojan-activity; sid:100002287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"extrovertoffers.com"; classtype:trojan-activity; sid:100002288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"f1sol.com"; classtype:trojan-activity; sid:100002289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"familydentist.site"; classtype:trojan-activity; sid:100002290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"faveraprojects.com"; classtype:trojan-activity; sid:100002291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fc.co.mz"; classtype:trojan-activity; sid:100002292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"felicienne.nl"; classtype:trojan-activity; sid:100002293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"files.martellexpress.us"; classtype:trojan-activity; sid:100002294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"files6.uludagbilisim.com"; classtype:trojan-activity; sid:100002295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"final.makkahkmcc.com"; classtype:trojan-activity; sid:100002296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fineartgallerym.com"; classtype:trojan-activity; sid:100002297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fisconline.bar"; classtype:trojan-activity; sid:100002298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fisconline.casa"; classtype:trojan-activity; sid:100002299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fix-america-now.org"; classtype:trojan-activity; sid:100002300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fixauto.illumetechnology.com"; classtype:trojan-activity; sid:100002301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fixturegovernment.com"; classtype:trojan-activity; sid:100002302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fkd.derpcity.ru"; classtype:trojan-activity; sid:100002303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flexypay.dsquaregroup.com"; classtype:trojan-activity; sid:100002304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flintspin.com"; classtype:trojan-activity; sid:100002305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"flyingbuddhadesign.com"; classtype:trojan-activity; sid:100002306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fmjplastering.co.uk"; classtype:trojan-activity; sid:100002307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"follower.instantcashback.in"; classtype:trojan-activity; sid:100002308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foothills.com.br"; classtype:trojan-activity; sid:100002309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"footweardirect.elin.co.za"; classtype:trojan-activity; sid:100002310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"forum.mdb.nu"; classtype:trojan-activity; sid:100002311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fotoobjetivo.com"; classtype:trojan-activity; sid:100002312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foundationrepairhoustontx.net"; classtype:trojan-activity; sid:100002313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"foxeps.com.br"; classtype:trojan-activity; sid:100002314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freecnetdownload.com"; classtype:trojan-activity; sid:100002315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"freisites.com.br"; classtype:trojan-activity; sid:100002316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ftp.n3twork30cm.ml"; classtype:trojan-activity; sid:100002317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fullelectronica.com.ar"; classtype:trojan-activity; sid:100002318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"funletters.net"; classtype:trojan-activity; sid:100002319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"fusionfiresolutions.com"; classtype:trojan-activity; sid:100002320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"futbolpr.com"; classtype:trojan-activity; sid:100002321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"futuregraphics.com.ar"; classtype:trojan-activity; sid:100002322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"g.pinmonkey.xyz"; classtype:trojan-activity; sid:100002323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gaditastour.com"; classtype:trojan-activity; sid:100002324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gametwogame.com"; classtype:trojan-activity; sid:100002325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"garciadogshow.com"; classtype:trojan-activity; sid:100002326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"garenanow.myvnc.com"; classtype:trojan-activity; sid:100002327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"garenanow4.myvnc.com"; classtype:trojan-activity; sid:100002328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gastoudergonny.nl"; classtype:trojan-activity; sid:100002329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gbbulls.co.uk"; classtype:trojan-activity; sid:100002330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gcpc.co.id.chronoscurtain.com"; classtype:trojan-activity; sid:100002331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"generaldeviales.com"; classtype:trojan-activity; sid:100002332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gfmodd1.webselffiles01.com"; classtype:trojan-activity; sid:100002333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gfold1.webselffiles01.com"; classtype:trojan-activity; sid:100002334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ghettohub.co.za"; classtype:trojan-activity; sid:100002335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ghislain.dartois.pagesperso-orange.fr"; classtype:trojan-activity; sid:100002336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"giadungg7.com"; classtype:trojan-activity; sid:100002337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"giddos.ga"; classtype:trojan-activity; sid:100002338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"giteletropical.com"; classtype:trojan-activity; sid:100002339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"glowinmedia.co.ke"; classtype:trojan-activity; sid:100002340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gmtransformationacademy.com"; classtype:trojan-activity; sid:100002341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gmvadmission.org"; classtype:trojan-activity; sid:100002342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gnimelf.net"; classtype:trojan-activity; sid:100002343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gnscrew.ro"; classtype:trojan-activity; sid:100002344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gold.investforex.id"; classtype:trojan-activity; sid:100002345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldcake.co.id"; classtype:trojan-activity; sid:100002346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldcoastoffice365.com"; classtype:trojan-activity; sid:100002347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldcoastoffice365.com.au"; classtype:trojan-activity; sid:100002348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"golden-memories-funerals.yourpageserver.com"; classtype:trojan-activity; sid:100002349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldenasiacapital.com"; classtype:trojan-activity; sid:100002350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"goldmen.in"; classtype:trojan-activity; sid:100002351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gpotecnosystems.com"; classtype:trojan-activity; sid:100002352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gracejukes.com"; classtype:trojan-activity; sid:100002353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"grupoinmare.com"; classtype:trojan-activity; sid:100002354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gruposelt.000webhostapp.com"; classtype:trojan-activity; sid:100002355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gs.monerorx.com"; classtype:trojan-activity; sid:100002356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"guide-to-cell-phones.com"; classtype:trojan-activity; sid:100002357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gulfac-house.com"; classtype:trojan-activity; sid:100002358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"gvpcdpgc.edu.in"; classtype:trojan-activity; sid:100002359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"habbotips.free.fr"; classtype:trojan-activity; sid:100002360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hagebakken.no"; classtype:trojan-activity; sid:100002361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hamptonpartyoffive.com"; classtype:trojan-activity; sid:100002362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hashmati.com"; classtype:trojan-activity; sid:100002363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hassanproduct.com"; classtype:trojan-activity; sid:100002364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hchfug.org"; classtype:trojan-activity; sid:100002365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hd11315.com"; classtype:trojan-activity; sid:100002366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hdkamera2003.hu"; classtype:trojan-activity; sid:100002367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hds.sz4h.com"; classtype:trojan-activity; sid:100002368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"heavymaq.cl"; classtype:trojan-activity; sid:100002369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hellogorgeous.com.au"; classtype:trojan-activity; sid:100002370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"help.hizuko.com"; classtype:trojan-activity; sid:100002371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"herchinfitout.com.sg"; classtype:trojan-activity; sid:100002372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hhaward.org"; classtype:trojan-activity; sid:100002373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"highlandroadcoc.com"; classtype:trojan-activity; sid:100002374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"highlandslasvegas.atakdev.com"; classtype:trojan-activity; sid:100002375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hindi.factsriver.com"; classtype:trojan-activity; sid:100002376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hiptool.net"; classtype:trojan-activity; sid:100002377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hitpe.com"; classtype:trojan-activity; sid:100002378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hitstation.nl"; classtype:trojan-activity; sid:100002379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hmpmall.co.kr"; classtype:trojan-activity; sid:100002380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hoagietesting10.com"; classtype:trojan-activity; sid:100002381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hoayeuthuong-my.sharepoint.com"; classtype:trojan-activity; sid:100002382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"holmesservices.mobiledevsite.co"; classtype:trojan-activity; sid:100002383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"homefindersolutions.com"; classtype:trojan-activity; sid:100002384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hongluosi.com"; classtype:trojan-activity; sid:100002385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hookedupboatclub.com"; classtype:trojan-activity; sid:100002386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hostingparacolombia.com"; classtype:trojan-activity; sid:100002387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hostzaa.com"; classtype:trojan-activity; sid:100002388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"houstonshutters.site"; classtype:trojan-activity; sid:100002389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hr2019.vrcom7.com"; classtype:trojan-activity; sid:100002390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hseda.com"; classtype:trojan-activity; sid:100002391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hsmwebapp.com"; classtype:trojan-activity; sid:100002392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"htownbars.com"; classtype:trojan-activity; sid:100002393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hubtech.co.za"; classtype:trojan-activity; sid:100002394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"huellacero.cl"; classtype:trojan-activity; sid:100002395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hunchomusichub.com"; classtype:trojan-activity; sid:100002396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"hunggiang.vn"; classtype:trojan-activity; sid:100002397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"husamiyahschool.com"; classtype:trojan-activity; sid:100002398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iabmixx2020.rayadigital.online"; classtype:trojan-activity; sid:100002399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iam313.com"; classtype:trojan-activity; sid:100002400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"icon.shatangmu.cn"; classtype:trojan-activity; sid:100002401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idea-secure-login.com"; classtype:trojan-activity; sid:100002402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idilsoft.com"; classtype:trojan-activity; sid:100002403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idj.no"; classtype:trojan-activity; sid:100002404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"idvindia.com"; classtype:trojan-activity; sid:100002405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ieclb.com.br"; classtype:trojan-activity; sid:100002406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ikexpert.com"; classtype:trojan-activity; sid:100002407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ilrafrica.com"; classtype:trojan-activity; sid:100002408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"images.jermiau.com"; classtype:trojan-activity; sid:100002409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"imbueautoworx.co.za"; classtype:trojan-activity; sid:100002410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"in-tune2016.com"; classtype:trojan-activity; sid:100002411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"incrediblepixels.com"; classtype:trojan-activity; sid:100002412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"incredicole.com"; classtype:trojan-activity; sid:100002413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"indrasbikaner.com"; classtype:trojan-activity; sid:100002414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"infair.vn"; classtype:trojan-activity; sid:100002415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"infovator.com"; classtype:trojan-activity; sid:100002416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"initialnetworks.com"; classtype:trojan-activity; sid:100002417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inodesthetotaldesigners.com"; classtype:trojan-activity; sid:100002418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inrajahmundry.co.in"; classtype:trojan-activity; sid:100002419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"instantindialoan.com"; classtype:trojan-activity; sid:100002420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"intellectsmart.in"; classtype:trojan-activity; sid:100002421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"intersel-idf.org"; classtype:trojan-activity; sid:100002422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"intuitiveideas.com.my"; classtype:trojan-activity; sid:100002423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"inversiones.arrayanfinanciero.cl"; classtype:trojan-activity; sid:100002424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"invest.xpcorporative.com.br"; classtype:trojan-activity; sid:100002425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ipmes.ma"; classtype:trojan-activity; sid:100002426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iremart.es"; classtype:trojan-activity; sid:100002427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iris101.co.uk"; classtype:trojan-activity; sid:100002428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"isaac.mikhailmotoringschool.com"; classtype:trojan-activity; sid:100002429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iscamenabe.com"; classtype:trojan-activity; sid:100002430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"isiphephelocon.co.za"; classtype:trojan-activity; sid:100002431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ismf.com.ng"; classtype:trojan-activity; sid:100002432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"iso-dubai.net"; classtype:trojan-activity; sid:100002433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"israrulhaq.me"; classtype:trojan-activity; sid:100002434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"isrorg.com"; classtype:trojan-activity; sid:100002435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"isso.ps"; classtype:trojan-activity; sid:100002436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ist-security.com"; classtype:trojan-activity; sid:100002437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"it123.ru"; classtype:trojan-activity; sid:100002438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"italiandirezione.casa"; classtype:trojan-activity; sid:100002439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"itc-demo.softgig.co.ke"; classtype:trojan-activity; sid:100002440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"itmotasaciones.com"; classtype:trojan-activity; sid:100002441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jamiekaylive.com"; classtype:trojan-activity; sid:100002442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jansen-heesch.nl"; classtype:trojan-activity; sid:100002443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jathra.co.uk"; classtype:trojan-activity; sid:100002444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jay.diamondrelationscrm.us"; classtype:trojan-activity; sid:100002445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jebs.net.au"; classtype:trojan-activity; sid:100002446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jeffdahlke.com"; classtype:trojan-activity; sid:100002447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jiaoyuzixun.cn"; classtype:trojan-activity; sid:100002448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jing-da.com.tw"; classtype:trojan-activity; sid:100002449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jmtc.91756.cn"; classtype:trojan-activity; sid:100002450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jnanbharati.com"; classtype:trojan-activity; sid:100002451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jobs.thebeessolution.com"; classtype:trojan-activity; sid:100002452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"joelbonissilver.com"; classtype:trojan-activity; sid:100002453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"join.cl8movement.co.za"; classtype:trojan-activity; sid:100002454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"josegene.com"; classtype:trojan-activity; sid:100002455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jpwoodfordco.com"; classtype:trojan-activity; sid:100002456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jumpmanualjacobhiller.com"; classtype:trojan-activity; sid:100002457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"jupiter.toxsl.in"; classtype:trojan-activity; sid:100002458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"justinscott.com.au"; classtype:trojan-activity; sid:100002459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kadigital.co.uk"; classtype:trojan-activity; sid:100002460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kalawatihomes.com"; classtype:trojan-activity; sid:100002461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kalogirosfinance.com"; classtype:trojan-activity; sid:100002462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kaptaanchapal.com"; classtype:trojan-activity; sid:100002463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"karer.by"; classtype:trojan-activity; sid:100002464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"katanvetov.co.il"; classtype:trojan-activity; sid:100002465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"katelynn9506a.ru.com"; classtype:trojan-activity; sid:100002466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kensingtondriving.com"; classtype:trojan-activity; sid:100002467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ketofitnessexpert.com"; classtype:trojan-activity; sid:100002468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kevinjewelry.com.co"; classtype:trojan-activity; sid:100002469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"keywatch.yourpageserver.com"; classtype:trojan-activity; sid:100002470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kingssa.co.za"; classtype:trojan-activity; sid:100002471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kizitox.ga"; classtype:trojan-activity; sid:100002472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kjcpromo.com"; classtype:trojan-activity; sid:100002473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kleinendeli.co.za"; classtype:trojan-activity; sid:100002474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"korrectconceptservices.com"; classtype:trojan-activity; sid:100002475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"krisbadminton.com"; classtype:trojan-activity; sid:100002476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ktb.sch.id"; classtype:trojan-activity; sid:100002477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kubatoglubaklava.com.tr"; classtype:trojan-activity; sid:100002478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kumaralok.in"; classtype:trojan-activity; sid:100002479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kwanfromhongkong.com"; classtype:trojan-activity; sid:100002480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"kz.sldov.ru"; classtype:trojan-activity; sid:100002481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lacasadelosalebrijes.com"; classtype:trojan-activity; sid:100002482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ladylabonde.com"; classtype:trojan-activity; sid:100002483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lameguard.ru"; classtype:trojan-activity; sid:100002484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"laodongnhat.vn"; classtype:trojan-activity; sid:100002485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"laravel.pointersoftwares.com.br"; classtype:trojan-activity; sid:100002486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lasermobilesounds.co.uk"; classtype:trojan-activity; sid:100002487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lauratomismith.com"; classtype:trojan-activity; sid:100002488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lautarosanmiguel.com"; classtype:trojan-activity; sid:100002489; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lawforall.edu.lk"; classtype:trojan-activity; sid:100002490; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lawschoolideas.xyz"; classtype:trojan-activity; sid:100002491; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lceventos.net"; classtype:trojan-activity; sid:100002492; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ld.mediaget.com"; classtype:trojan-activity; sid:100002493; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ldgcorp.com"; classtype:trojan-activity; sid:100002494; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"learning.real-academy.net"; classtype:trojan-activity; sid:100002495; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leasiacherise.com"; classtype:trojan-activity; sid:100002496; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leczkregoslup.acelero.pl"; classtype:trojan-activity; sid:100002497; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"legend.nu"; classtype:trojan-activity; sid:100002498; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"leluibuffet.com.br"; classtype:trojan-activity; sid:100002499; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lestesteux.ca"; classtype:trojan-activity; sid:100002500; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"library.arihantmbainstitute.ac.in"; classtype:trojan-activity; sid:100002501; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"library.uib.ac.id"; classtype:trojan-activity; sid:100002502; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lidoraggiodisole.it"; classtype:trojan-activity; sid:100002503; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lifebeam.elin.co.za"; classtype:trojan-activity; sid:100002504; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lindnerelektroanlagen.de"; classtype:trojan-activity; sid:100002505; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"linkintec.cn"; classtype:trojan-activity; sid:100002506; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"liquidaz.casa"; classtype:trojan-activity; sid:100002507; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"livetrack.in"; classtype:trojan-activity; sid:100002508; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lloydsindian.co.uk"; classtype:trojan-activity; sid:100002509; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lm.stagingarea.co.za"; classtype:trojan-activity; sid:100002510; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lmaancha.co.il"; classtype:trojan-activity; sid:100002511; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lms.cstdevs.com"; classtype:trojan-activity; sid:100002512; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lms.login2.in"; classtype:trojan-activity; sid:100002513; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"location-voitures.ma"; classtype:trojan-activity; sid:100002514; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"login.trezor.com.stockfootagesindia.com"; classtype:trojan-activity; sid:100002515; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"logotypfabriken.se"; classtype:trojan-activity; sid:100002516; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lotix.de"; classtype:trojan-activity; sid:100002517; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lotusanddragonfly.com"; classtype:trojan-activity; sid:100002518; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lp.definerisco.com"; classtype:trojan-activity; sid:100002519; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"lp.difusodesign.com"; classtype:trojan-activity; sid:100002520; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ltc.typoten.com"; classtype:trojan-activity; sid:100002521; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luckybrownie.com"; classtype:trojan-activity; sid:100002522; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luminouspneuma.com"; classtype:trojan-activity; sid:100002523; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"luxomodels.com"; classtype:trojan-activity; sid:100002524; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"m-technics.kz"; classtype:trojan-activity; sid:100002525; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"m.estudiomoros.com.ar"; classtype:trojan-activity; sid:100002526; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"m.softsharks.com"; classtype:trojan-activity; sid:100002527; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"madicon.co.za"; classtype:trojan-activity; sid:100002528; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"magianegramagiablancayamarres.com"; classtype:trojan-activity; sid:100002529; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mail.bs-eiendomme.co.za"; classtype:trojan-activity; sid:100002530; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mail.golimoapp.com"; classtype:trojan-activity; sid:100002531; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mail.jeffsono.org"; classtype:trojan-activity; sid:100002532; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"maksi.feb.unib.ac.id"; classtype:trojan-activity; sid:100002533; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"malaya.tv"; classtype:trojan-activity; sid:100002534; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"malwarecoding.github.io"; classtype:trojan-activity; sid:100002535; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"managed.oss-cn-beijing.aliyuncs.com"; classtype:trojan-activity; sid:100002536; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"managemysalon.in"; classtype:trojan-activity; sid:100002537; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manantialesdelnorte.uy"; classtype:trojan-activity; sid:100002538; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"manhtien.net"; classtype:trojan-activity; sid:100002539; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mario-sunjic.com"; classtype:trojan-activity; sid:100002540; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mariobrown.net"; classtype:trojan-activity; sid:100002541; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mariotessarollo.com"; classtype:trojan-activity; sid:100002542; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"marketinfosales.com"; classtype:trojan-activity; sid:100002543; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"marketing.enexusgroup.com.au"; classtype:trojan-activity; sid:100002544; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"marksidfgs.ug"; classtype:trojan-activity; sid:100002545; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"masjidhabeebiyarazviya.mysunni.com"; classtype:trojan-activity; sid:100002546; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mastersofclientretention.com.au"; classtype:trojan-activity; sid:100002547; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"materialescantu.com"; classtype:trojan-activity; sid:100002548; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"matruchhaya.co.in"; classtype:trojan-activity; sid:100002549; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"maxiquim.cl"; classtype:trojan-activity; sid:100002550; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"maxtox.com.pk"; classtype:trojan-activity; sid:100002551; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mbgrm.com"; classtype:trojan-activity; sid:100002552; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mbjtimes.com"; classtype:trojan-activity; sid:100002553; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mbsolutions.ge"; classtype:trojan-activity; sid:100002554; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mbx.com.au"; classtype:trojan-activity; sid:100002555; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mdasa.elin.co.za"; classtype:trojan-activity; sid:100002556; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medevlb.org"; classtype:trojan-activity; sid:100002557; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"media-server.skyinternet.com.pk"; classtype:trojan-activity; sid:100002558; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medianews.ge"; classtype:trojan-activity; sid:100002559; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mediawaysnews.com"; classtype:trojan-activity; sid:100002560; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"medistaffconsulting.com"; classtype:trojan-activity; sid:100002561; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"meeweb.com"; classtype:trojan-activity; sid:100002562; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"megagynreformas.com.br"; classtype:trojan-activity; sid:100002563; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"megamart.afnan-amc.com"; classtype:trojan-activity; sid:100002564; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mehainteriors.com"; classtype:trojan-activity; sid:100002565; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mercabits.com"; classtype:trojan-activity; sid:100002566; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"merkathink.com"; classtype:trojan-activity; sid:100002567; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mertlog.com"; classtype:trojan-activity; sid:100002568; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"metalin-cr.com"; classtype:trojan-activity; sid:100002569; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mettaanand.org"; classtype:trojan-activity; sid:100002570; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"meuoculosnanet.com.br"; classtype:trojan-activity; sid:100002571; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mfevr.com"; classtype:trojan-activity; sid:100002572; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mhkdhotbot.myvnc.com"; classtype:trojan-activity; sid:100002573; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mhkdhotbot80.myvnc.com"; classtype:trojan-activity; sid:100002574; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"micalle.com.au"; classtype:trojan-activity; sid:100002575; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"michaelphilip.com"; classtype:trojan-activity; sid:100002576; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"michimal2.000webhostapp.com"; classtype:trojan-activity; sid:100002577; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"microblading.mirliandias.com.br"; classtype:trojan-activity; sid:100002578; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"microcomm-group.com"; classtype:trojan-activity; sid:100002579; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mikhailmotoringschool.com"; classtype:trojan-activity; sid:100002580; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mills-skyla30ec.com"; classtype:trojan-activity; sid:100002581; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mingguanwms.com"; classtype:trojan-activity; sid:100002582; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"minuevavida.org"; classtype:trojan-activity; sid:100002583; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mirror.mypage.sk"; classtype:trojan-activity; sid:100002584; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mis.nbcc.ac.th"; classtype:trojan-activity; sid:100002585; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"misterson.com"; classtype:trojan-activity; sid:100002586; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mkontakt.az"; classtype:trojan-activity; sid:100002587; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mktf.mx"; classtype:trojan-activity; sid:100002588; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mmogollon.com.mx"; classtype:trojan-activity; sid:100002589; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"mncarteam.com"; classtype:trojan-activity; sid:100002590; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"modelhouseturkey.com"; classtype:trojan-activity; sid:100002591; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"modernmanna.org"; classtype:trojan-activity; sid:100002592; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"monetization.business"; classtype:trojan-activity; sid:100002593; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"moninediy.com"; classtype:trojan-activity; sid:100002594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"motorcomunicacion.com"; classtype:trojan-activity; sid:100002595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"moumitas.com"; classtype:trojan-activity; sid:100002596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"msacontabil.com.br"; classtype:trojan-activity; sid:100002597; rev:1;) @@ -2616,7 +2616,7 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nap.mgsservers.com"; classtype:trojan-activity; sid:100002610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"navayurveda.in"; classtype:trojan-activity; sid:100002611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nec-i.com"; classtype:trojan-activity; sid:100002612; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nellaimasthanbiryani.com"; classtype:trojan-activity; sid:100002613; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nelitrianggraeni.000webhostapp.com"; classtype:trojan-activity; sid:100002613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nerve.untergrund.net"; classtype:trojan-activity; sid:100002614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nettube.com.br"; classtype:trojan-activity; sid:100002615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"networkwheels.co.za"; classtype:trojan-activity; sid:100002616; rev:1;) @@ -2635,134 +2635,134 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nilinkeji.com"; classtype:trojan-activity; sid:100002629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nimboohomes.com"; classtype:trojan-activity; sid:100002630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"njtiledesigncenter.com"; classtype:trojan-activity; sid:100002631; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nobius.org"; classtype:trojan-activity; sid:100002632; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nocalnoodle.elin.co.za"; classtype:trojan-activity; sid:100002633; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nomadicbees.com"; classtype:trojan-activity; sid:100002634; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"northnodegroup.com.au"; classtype:trojan-activity; sid:100002635; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"notamuzikaletleri.com"; classtype:trojan-activity; sid:100002636; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ns1.the-widyantos.com"; classtype:trojan-activity; sid:100002637; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nsb.org.uk"; classtype:trojan-activity; sid:100002638; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nurmarkaz.org"; classtype:trojan-activity; sid:100002639; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nxtnet.ga"; classtype:trojan-activity; sid:100002640; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nyasabigbullets.com"; classtype:trojan-activity; sid:100002641; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nyeh2o.com.au"; classtype:trojan-activity; sid:100002642; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"obseques-conseils.com"; classtype:trojan-activity; sid:100002643; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oecteam.com"; classtype:trojan-activity; sid:100002644; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ohsewgorgeous.co.uk"; classtype:trojan-activity; sid:100002645; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oknoplastik.sk"; classtype:trojan-activity; sid:100002646; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oleholeh.memangbeda.website"; classtype:trojan-activity; sid:100002647; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"omaia.org"; classtype:trojan-activity; sid:100002648; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"omaromatic.com"; classtype:trojan-activity; sid:100002649; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"omega.az"; classtype:trojan-activity; sid:100002650; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oms.pappai.com"; classtype:trojan-activity; sid:100002651; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"omscoc.pappai.com"; classtype:trojan-activity; sid:100002652; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onedigitalcard.granvizionnecorp.com"; classtype:trojan-activity; sid:100002653; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onedrive.listifyapp.co"; classtype:trojan-activity; sid:100002654; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"online.creedglobal.in"; classtype:trojan-activity; sid:100002655; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onlinestatis.bar"; classtype:trojan-activity; sid:100002656; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"open.warehousesaas.co.uk"; classtype:trojan-activity; sid:100002657; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"opolis.io"; classtype:trojan-activity; sid:100002658; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"opticaoptigral.cl"; classtype:trojan-activity; sid:100002659; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"optimus.com.sg"; classtype:trojan-activity; sid:100002660; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"order.bizpeed.com"; classtype:trojan-activity; sid:100002661; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"orientgatewayltd.com"; classtype:trojan-activity; sid:100002662; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"orion445.com"; classtype:trojan-activity; sid:100002663; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oserve.pk"; classtype:trojan-activity; sid:100002664; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ot.weenets.com"; classtype:trojan-activity; sid:100002665; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"outletdosaquecedores.com.br"; classtype:trojan-activity; sid:100002666; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ozemag.com"; classtype:trojan-activity; sid:100002667; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"p1.lingpao8.com"; classtype:trojan-activity; sid:100002668; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"p3.zbjimg.com"; classtype:trojan-activity; sid:100002669; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"p6.zbjimg.com"; classtype:trojan-activity; sid:100002670; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pablobrothel.com.ar"; classtype:trojan-activity; sid:100002671; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pacificgroup.ws"; classtype:trojan-activity; sid:100002672; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pacwebdesigns.com"; classtype:trojan-activity; sid:100002673; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pagos.krayem.com.mx"; classtype:trojan-activity; sid:100002674; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"palbas.cl"; classtype:trojan-activity; sid:100002675; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"palochusvet.szm.com"; classtype:trojan-activity; sid:100002676; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"parallel.rockvideos.at"; classtype:trojan-activity; sid:100002677; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"parejasfelices.mi-fs.com"; classtype:trojan-activity; sid:100002678; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"parkhussion.com"; classtype:trojan-activity; sid:100002679; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pastorpaulocosta.com"; classtype:trojan-activity; sid:100002680; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patch2.51lg.com"; classtype:trojan-activity; sid:100002681; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patch2.99ddd.com"; classtype:trojan-activity; sid:100002682; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patch3.99ddd.com"; classtype:trojan-activity; sid:100002683; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"paths.elin.co.za"; classtype:trojan-activity; sid:100002684; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patriotsupremehemp.com"; classtype:trojan-activity; sid:100002685; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"paulmercier.biz"; classtype:trojan-activity; sid:100002686; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"payerrealty.com"; classtype:trojan-activity; sid:100002687; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"payments.atifsiddiqui.me"; classtype:trojan-activity; sid:100002688; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pcsoori.com"; classtype:trojan-activity; sid:100002689; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pd.oceaniarp.net"; classtype:trojan-activity; sid:100002690; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pemdodo.com"; classtype:trojan-activity; sid:100002691; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"perfumeriamontes.es"; classtype:trojan-activity; sid:100002692; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"periodiche.bar"; classtype:trojan-activity; sid:100002693; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"perpus.onlineman7-jombang.sch.id"; classtype:trojan-activity; sid:100002694; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"perpustekim.untirta.ac.id"; classtype:trojan-activity; sid:100002695; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pestoclean.co.uk"; classtype:trojan-activity; sid:100002696; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"petercollie.com"; classtype:trojan-activity; sid:100002697; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ph4s.ru"; classtype:trojan-activity; sid:100002698; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"phasdesign.com"; classtype:trojan-activity; sid:100002699; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"phenhuong.sanpham.online"; classtype:trojan-activity; sid:100002700; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"phittc.com"; classtype:trojan-activity; sid:100002701; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"photo360.kubooking.com"; classtype:trojan-activity; sid:100002702; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pink99.com"; classtype:trojan-activity; sid:100002703; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"plasfan.ind.br"; classtype:trojan-activity; sid:100002704; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"playground2.grupoaliadasca.com"; classtype:trojan-activity; sid:100002705; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pmglance.startwriteup.com"; classtype:trojan-activity; sid:100002706; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pokojewewladyslawowie.pl"; classtype:trojan-activity; sid:100002707; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pole.com.vc"; classtype:trojan-activity; sid:100002708; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pool.phxdir.com"; classtype:trojan-activity; sid:100002709; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pooltablemoversdenver.net"; classtype:trojan-activity; sid:100002710; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"posmicrosystems.com"; classtype:trojan-activity; sid:100002711; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"poulman.panagiotopoulos-tours.gr"; classtype:trojan-activity; sid:100002712; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ppdb.smk-ciptaskill.sch.id"; classtype:trojan-activity; sid:100002713; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prestasicash.com.ar"; classtype:trojan-activity; sid:100002714; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prestigehomeautomation.net"; classtype:trojan-activity; sid:100002715; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"preview2.behalen.com"; classtype:trojan-activity; sid:100002716; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prishaartcreations.com"; classtype:trojan-activity; sid:100002717; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"production.sparshims.com"; classtype:trojan-activity; sid:100002718; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"programaoperadoronline.com.br"; classtype:trojan-activity; sid:100002719; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"project.exquitec.com"; classtype:trojan-activity; sid:100002720; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"promotoradescomplica.com.br"; classtype:trojan-activity; sid:100002721; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"promoversdubai.com"; classtype:trojan-activity; sid:100002722; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"propertiq.elin.co.za"; classtype:trojan-activity; sid:100002723; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"propertiq2.elin.co.za"; classtype:trojan-activity; sid:100002724; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prosoc.nl"; classtype:trojan-activity; sid:100002725; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prosupport.cl"; classtype:trojan-activity; sid:100002726; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prosyarmakassar.com"; classtype:trojan-activity; sid:100002727; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"provence.elin.co.za"; classtype:trojan-activity; sid:100002728; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prox.realunix.cc"; classtype:trojan-activity; sid:100002729; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prueba.danielluza.com"; classtype:trojan-activity; sid:100002730; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pujashoppe.in"; classtype:trojan-activity; sid:100002731; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"punchdialogues.com"; classtype:trojan-activity; sid:100002732; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"punjabdevelopersassociation.com.pk"; classtype:trojan-activity; sid:100002733; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pvcprinting.co.uk"; classtype:trojan-activity; sid:100002734; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"qadir.tickfa.ir"; classtype:trojan-activity; sid:100002735; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"qatarglobalconsulting.com"; classtype:trojan-activity; sid:100002736; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"qmsled.com"; classtype:trojan-activity; sid:100002737; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"quartier-midi.be"; classtype:trojan-activity; sid:100002738; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"querocar.com"; classtype:trojan-activity; sid:100002739; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rachmat-assuhaimi.my.id"; classtype:trojan-activity; sid:100002740; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"radioafifense.deploys.live"; classtype:trojan-activity; sid:100002741; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rainbowisp.info"; classtype:trojan-activity; sid:100002742; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rajeshtailang.com"; classtype:trojan-activity; sid:100002743; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rakeshkhatri.in"; classtype:trojan-activity; sid:100002744; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"raodigitalmedia.com"; classtype:trojan-activity; sid:100002745; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"raquelhelena.com.br"; classtype:trojan-activity; sid:100002746; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rarlabarchiver.ac"; classtype:trojan-activity; sid:100002747; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rasadbar.ir"; classtype:trojan-activity; sid:100002748; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rashika.ascarvalho.co.za"; classtype:trojan-activity; sid:100002749; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ratemyfenancialadvisor.com"; classtype:trojan-activity; sid:100002750; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ravenproductionsltd.com"; classtype:trojan-activity; sid:100002751; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rc.ixiaoyang.cn"; classtype:trojan-activity; sid:100002752; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rcmesilva.charbelsales.com.br"; classtype:trojan-activity; sid:100002753; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"reacredit.com.br"; classtype:trojan-activity; sid:100002754; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"readwrite26.nl"; classtype:trojan-activity; sid:100002755; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"readymmade.com"; classtype:trojan-activity; sid:100002756; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recyclethesurplus.com"; classtype:trojan-activity; sid:100002757; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"redbats.co.in"; classtype:trojan-activity; sid:100002758; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"redboxmultimedia.com"; classtype:trojan-activity; sid:100002759; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nmxwllwsdyminoragenw.dns.army"; classtype:trojan-activity; sid:100002632; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nobius.org"; classtype:trojan-activity; sid:100002633; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nocalnoodle.elin.co.za"; classtype:trojan-activity; sid:100002634; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nomadicbees.com"; classtype:trojan-activity; sid:100002635; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"northnodegroup.com.au"; classtype:trojan-activity; sid:100002636; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"notamuzikaletleri.com"; classtype:trojan-activity; sid:100002637; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ns1.the-widyantos.com"; classtype:trojan-activity; sid:100002638; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nsb.org.uk"; classtype:trojan-activity; sid:100002639; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nurmarkaz.org"; classtype:trojan-activity; sid:100002640; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nxtnet.ga"; classtype:trojan-activity; sid:100002641; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nyasabigbullets.com"; classtype:trojan-activity; sid:100002642; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"nyeh2o.com.au"; classtype:trojan-activity; sid:100002643; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"obseques-conseils.com"; classtype:trojan-activity; sid:100002644; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oecteam.com"; classtype:trojan-activity; sid:100002645; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ohe.ie"; classtype:trojan-activity; sid:100002646; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ohsewgorgeous.co.uk"; classtype:trojan-activity; sid:100002647; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oknoplastik.sk"; classtype:trojan-activity; sid:100002648; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oleholeh.memangbeda.website"; classtype:trojan-activity; sid:100002649; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"omaia.org"; classtype:trojan-activity; sid:100002650; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"omaromatic.com"; classtype:trojan-activity; sid:100002651; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"omega.az"; classtype:trojan-activity; sid:100002652; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oms.pappai.com"; classtype:trojan-activity; sid:100002653; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"omscoc.pappai.com"; classtype:trojan-activity; sid:100002654; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onedigitalcard.granvizionnecorp.com"; classtype:trojan-activity; sid:100002655; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onedrive.listifyapp.co"; classtype:trojan-activity; sid:100002656; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"online.creedglobal.in"; classtype:trojan-activity; sid:100002657; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"onlinestatis.bar"; classtype:trojan-activity; sid:100002658; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"open.warehousesaas.co.uk"; classtype:trojan-activity; sid:100002659; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"opolis.io"; classtype:trojan-activity; sid:100002660; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"opticaoptigral.cl"; classtype:trojan-activity; sid:100002661; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"optimus.com.sg"; classtype:trojan-activity; sid:100002662; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"order.bizpeed.com"; classtype:trojan-activity; sid:100002663; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"orientgatewayltd.com"; classtype:trojan-activity; sid:100002664; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"orion445.com"; classtype:trojan-activity; sid:100002665; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"oserve.pk"; classtype:trojan-activity; sid:100002666; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ot.weenets.com"; classtype:trojan-activity; sid:100002667; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"outletdosaquecedores.com.br"; classtype:trojan-activity; sid:100002668; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ozemag.com"; classtype:trojan-activity; sid:100002669; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"p1.lingpao8.com"; classtype:trojan-activity; sid:100002670; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"p3.zbjimg.com"; classtype:trojan-activity; sid:100002671; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"p6.zbjimg.com"; classtype:trojan-activity; sid:100002672; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pablobrothel.com.ar"; classtype:trojan-activity; sid:100002673; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pacificgroup.ws"; classtype:trojan-activity; sid:100002674; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pacwebdesigns.com"; classtype:trojan-activity; sid:100002675; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pagos.krayem.com.mx"; classtype:trojan-activity; sid:100002676; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"palbas.cl"; classtype:trojan-activity; sid:100002677; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"palochusvet.szm.com"; classtype:trojan-activity; sid:100002678; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"panslimiterd.com"; classtype:trojan-activity; sid:100002679; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"parallel.rockvideos.at"; classtype:trojan-activity; sid:100002680; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"parejasfelices.mi-fs.com"; classtype:trojan-activity; sid:100002681; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"parkhussion.com"; classtype:trojan-activity; sid:100002682; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pastorpaulocosta.com"; classtype:trojan-activity; sid:100002683; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patch2.51lg.com"; classtype:trojan-activity; sid:100002684; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patch2.99ddd.com"; classtype:trojan-activity; sid:100002685; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patch3.99ddd.com"; classtype:trojan-activity; sid:100002686; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"paths.elin.co.za"; classtype:trojan-activity; sid:100002687; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"patriotsupremehemp.com"; classtype:trojan-activity; sid:100002688; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"paulmercier.biz"; classtype:trojan-activity; sid:100002689; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"payerrealty.com"; classtype:trojan-activity; sid:100002690; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"payments.atifsiddiqui.me"; classtype:trojan-activity; sid:100002691; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pcsoori.com"; classtype:trojan-activity; sid:100002692; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pd.oceaniarp.net"; classtype:trojan-activity; sid:100002693; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pemdodo.com"; classtype:trojan-activity; sid:100002694; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"perfumeriamontes.es"; classtype:trojan-activity; sid:100002695; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"periodiche.bar"; classtype:trojan-activity; sid:100002696; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"perpus.onlineman7-jombang.sch.id"; classtype:trojan-activity; sid:100002697; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"perpustekim.untirta.ac.id"; classtype:trojan-activity; sid:100002698; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pestoclean.co.uk"; classtype:trojan-activity; sid:100002699; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"petercollie.com"; classtype:trojan-activity; sid:100002700; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ph4s.ru"; classtype:trojan-activity; sid:100002701; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"phasdesign.com"; classtype:trojan-activity; sid:100002702; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"phenhuong.sanpham.online"; classtype:trojan-activity; sid:100002703; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"phittc.com"; classtype:trojan-activity; sid:100002704; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"photo360.kubooking.com"; classtype:trojan-activity; sid:100002705; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pink99.com"; classtype:trojan-activity; sid:100002706; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"plasfan.ind.br"; classtype:trojan-activity; sid:100002707; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"playground2.grupoaliadasca.com"; classtype:trojan-activity; sid:100002708; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pmglance.startwriteup.com"; classtype:trojan-activity; sid:100002709; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pmrimewsdylimtewsogh.dns.army"; classtype:trojan-activity; sid:100002710; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pokojewewladyslawowie.pl"; classtype:trojan-activity; sid:100002711; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pole.com.vc"; classtype:trojan-activity; sid:100002712; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pool.phxdir.com"; classtype:trojan-activity; sid:100002713; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pooltablemoversdenver.net"; classtype:trojan-activity; sid:100002714; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"posmicrosystems.com"; classtype:trojan-activity; sid:100002715; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"poulman.panagiotopoulos-tours.gr"; classtype:trojan-activity; sid:100002716; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ppdb.smk-ciptaskill.sch.id"; classtype:trojan-activity; sid:100002717; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prestasicash.com.ar"; classtype:trojan-activity; sid:100002718; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prestigehomeautomation.net"; classtype:trojan-activity; sid:100002719; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"preview2.behalen.com"; classtype:trojan-activity; sid:100002720; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prishaartcreations.com"; classtype:trojan-activity; sid:100002721; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"production.sparshims.com"; classtype:trojan-activity; sid:100002722; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"programaoperadoronline.com.br"; classtype:trojan-activity; sid:100002723; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"promotoradescomplica.com.br"; classtype:trojan-activity; sid:100002724; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"promoversdubai.com"; classtype:trojan-activity; sid:100002725; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"propertiq.elin.co.za"; classtype:trojan-activity; sid:100002726; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"propertiq2.elin.co.za"; classtype:trojan-activity; sid:100002727; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prosoc.nl"; classtype:trojan-activity; sid:100002728; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prosupport.cl"; classtype:trojan-activity; sid:100002729; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prosyarmakassar.com"; classtype:trojan-activity; sid:100002730; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"provence.elin.co.za"; classtype:trojan-activity; sid:100002731; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"prox.realunix.cc"; classtype:trojan-activity; sid:100002732; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pujashoppe.in"; classtype:trojan-activity; sid:100002733; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"punchdialogues.com"; classtype:trojan-activity; sid:100002734; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"punjabdevelopersassociation.com.pk"; classtype:trojan-activity; sid:100002735; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"pvcprinting.co.uk"; classtype:trojan-activity; sid:100002736; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"qadir.tickfa.ir"; classtype:trojan-activity; sid:100002737; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"qatarglobalconsulting.com"; classtype:trojan-activity; sid:100002738; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"qmsled.com"; classtype:trojan-activity; sid:100002739; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"quartier-midi.be"; classtype:trojan-activity; sid:100002740; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"querocar.com"; classtype:trojan-activity; sid:100002741; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rachmat-assuhaimi.my.id"; classtype:trojan-activity; sid:100002742; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"radioafifense.deploys.live"; classtype:trojan-activity; sid:100002743; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rainbowisp.info"; classtype:trojan-activity; sid:100002744; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rajeshtailang.com"; classtype:trojan-activity; sid:100002745; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rakeshkhatri.in"; classtype:trojan-activity; sid:100002746; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"raquelhelena.com.br"; classtype:trojan-activity; sid:100002747; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rarlabarchiver.ac"; classtype:trojan-activity; sid:100002748; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rasadbar.ir"; classtype:trojan-activity; sid:100002749; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rashika.ascarvalho.co.za"; classtype:trojan-activity; sid:100002750; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ratemyfenancialadvisor.com"; classtype:trojan-activity; sid:100002751; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ravenproductionsltd.com"; classtype:trojan-activity; sid:100002752; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rc.ixiaoyang.cn"; classtype:trojan-activity; sid:100002753; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"rcmesilva.charbelsales.com.br"; classtype:trojan-activity; sid:100002754; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"reacredit.com.br"; classtype:trojan-activity; sid:100002755; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"readwrite26.nl"; classtype:trojan-activity; sid:100002756; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"readymmade.com"; classtype:trojan-activity; sid:100002757; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"recyclethesurplus.com"; classtype:trojan-activity; sid:100002758; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"redbats.co.in"; classtype:trojan-activity; sid:100002759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"redchillicrackers.com"; classtype:trojan-activity; sid:100002760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"reifenquick.de"; classtype:trojan-activity; sid:100002761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"relaxindulge.co.nz"; classtype:trojan-activity; sid:100002762; rev:1;) @@ -2846,145 +2846,145 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sibernetix.fr"; classtype:trojan-activity; sid:100002840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sigapresschennai.com"; classtype:trojan-activity; sid:100002841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sige.brisainformatica.com.br"; classtype:trojan-activity; sid:100002842; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"signatureads.co.in"; classtype:trojan-activity; sid:100002843; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"siili.net"; classtype:trojan-activity; sid:100002844; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"simoneporzi.it"; classtype:trojan-activity; sid:100002845; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"simorsint.com"; classtype:trojan-activity; sid:100002846; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"simplithy.co.uk"; classtype:trojan-activity; sid:100002847; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sindicato1ucm.cl"; classtype:trojan-activity; sid:100002848; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sindpol.tiejuris.com.br"; classtype:trojan-activity; sid:100002849; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sipahielektrik.com"; classtype:trojan-activity; sid:100002850; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sistelligent.com"; classtype:trojan-activity; sid:100002851; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"skare.net"; classtype:trojan-activity; sid:100002852; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"skyflyfares.com"; classtype:trojan-activity; sid:100002853; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"skyscan.com"; classtype:trojan-activity; sid:100002854; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"slot0.gamoruz.com"; classtype:trojan-activity; sid:100002855; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smarthouseforum.ru"; classtype:trojan-activity; sid:100002856; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smartzedu.com"; classtype:trojan-activity; sid:100002857; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smokesolutionindia.com"; classtype:trojan-activity; sid:100002858; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smritiphotography.in"; classtype:trojan-activity; sid:100002859; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sobariko.com"; classtype:trojan-activity; sid:100002860; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sobethuacademy.com"; classtype:trojan-activity; sid:100002861; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"soft.110route.com"; classtype:trojan-activity; sid:100002862; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"soft.officelabo.net"; classtype:trojan-activity; sid:100002863; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"softanis.net"; classtype:trojan-activity; sid:100002864; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sogecoenergy.com"; classtype:trojan-activity; sid:100002865; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sohs.conceptechs.info"; classtype:trojan-activity; sid:100002866; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"solar.amazingtribe.lk"; classtype:trojan-activity; sid:100002867; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"somcorbera.cat"; classtype:trojan-activity; sid:100002868; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"somir.com.mx"; classtype:trojan-activity; sid:100002869; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"soralapps.com"; classtype:trojan-activity; sid:100002870; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sota-france.fr"; classtype:trojan-activity; sid:100002871; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"space.proactint.org"; classtype:trojan-activity; sid:100002872; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spaceframe.mobi.space-frame.co.za"; classtype:trojan-activity; sid:100002873; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"special-key.cf"; classtype:trojan-activity; sid:100002874; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spent.com.pl"; classtype:trojan-activity; sid:100002875; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spetsesyachtcharter.gr"; classtype:trojan-activity; sid:100002876; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spititourism.com"; classtype:trojan-activity; sid:100002877; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spittinfire.com"; classtype:trojan-activity; sid:100002878; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"springbedspetroleum.com"; classtype:trojan-activity; sid:100002879; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"src1.minibai.com"; classtype:trojan-activity; sid:100002880; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sreenivasapaintingworks.com"; classtype:trojan-activity; sid:100002881; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sriglobalit.com"; classtype:trojan-activity; sid:100002882; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"srilankamovies.com"; classtype:trojan-activity; sid:100002883; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"srvmanos.no-ip.info"; classtype:trojan-activity; sid:100002884; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ss.monita.co.id"; classtype:trojan-activity; sid:100002885; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"st.devcodin.com"; classtype:trojan-activity; sid:100002886; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"staging.apparelpunch.com"; classtype:trojan-activity; sid:100002887; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"starcountry.net"; classtype:trojan-activity; sid:100002888; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"static.3001.net"; classtype:trojan-activity; sid:100002889; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stiau.iuc.ac"; classtype:trojan-activity; sid:100002890; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sticker.jewsjuice.com"; classtype:trojan-activity; sid:100002891; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stiedemann-alvah30hq.ru.com"; classtype:trojan-activity; sid:100002892; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stiepancasetia.ac.id"; classtype:trojan-activity; sid:100002893; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"store.ericalgarin.com"; classtype:trojan-activity; sid:100002894; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stott-thompson.co.uk"; classtype:trojan-activity; sid:100002895; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stratexec.co.za"; classtype:trojan-activity; sid:100002896; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streetdemo.yourpageserver.com"; classtype:trojan-activity; sid:100002897; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"suboldesign.com"; classtype:trojan-activity; sid:100002898; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sumerians.org"; classtype:trojan-activity; sid:100002899; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sunaryem.com.tr"; classtype:trojan-activity; sid:100002900; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sunbrero.com.au"; classtype:trojan-activity; sid:100002901; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sunmarkholidays.com"; classtype:trojan-activity; sid:100002902; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"support-4-free.com"; classtype:trojan-activity; sid:100002903; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"support.clz.kr"; classtype:trojan-activity; sid:100002904; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"supportit.online"; classtype:trojan-activity; sid:100002905; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sw.yourpageserver.com"; classtype:trojan-activity; sid:100002906; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sweaty.dk"; classtype:trojan-activity; sid:100002907; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sweet-diet.com"; classtype:trojan-activity; sid:100002908; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"swiftlogisticseg.com"; classtype:trojan-activity; sid:100002909; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"swwbia.com"; classtype:trojan-activity; sid:100002910; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syracusecoffee.com"; classtype:trojan-activity; sid:100002911; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sytraders.co"; classtype:trojan-activity; sid:100002912; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"t.honker.info"; classtype:trojan-activity; sid:100002913; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"t.netcatkit.com"; classtype:trojan-activity; sid:100002914; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tacticohosting.com"; classtype:trojan-activity; sid:100002915; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tadoo.ca"; classtype:trojan-activity; sid:100002916; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tafsantoursandtravels.com"; classtype:trojan-activity; sid:100002917; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tajushariya.com"; classtype:trojan-activity; sid:100002918; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tallyinvoicecustomization.com"; classtype:trojan-activity; sid:100002919; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"taltus.co.uk"; classtype:trojan-activity; sid:100002920; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tapalkoedacoffee.com"; classtype:trojan-activity; sid:100002921; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tarravalleyfoods.com.au"; classtype:trojan-activity; sid:100002922; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tavo.cl"; classtype:trojan-activity; sid:100002923; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tc.snpsresidential.com"; classtype:trojan-activity; sid:100002924; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tcy.198424.com"; classtype:trojan-activity; sid:100002925; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tdsp.yngw518.com"; classtype:trojan-activity; sid:100002926; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"techgms.com"; classtype:trojan-activity; sid:100002927; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"teduae.com"; classtype:trojan-activity; sid:100002928; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"teleargentina.com"; classtype:trojan-activity; sid:100002929; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"telescopelms.com"; classtype:trojan-activity; sid:100002930; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"temptmag.com"; classtype:trojan-activity; sid:100002931; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tencoconsulting.com"; classtype:trojan-activity; sid:100002932; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"teneth.co.za"; classtype:trojan-activity; sid:100002933; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tentandoserfitness.000webhostapp.com"; classtype:trojan-activity; sid:100002934; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tessrobins.com"; classtype:trojan-activity; sid:100002935; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.adventser.com"; classtype:trojan-activity; sid:100002936; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.letraele.es"; classtype:trojan-activity; sid:100002937; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.lubrico.in"; classtype:trojan-activity; sid:100002938; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.typoten.com"; classtype:trojan-activity; sid:100002939; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.wanepghana.org"; classtype:trojan-activity; sid:100002940; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test1.asistencia247.com"; classtype:trojan-activity; sid:100002941; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test1.milenial.id"; classtype:trojan-activity; sid:100002942; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test1.tenplusone.my"; classtype:trojan-activity; sid:100002943; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test2.basis-web.com"; classtype:trojan-activity; sid:100002944; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test2.marrenconstruction.ie"; classtype:trojan-activity; sid:100002945; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"testing.clickitsolutionsmw.com"; classtype:trojan-activity; sid:100002946; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"testing.thinkingcorp.in"; classtype:trojan-activity; sid:100002947; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"testnew.yourpageserver.com"; classtype:trojan-activity; sid:100002948; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"teteaffiche.stephanebillon.com"; classtype:trojan-activity; sid:100002949; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tewoerd.eu"; classtype:trojan-activity; sid:100002950; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"textile.softberg.ro"; classtype:trojan-activity; sid:100002951; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tharringtonsponsorship.com"; classtype:trojan-activity; sid:100002952; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thecleaningladiespdx.com"; classtype:trojan-activity; sid:100002953; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thecreativecafe.co.uk"; classtype:trojan-activity; sid:100002954; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thedesertship.com"; classtype:trojan-activity; sid:100002955; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thediasporianexperience.com"; classtype:trojan-activity; sid:100002956; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefamouscurrybazaar.co.uk"; classtype:trojan-activity; sid:100002957; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefuturelife.in"; classtype:trojan-activity; sid:100002958; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehighlightinterior.com"; classtype:trojan-activity; sid:100002959; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thekassia.co.uk"; classtype:trojan-activity; sid:100002960; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"themansionkasauli.com"; classtype:trojan-activity; sid:100002961; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theprofinn.com"; classtype:trojan-activity; sid:100002962; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thesummitpc.net"; classtype:trojan-activity; sid:100002963; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theurbantutors.com"; classtype:trojan-activity; sid:100002964; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thosewebbs.com"; classtype:trojan-activity; sid:100002965; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thriveink.com"; classtype:trojan-activity; sid:100002966; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tianangdep.com"; classtype:trojan-activity; sid:100002967; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tickfoods.tickme.lk"; classtype:trojan-activity; sid:100002968; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tidymasters.com.au"; classtype:trojan-activity; sid:100002969; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"timegonebuy.com"; classtype:trojan-activity; sid:100002970; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tksb.net"; classtype:trojan-activity; sid:100002971; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tlcc.com.gt"; classtype:trojan-activity; sid:100002972; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"todoapp.cstdevs.com"; classtype:trojan-activity; sid:100002973; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tonydong.com"; classtype:trojan-activity; sid:100002974; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tonyzone.com"; classtype:trojan-activity; sid:100002975; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tooba.tenplusone.my"; classtype:trojan-activity; sid:100002976; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tools.reimclub.com"; classtype:trojan-activity; sid:100002977; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"topcell9.com"; classtype:trojan-activity; sid:100002978; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"toplevel.com.br"; classtype:trojan-activity; sid:100002979; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"topmask.co.za"; classtype:trojan-activity; sid:100002980; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"torresquinterocorp.com"; classtype:trojan-activity; sid:100002981; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"siili.net"; classtype:trojan-activity; sid:100002843; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"simoneporzi.it"; classtype:trojan-activity; sid:100002844; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"simorsint.com"; classtype:trojan-activity; sid:100002845; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"simplithy.co.uk"; classtype:trojan-activity; sid:100002846; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sindicato1ucm.cl"; classtype:trojan-activity; sid:100002847; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sindpol.tiejuris.com.br"; classtype:trojan-activity; sid:100002848; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sipahielektrik.com"; classtype:trojan-activity; sid:100002849; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sistelligent.com"; classtype:trojan-activity; sid:100002850; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"skare.net"; classtype:trojan-activity; sid:100002851; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"skyflyfares.com"; classtype:trojan-activity; sid:100002852; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"skyscan.com"; classtype:trojan-activity; sid:100002853; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"slot0.gamoruz.com"; classtype:trojan-activity; sid:100002854; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smarthouseforum.ru"; classtype:trojan-activity; sid:100002855; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smartzedu.com"; classtype:trojan-activity; sid:100002856; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smokesolutionindia.com"; classtype:trojan-activity; sid:100002857; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"smritiphotography.in"; classtype:trojan-activity; sid:100002858; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sobariko.com"; classtype:trojan-activity; sid:100002859; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sobethuacademy.com"; classtype:trojan-activity; sid:100002860; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"soft.110route.com"; classtype:trojan-activity; sid:100002861; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"soft.officelabo.net"; classtype:trojan-activity; sid:100002862; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"softanis.net"; classtype:trojan-activity; sid:100002863; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sogecoenergy.com"; classtype:trojan-activity; sid:100002864; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sohs.conceptechs.info"; classtype:trojan-activity; sid:100002865; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"solar.amazingtribe.lk"; classtype:trojan-activity; sid:100002866; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"somcorbera.cat"; classtype:trojan-activity; sid:100002867; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"somir.com.mx"; classtype:trojan-activity; sid:100002868; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"soralapps.com"; classtype:trojan-activity; sid:100002869; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sota-france.fr"; classtype:trojan-activity; sid:100002870; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"space.proactint.org"; classtype:trojan-activity; sid:100002871; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spaceframe.mobi.space-frame.co.za"; classtype:trojan-activity; sid:100002872; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"special-key.cf"; classtype:trojan-activity; sid:100002873; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spent.com.pl"; classtype:trojan-activity; sid:100002874; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spetsesyachtcharter.gr"; classtype:trojan-activity; sid:100002875; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spititourism.com"; classtype:trojan-activity; sid:100002876; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"spittinfire.com"; classtype:trojan-activity; sid:100002877; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"src1.minibai.com"; classtype:trojan-activity; sid:100002878; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sreenivasapaintingworks.com"; classtype:trojan-activity; sid:100002879; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sriglobalit.com"; classtype:trojan-activity; sid:100002880; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"srilankamovies.com"; classtype:trojan-activity; sid:100002881; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"srvmanos.no-ip.info"; classtype:trojan-activity; sid:100002882; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ss.monita.co.id"; classtype:trojan-activity; sid:100002883; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"st.devcodin.com"; classtype:trojan-activity; sid:100002884; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"staging.apparelpunch.com"; classtype:trojan-activity; sid:100002885; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"starcountry.net"; classtype:trojan-activity; sid:100002886; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"static.3001.net"; classtype:trojan-activity; sid:100002887; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stiau.iuc.ac"; classtype:trojan-activity; sid:100002888; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sticker.jewsjuice.com"; classtype:trojan-activity; sid:100002889; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stiedemann-alvah30hq.ru.com"; classtype:trojan-activity; sid:100002890; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stiepancasetia.ac.id"; classtype:trojan-activity; sid:100002891; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"store.ericalgarin.com"; classtype:trojan-activity; sid:100002892; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stott-thompson.co.uk"; classtype:trojan-activity; sid:100002893; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"stratexec.co.za"; classtype:trojan-activity; sid:100002894; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"streetdemo.yourpageserver.com"; classtype:trojan-activity; sid:100002895; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"suboldesign.com"; classtype:trojan-activity; sid:100002896; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sumerians.org"; classtype:trojan-activity; sid:100002897; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sunaryem.com.tr"; classtype:trojan-activity; sid:100002898; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sunbrero.com.au"; classtype:trojan-activity; sid:100002899; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sunmarkholidays.com"; classtype:trojan-activity; sid:100002900; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"support-4-free.com"; classtype:trojan-activity; sid:100002901; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"support.clz.kr"; classtype:trojan-activity; sid:100002902; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"supportit.online"; classtype:trojan-activity; sid:100002903; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sw.yourpageserver.com"; classtype:trojan-activity; sid:100002904; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sweaty.dk"; classtype:trojan-activity; sid:100002905; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sweet-diet.com"; classtype:trojan-activity; sid:100002906; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"swiftlogisticseg.com"; classtype:trojan-activity; sid:100002907; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"swwbia.com"; classtype:trojan-activity; sid:100002908; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"syracusecoffee.com"; classtype:trojan-activity; sid:100002909; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"sytraders.co"; classtype:trojan-activity; sid:100002910; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"t.honker.info"; classtype:trojan-activity; sid:100002911; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"t.netcatkit.com"; classtype:trojan-activity; sid:100002912; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tacticohosting.com"; classtype:trojan-activity; sid:100002913; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tadoo.ca"; classtype:trojan-activity; sid:100002914; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tafsantoursandtravels.com"; classtype:trojan-activity; sid:100002915; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tajushariya.com"; classtype:trojan-activity; sid:100002916; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tallyinvoicecustomization.com"; classtype:trojan-activity; sid:100002917; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"taltus.co.uk"; classtype:trojan-activity; sid:100002918; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tarravalleyfoods.com.au"; classtype:trojan-activity; sid:100002919; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tavo.cl"; classtype:trojan-activity; sid:100002920; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tc.snpsresidential.com"; classtype:trojan-activity; sid:100002921; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tcy.198424.com"; classtype:trojan-activity; sid:100002922; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tdsp.yngw518.com"; classtype:trojan-activity; sid:100002923; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tech332.synology.me"; classtype:trojan-activity; sid:100002924; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"techgms.com"; classtype:trojan-activity; sid:100002925; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"teduae.com"; classtype:trojan-activity; sid:100002926; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"teleargentina.com"; classtype:trojan-activity; sid:100002927; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"telescopelms.com"; classtype:trojan-activity; sid:100002928; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"temptmag.com"; classtype:trojan-activity; sid:100002929; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tencoconsulting.com"; classtype:trojan-activity; sid:100002930; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"teneth.co.za"; classtype:trojan-activity; sid:100002931; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tentandoserfitness.000webhostapp.com"; classtype:trojan-activity; sid:100002932; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tessrobins.com"; classtype:trojan-activity; sid:100002933; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.adventser.com"; classtype:trojan-activity; sid:100002934; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.letraele.es"; classtype:trojan-activity; sid:100002935; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.lubrico.in"; classtype:trojan-activity; sid:100002936; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.typoten.com"; classtype:trojan-activity; sid:100002937; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test.wanepghana.org"; classtype:trojan-activity; sid:100002938; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test1.asistencia247.com"; classtype:trojan-activity; sid:100002939; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test1.milenial.id"; classtype:trojan-activity; sid:100002940; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test1.tenplusone.my"; classtype:trojan-activity; sid:100002941; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test2.basis-web.com"; classtype:trojan-activity; sid:100002942; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"test2.marrenconstruction.ie"; classtype:trojan-activity; sid:100002943; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"testing.clickitsolutionsmw.com"; classtype:trojan-activity; sid:100002944; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"testing.thinkingcorp.in"; classtype:trojan-activity; sid:100002945; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"testnew.yourpageserver.com"; classtype:trojan-activity; sid:100002946; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"teteaffiche.stephanebillon.com"; classtype:trojan-activity; sid:100002947; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tewoerd.eu"; classtype:trojan-activity; sid:100002948; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"textile.softberg.ro"; classtype:trojan-activity; sid:100002949; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tharringtonsponsorship.com"; classtype:trojan-activity; sid:100002950; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thecleaningladiespdx.com"; classtype:trojan-activity; sid:100002951; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thecreativecafe.co.uk"; classtype:trojan-activity; sid:100002952; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thedesertship.com"; classtype:trojan-activity; sid:100002953; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thediasporianexperience.com"; classtype:trojan-activity; sid:100002954; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefamouscurrybazaar.co.uk"; classtype:trojan-activity; sid:100002955; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thefuturelife.in"; classtype:trojan-activity; sid:100002956; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thehighlightinterior.com"; classtype:trojan-activity; sid:100002957; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thekassia.co.uk"; classtype:trojan-activity; sid:100002958; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"themansionkasauli.com"; classtype:trojan-activity; sid:100002959; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theprofinn.com"; classtype:trojan-activity; sid:100002960; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thesummitpc.net"; classtype:trojan-activity; sid:100002961; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theurbantutors.com"; classtype:trojan-activity; sid:100002962; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"theviewsdyjupcazfeqv.dns.army"; classtype:trojan-activity; sid:100002963; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thosewebbs.com"; classtype:trojan-activity; sid:100002964; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"thriveink.com"; classtype:trojan-activity; sid:100002965; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tianangdep.com"; classtype:trojan-activity; sid:100002966; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tickfoods.tickme.lk"; classtype:trojan-activity; sid:100002967; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tidymasters.com.au"; classtype:trojan-activity; sid:100002968; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"timegonebuy.com"; classtype:trojan-activity; sid:100002969; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tksb.net"; classtype:trojan-activity; sid:100002970; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tlcc.com.gt"; classtype:trojan-activity; sid:100002971; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"todoapp.cstdevs.com"; classtype:trojan-activity; sid:100002972; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tonydong.com"; classtype:trojan-activity; sid:100002973; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tonyzone.com"; classtype:trojan-activity; sid:100002974; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tooba.tenplusone.my"; classtype:trojan-activity; sid:100002975; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tools.reimclub.com"; classtype:trojan-activity; sid:100002976; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"topcell9.com"; classtype:trojan-activity; sid:100002977; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"toplevel.com.br"; classtype:trojan-activity; sid:100002978; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"topmask.co.za"; classtype:trojan-activity; sid:100002979; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"torresquinterocorp.com"; classtype:trojan-activity; sid:100002980; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"towme.services"; classtype:trojan-activity; sid:100002981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"toyotacollege.ac.th"; classtype:trojan-activity; sid:100002982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"tpke.hu"; classtype:trojan-activity; sid:100002983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"translaterjemah.com"; classtype:trojan-activity; sid:100002984; rev:1;) @@ -3008,15 +3008,15 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"umwelt-kirchhof.de"; classtype:trojan-activity; sid:100003002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unicorpbrunei.com"; classtype:trojan-activity; sid:100003003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uniengrisb.com"; classtype:trojan-activity; sid:100003004; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unisoftcc.com"; classtype:trojan-activity; sid:100003005; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unityindiversity.in"; classtype:trojan-activity; sid:100003006; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unyazitelecom.com"; classtype:trojan-activity; sid:100003007; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upcbpta.com"; classtype:trojan-activity; sid:100003008; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"urbantrapfest.cl"; classtype:trojan-activity; sid:100003009; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"used-jeans.fr"; classtype:trojan-activity; sid:100003010; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"useformoney.000webhostapp.com"; classtype:trojan-activity; sid:100003011; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uss.ac.th"; classtype:trojan-activity; sid:100003012; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uzzepay.com.br"; classtype:trojan-activity; sid:100003013; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unitedwsdykesokowskg.dns.army"; classtype:trojan-activity; sid:100003005; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"unyazitelecom.com"; classtype:trojan-activity; sid:100003006; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"upcbpta.com"; classtype:trojan-activity; sid:100003007; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"urbantrapfest.cl"; classtype:trojan-activity; sid:100003008; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"used-jeans.fr"; classtype:trojan-activity; sid:100003009; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"useformoney.000webhostapp.com"; classtype:trojan-activity; sid:100003010; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uss.ac.th"; classtype:trojan-activity; sid:100003011; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"uzzepay.com.br"; classtype:trojan-activity; sid:100003012; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"v2consultores.com"; classtype:trojan-activity; sid:100003013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vanzare.cabanabrazi2.ro"; classtype:trojan-activity; sid:100003014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vbcargo.hu"; classtype:trojan-activity; sid:100003015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"vcah.co.uk"; classtype:trojan-activity; sid:100003016; rev:1;) @@ -3076,841 +3076,864 @@ alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious web alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"woodsytech.com"; classtype:trojan-activity; sid:100003070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wordpress.saleensuporte.com.br"; classtype:trojan-activity; sid:100003071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"workingsolutionsrome.org"; classtype:trojan-activity; sid:100003072; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wozata.000webhostapp.com"; classtype:trojan-activity; sid:100003073; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wp.readhere.in"; classtype:trojan-activity; sid:100003074; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wpdemo.101clients.com.au"; classtype:trojan-activity; sid:100003075; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"writtendeer.com"; classtype:trojan-activity; sid:100003076; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ws5588.f3322.net"; classtype:trojan-activity; sid:100003077; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wsdysuresbonescagegp.dns.army"; classtype:trojan-activity; sid:100003078; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wyklej.pl"; classtype:trojan-activity; sid:100003079; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"x2vn.com"; classtype:trojan-activity; sid:100003080; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xia.beihaixue.com"; classtype:trojan-activity; sid:100003081; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xixaoclothing.com"; classtype:trojan-activity; sid:100003082; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xk.996is.com"; classtype:trojan-activity; sid:100003083; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xn--80akinnkiib6h.xn--90ais"; classtype:trojan-activity; sid:100003084; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xn--polimerbizmimarlk-rvc.com"; classtype:trojan-activity; sid:100003085; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ybom.urbanolab.com"; classtype:trojan-activity; sid:100003086; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yeichner.com"; classtype:trojan-activity; sid:100003087; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ylfpremium.com"; classtype:trojan-activity; sid:100003088; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoast.yourpageserver.com"; classtype:trojan-activity; sid:100003089; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"youtubetrainingacademy.com"; classtype:trojan-activity; sid:100003090; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yskadvisors.com"; classtype:trojan-activity; sid:100003091; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yummyyogaudaipur.com"; classtype:trojan-activity; sid:100003092; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yzkzixun.com"; classtype:trojan-activity; sid:100003093; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"zmedcoach.com"; classtype:trojan-activity; sid:100003094; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"zytrox.tk"; classtype:trojan-activity; sid:100003095; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"zz.690tx.com"; classtype:trojan-activity; sid:100003096; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/64.exe"; endswith; nocase; http.host; content:"2.indexsinas.me:811"; classtype:trojan-activity; sid:100003097; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/86.exe"; endswith; nocase; http.host; content:"2.indexsinas.me:811"; classtype:trojan-activity; sid:100003098; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/c64.exe"; endswith; nocase; http.host; content:"2.indexsinas.me:811"; classtype:trojan-activity; sid:100003099; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/8/1/2/9/81294208/growtopiastaff_setup1.61.exe"; endswith; nocase; http.host; content:"amumufree.weebly.com"; classtype:trojan-activity; sid:100003100; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/files/proxyi.exe"; endswith; nocase; http.host; content:"analogx.com"; classtype:trojan-activity; sid:100003101; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/abernathyjorge711/y6788/downloads/bubblebrowserext1.0.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003102; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dvdfv/anjj/downloads/jami.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003103; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/heyhoeee/heyhoename1/downloads/1234.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003104; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/jpavelski/chpock/downloads/4.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003105; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/jpavelski/chpock/downloads/6.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003106; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/labesoftware/update/downloads/boost-fps.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003107; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/labesoftware/update/downloads/install_plugin_x64_x86.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003108; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/labesoftware/update/downloads/vpn_free.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003109; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/1.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003110; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/clr.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003111; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/omar.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003112; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/updatev.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003113; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/work.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003114; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/ya.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003115; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/player2012/rumpa1/downloads/component.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003116; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/player2012/rumpa1/downloads/nordvpnsetup.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003117; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/player2012/rumpa1/downloads/regsvc.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003118; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/skygaming/updates/downloads/update.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003119; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/001.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003120; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/1488.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003121; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/1_cr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003122; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/1cr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003123; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/1fc2d.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003124; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/26a5.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003125; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/6e7_2021-01-19_18-04.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003126; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/abjects.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003127; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/attached.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003128; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/b7f2c.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003129; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/battletext.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003130; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/bkghj_nowin.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003131; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/bsdasdasd333.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003132; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/build.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003133; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/build_makros.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003134; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/build_silent.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003135; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/build_sup.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003136; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/buildcmobiler.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003137; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/buildcmobiler.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003138; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/buildcr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003139; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/buildss.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003140; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/clientnik.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003141; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/clientrevers.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003142; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/dcrat.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003143; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/dllservices.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003144; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/dllservices2.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003145; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/exe_morris.mcdermott.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003146; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/hans.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003147; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/hulu.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003148; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/intelfive.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003149; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/intelfour.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003150; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/intelone.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003151; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/intelthree.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003152; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/inteltwo.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003153; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/jjuufksfn.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003154; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/kleiman.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003155; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/lucky_fixed.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003156; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/notepadplus.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003157; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/osiris_qqkz_nauto.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003158; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/out.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003159; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/out.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003160; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/pacbe_bin.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003161; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/putty.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003162; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/rockethcd.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003163; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/scvhost900.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003164; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/sessionwin.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003165; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/siliculose.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003166; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/statemobi.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003167; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/stealers.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003168; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/stealers2.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003169; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/stgedo.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003170; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/svcperf.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003171; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/symptomaticshon5.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003172; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/taurjok.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003173; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/taurusbabac.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003174; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/telekiller.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003175; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/updateanddr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003176; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/updateandr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003177; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/vhajeja.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003178; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/word.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003179; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/www.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003180; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/xlsd.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003181; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/teaserex/tease/downloads/b_kfmhkk172.bin"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003182; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/teaserex/tease/downloads/macro_xmprohiq27.bin"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003183; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/hmatrix/data/hack1226.exe"; endswith; nocase; http.host; content:"cd.textfiles.com"; classtype:trojan-activity; sid:100003184; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/775238059083038744/821062129347067924/wxhyhyciuesjdefkxcqddvfbjqrofjq"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003185; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/816070119281131570/816070273254162442/all.txt"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003186; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/825372018244583454/826848185246023750/loaddd.exe"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003187; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/825372018244583454/826848348342059008/zeppelin.exe"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003188; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/825372018244583454/826848405258633277/build.exe"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003189; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/826198252025675816/826537386485612574/china.png"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003190; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/826376903400751108/826431600383361065/remcmcmcm_mjvbsmlrc45.bin"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003191; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003192; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/razor/rzr-winner_intro.zip"; endswith; nocase; http.host; content:"chiptune.com"; classtype:trojan-activity; sid:100003193; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v1/ws2/:suengpen/:buyerlist.js/buyerlist.js.xz"; endswith; nocase; http.host; content:"cloudme.com"; classtype:trojan-activity; sid:100003194; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v1/ws2/:suengpen/:buyerlist1/buyerlist1.rar"; endswith; nocase; http.host; content:"cloudme.com"; classtype:trojan-activity; sid:100003195; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/meteoradminz/hidden-tear/zip/master"; endswith; nocase; http.host; content:"codeload.github.com"; classtype:trojan-activity; sid:100003196; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tmp/protected-cek9qz4zvk2n65e-c5d84gi5/security-cloud/kypqw-52kkq0n9ywj9oa/"; endswith; nocase; http.host; content:"colfincas.com"; classtype:trojan-activity; sid:100003197; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq"; endswith; nocase; http.host; content:"docs.google.com"; classtype:trojan-activity; sid:100003198; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/frm0reseen/prntscrnofamzorderid.jpg.exe"; endswith; nocase; http.host; content:"drive.google.com.it-barcelona.com"; classtype:trojan-activity; sid:100003199; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003200; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003201; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003202; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003203; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=152yoztzpbx_bbpxepfackfklg8c1eao6"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003204; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=15hcgek7odccdafzf-9gvibnlgkirj4uo"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003205; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003206; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003207; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=194lqzukzvt-jtdxmihcvhd0yk1sxoybk"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003208; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003209; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003210; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003211; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003212; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003213; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003214; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1cos43rmscrescxk3u40qjuqbwr-pydsn"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003215; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003216; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003217; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003218; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003219; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003220; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003221; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003222; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1jkov2g5s1xkcq4bfb3uvmd6inhadatrg"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003223; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003224; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1kjcylye1dbmhystyyotz-3pagktkhlhq"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003225; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003226; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003227; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003228; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1mwgdd3lxuuk-bnsrm1rpclom0cmx7wob"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003229; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003230; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003231; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1nmf6kty3xsoygjxjhb-bsafvlfy-0lt2"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003232; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003233; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003234; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1p5fvqkxzwoiu_uauzbmrxpklsetculad"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003235; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003236; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003237; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003238; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1q1dwckludrpqijtrpw14_60d5nu7n97t"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003239; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003240; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003241; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003242; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003243; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1sjvkrinuscxqmbkdeusxaezazbiagnv3"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003244; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1so1trfuzt5-giahetghfhmd-_ot3rq35"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003245; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003246; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003247; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003248; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003249; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003250; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003251; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003252; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003253; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003254; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003255; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1yhflwpk3yeyrdhlhanctlind-5j24iwv"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003256; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1yqpuxjbnjokc5fjgt-8xzuybr97rtvg2"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003257; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003258; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003259; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003260; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-includes/1zilg/"; endswith; nocase; http.host; content:"drpamelageorge.com"; classtype:trojan-activity; sid:100003261; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-includes/qcgfmfvh/"; endswith; nocase; http.host; content:"drpamelageorge.com"; classtype:trojan-activity; sid:100003262; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/downloads/emclick.zip"; endswith; nocase; http.host; content:"e-mudhra.com"; classtype:trojan-activity; sid:100003263; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/informatica/informatica-actief/hoofdstuk1/extrasoftware/getallen.exe"; endswith; nocase; http.host; content:"evertkok.nl"; classtype:trojan-activity; sid:100003264; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/informatica/informatica-actief/hoofdstuk2/software/hksetup.exe"; endswith; nocase; http.host; content:"evertkok.nl"; classtype:trojan-activity; sid:100003265; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/register/phpcaptcha/images/19dnqhg1p/sbhvtqlysxhxn/"; endswith; nocase; http.host; content:"expeditionquest.com"; classtype:trojan-activity; sid:100003266; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/register/phpcaptcha/images/35egphpl5uzpvdmz9bncmvon3p/"; endswith; nocase; http.host; content:"expeditionquest.com"; classtype:trojan-activity; sid:100003267; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/x/"; endswith; nocase; http.host; content:"expeditionquest.com"; classtype:trojan-activity; sid:100003268; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf/"; endswith; nocase; http.host; content:"exxonabnie.ir"; classtype:trojan-activity; sid:100003269; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf//"; endswith; nocase; http.host; content:"exxonabnie.ir"; classtype:trojan-activity; sid:100003270; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf///"; endswith; nocase; http.host; content:"exxonabnie.ir"; classtype:trojan-activity; sid:100003271; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf////"; endswith; nocase; http.host; content:"exxonabnie.ir"; classtype:trojan-activity; sid:100003272; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/web1/m00/8f/36/o4ybafy-2m2aarfzaahkaiik5pi122.exe"; endswith; nocase; http.host; content:"file.elecfans.com"; classtype:trojan-activity; sid:100003273; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/4cb7cebd101/e5fb4174-ab23-48e8-bf05-e80ec5fa2169.xls"; endswith; nocase; http.host; content:"files.constantcontact.com"; classtype:trojan-activity; sid:100003274; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ee304de9001/7e533e73-e272-4a44-9d9e-138cab64bf19.docx"; endswith; nocase; http.host; content:"files.constantcontact.com"; classtype:trojan-activity; sid:100003275; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zibri/19f9838ffd12349bb2c6c3afddc9388f/raw/01977fd3c7e036c3a38f062f626fd189ba1e1aa3/uefivar.exe"; endswith; nocase; http.host; content:"gist.githubusercontent.com"; classtype:trojan-activity; sid:100003276; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/cgi-bin/sni8w3fssb44iavmzss2nv0od6eiixlq6/"; endswith; nocase; http.host; content:"hqdecig.com"; classtype:trojan-activity; sid:100003277; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-admin/suy/"; endswith; nocase; http.host; content:"hsecaravans.co.uk"; classtype:trojan-activity; sid:100003278; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/19/items/startup_20210219/startup.txt"; endswith; nocase; http.host; content:"ia801802.us.archive.org"; classtype:trojan-activity; sid:100003279; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/online-timer-kvhxz/ilxl/"; endswith; nocase; http.host; content:"ie-best.net"; classtype:trojan-activity; sid:100003280; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/64.exe"; endswith; nocase; http.host; content:"indonesias.me:9998"; classtype:trojan-activity; sid:100003281; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/c64.exe"; endswith; nocase; http.host; content:"indonesias.me:9998"; classtype:trojan-activity; sid:100003282; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v/bnun9t30zqx9t6z944g7o9z9o2plcrswmwuv9/"; endswith; nocase; http.host; content:"insupportofchildren.co.uk"; classtype:trojan-activity; sid:100003283; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ebook/cs17.exe"; endswith; nocase; http.host; content:"jcedu.org"; classtype:trojan-activity; sid:100003284; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/1"; endswith; nocase; http.host; content:"jointings.org"; classtype:trojan-activity; sid:100003285; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/2"; endswith; nocase; http.host; content:"jointings.org"; classtype:trojan-activity; sid:100003286; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/3"; endswith; nocase; http.host; content:"jointings.org"; classtype:trojan-activity; sid:100003287; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/3/2/8/8/3288864/karma_koin_codes.exe"; endswith; nocase; http.host; content:"karmakoincodes.weebly.com"; classtype:trojan-activity; sid:100003288; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dg/etrac/nf4emwz/"; endswith; nocase; http.host; content:"kotakwarna.co.id"; classtype:trojan-activity; sid:100003289; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/docs/adatgyujtesek/elektra/csv_to_xml.exe"; endswith; nocase; http.host; content:"ksh.hu"; classtype:trojan-activity; sid:100003290; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/down/affiliate/kuaizip_setup_10029.exe"; endswith; nocase; http.host; content:"kuaizip.com"; classtype:trojan-activity; sid:100003291; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/linuxforensicscode.zip"; endswith; nocase; http.host; content:"linuxforensicsbook.com.s3.amazonaws.com"; classtype:trojan-activity; sid:100003292; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dl8.exe"; endswith; nocase; http.host; content:"lojavirtual.top"; classtype:trojan-activity; sid:100003293; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dl8v2.exe"; endswith; nocase; http.host; content:"lojavirtual.top"; classtype:trojan-activity; sid:100003294; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ds/1802.gif"; endswith; nocase; http.host; content:"marcostrombetta.com.br"; classtype:trojan-activity; sid:100003295; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/k/big5/1giof6/"; endswith; nocase; http.host; content:"minpic.de"; classtype:trojan-activity; sid:100003296; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/order+00843112.ace"; endswith; nocase; http.host; content:"miot2.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003297; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/shipping+docs(ci%2ccoo%2cbl%2cpl).ace"; endswith; nocase; http.host; content:"miot2.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003298; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-contentbak/t9m/"; endswith; nocase; http.host; content:"morrobaydrugandgift.com"; classtype:trojan-activity; sid:100003299; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v1/ws2/:gianni1962/:ie6setup/ie6setup.exe"; endswith; nocase; http.host; content:"my.cloudme.com"; classtype:trojan-activity; sid:100003300; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/components/aacenc.exe"; endswith; nocase; http.host; content:"nch.com.au"; classtype:trojan-activity; sid:100003301; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/components/doxillionsetup.exe"; endswith; nocase; http.host; content:"nch.com.au"; classtype:trojan-activity; sid:100003302; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/4/1/6/6/4166984/keygen.exe"; endswith; nocase; http.host; content:"newyarlfm.weebly.com"; classtype:trojan-activity; sid:100003303; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/efficiency-all-iuehb/bjug3jyhuyilwhcqs3ykssaqqw7tpyvmypb91wtzdbluio1ekope5vrbbcx8zhdar9yt/"; endswith; nocase; http.host; content:"nhipcauytevietnhat.com"; classtype:trojan-activity; sid:100003304; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/yws/api/personal/file/web3a243b322cf83ca7cae587a92916bac7?method=download&inline=true&sharekey=649ac0bb5d5b13d15cbf50b2609e193a"; endswith; nocase; http.host; content:"note.youdao.com"; classtype:trojan-activity; sid:100003305; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/spreadsheets/osv_stock_valuation-sample-dummy.exe"; endswith; nocase; http.host; content:"oldschoolvalue.s3.amazonaws.com"; classtype:trojan-activity; sid:100003306; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003307; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003308; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003309; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=b4c15a27928f663b!230&authkey=ancu1eabetiubzg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003310; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=b4c15a27928f663b!231&authkey=ai9h3sk_luxran0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003311; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=c127f9e0fb7cbbea!214&authkey=aat73nvghhjdr9g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003312; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?authkey=!aase4ma0-vo_cls&cid=4df11eda676a355f&resid=4df11eda676a355f!140"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003313; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?authkey=!akd6uxvljtlvpxu&cid=4df11eda676a355f&resid=4df11eda676a355f!130"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003314; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?authkey=!aomvnemlpgwfuie&cid=4df11eda676a355f&resid=4df11eda676a355f!135"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003315; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?authkey=adf5p_kn8rjf29y&cid=34224e3e49966a27&resid=34224e3e49966a27%211732"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003316; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=013413cfbbbcfae4&resid=13413cfbbbcfae4%211656&authkey=ai9wpcp_k9okgk4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003317; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c!111&authkey=aemrwamaaaiyyjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003318; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c%21111&authkey=aemrwamaaaiyyjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003319; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0175cdbe2d2944c5&resid=175cdbe2d2944c5%21107&authkey=al6uptubjmmugo0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003320; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!157&authkey=aagcsm7chqez6uu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003321; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!158&authkey=amsoii5nr6pomhc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003322; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21157&authkey=aagcsm7chqez6uu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003323; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21158&authkey=amsoii5nr6pomhc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003324; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211177&authkey=am0i98nwgvzgqvq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003325; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211183&authkey=anv33trmzmi5cko"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003326; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0319bb40eba80dcc&resid=319bb40eba80dcc%21110&authkey=ag8bs48lq9n-piw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003327; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0412fba39d6c52de&resid=412fba39d6c52de%2122008&authkey=amn2bgbswxwgpma"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003328; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=045adcdfe91be4f5&resid=45adcdfe91be4f5%21318&authkey=aa6lutarluhyj48"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003329; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0489c74de4facb30&resid=489c74de4facb30!109&authkey=ajo32arrzl_vwdq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003330; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=062a585e433edce3&resid=62a585e433edce3%211618&authkey=ahzfppat_uettfg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003331; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=087f57dcf1bd61bc&resid=87f57dcf1bd61bc!113&authkey=ap0wsc-rsiegllw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003332; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=09eebe7829f6351d&resid=9eebe7829f6351d%21827&authkey=amysfuvfuc5jezq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003333; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d!184&authkey=ackbiiarirejcam"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003334; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d%21184&authkey=ackbiiarirejcam"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003335; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!273&authkey=ae2m69e5nu3rrea"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003336; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!274&authkey=acqg0akutoxdpgo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003337; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21273&authkey=ae2m69e5nu3rrea"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003338; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21274&authkey=acqg0akutoxdpgo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003339; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0!1667&authkey=an8otd7jzc7xgho"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003340; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0%211667&authkey=an8otd7jzc7xgho"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003341; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0e26b39babdbf63c&resid=e26b39babdbf63c%21137&authkey=anshbgxg1_qa2h4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003342; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242!309&authkey=alfe36drai1zmwc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003343; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242%21309&authkey=alfe36drai1zmwc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003344; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21123&authkey=aco5hiwppfq8vrw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003345; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21124&authkey=ai6sfa2z-kqf6x0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003346; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=125290ca4dc682c9&resid=125290ca4dc682c9%21452&authkey=afdp5rurqhdqa2a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003347; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=13b301f1cb48f8cd&resid=13b301f1cb48f8cd%21106&authkey=aiae3olcs4lulz4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003348; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=14f52af71b98dbc5&resid=14f52af71b98dbc5%212449&authkey=anfs_n5cs1noojo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003349; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003350; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003351; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003352; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003353; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003354; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003355; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!129&authkey=apqoonsrce0ari4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003356; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21126&authkey=ad4yflrisq6d82g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003357; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21129&authkey=apqoonsrce0ari4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003358; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=196e83840ef8c152&resid=196e83840ef8c152%21107&authkey=ah2lhjyd0ukjcve"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003359; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a162e8fcaaef5fa&resid=1a162e8fcaaef5fa%215495&authkey=aic7rmj1cm3rt2w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003360; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!106&authkey=aklmrzgetlbm5wc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003361; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!107&authkey=albnx4ylxil-nog"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003362; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21106&authkey=aklmrzgetlbm5wc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003363; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21107&authkey=albnx4ylxil-nog"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003364; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558!8182&authkey=aautw8tvzxr5v3a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003365; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558%218182&authkey=aautw8tvzxr5v3a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003366; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1cbd82dd55d70086&resid=1cbd82dd55d70086%212526&authkey=aogaboensav3jrg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003367; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1dbdf62bc3c2b05b&resid=1dbdf62bc3c2b05b!134&authkey=ape6bhxn7c89z60"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003368; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003369; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003370; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003371; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003372; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003373; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003374; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f!191&authkey=ajvumpkzpla_nca"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003375; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f%21191&authkey=ajvumpkzpla_nca"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003376; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=26bbd7d5ad88dd29&resid=26bbd7d5ad88dd29%21115&authkey=acipfa3gbiqqcvu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003377; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=26f87316a7e32bb5&resid=26f87316a7e32bb5%21106&authkey=aepqo5hlkxn1t1k"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003378; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2831401bbac0235e&resid=2831401bbac0235e%211037&authkey=aagnkp6l76yhrlo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003379; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003380; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003381; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003382; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003383; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003384; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003385; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21115&authkey=aglznnsx71tbe9e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003386; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37!183&authkey=akon9i9zzhusiuk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003387; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37%21183&authkey=akon9i9zzhusiuk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003388; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!116&authkey=!abwledjhfsqwap4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003389; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!121&authkey=!aa0qbuuss-wb13w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003390; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1!119&authkey=apmakx2cqb9rimu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003391; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21118&authkey=acrl2iiem-zjer8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003392; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21119&authkey=apmakx2cqb9rimu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003393; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2ffaa48ef4bec51a&resid=2ffaa48ef4bec51a%21107&authkey=aiohrvrc3uuo_cw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003394; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3004cdd743a543f5&resid=3004cdd743a543f5%21170&authkey=ao8vz-4rkwuiyn8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003395; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!320&authkey=aooujzuf408dclw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003396; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!321&authkey=almpxnbtsbzauna"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003397; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21320&authkey=aooujzuf408dclw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003398; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21321&authkey=almpxnbtsbzauna"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003399; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3164ddeba70d2263&resid=3164ddeba70d2263%21106&authkey=afkvqrm4zoor8qq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003400; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=31771958ea3373a1&resid=31771958ea3373a1%21108&authkey=aiofxduo9rdb_-o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003401; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1!223&authkey=aajr842bzum0yg8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003402; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1%21223&authkey=aajr842bzum0yg8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003403; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=34207675f7506d94&resid=34207675f7506d94%21137&authkey=angxnhqpe2x5koc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003404; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3447601ab357f8c1&resid=3447601ab357f8c1!114&authkey=aitwerxd-t2cxl0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003405; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003406; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8,standard,n/a,n/a,urlhaus"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003407; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866!107&authkey=af08d9zk1yestqa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003408; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866%21107&authkey=af08d9zk1yestqa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003409; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c!139&authkey=ap4bbakgkikau-a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003410; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c%21139&authkey=ap4bbakgkikau-a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003411; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!152&authkey=am09sv26njxzyn0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003412; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!153&authkey=ajs0jkoeqkqjrze"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003413; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21152&authkey=am09sv26njxzyn0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003414; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21153&authkey=ajs0jkoeqkqjrze"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003415; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3a1715e2cb964f25&resid=3a1715e2cb964f25%213713&authkey=aortxmfnibnoqkk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003416; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0!119&authkey=adkqcwv8_3k86z4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003417; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0%21119&authkey=adkqcwv8_3k86z4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003418; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21432&authkey=aa_npsupyqb2kge"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003419; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21435&authkey=admsjhgpkbtcqzs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003420; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3ee68228c34c236d&resid=3ee68228c34c236d%21129&authkey=apll6hu3-xetzxu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003421; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f!154&authkey=aasj15d0g_p2pog"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003422; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f%21154&authkey=aasj15d0g_p2pog"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003423; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f!134&authkey=aaipzy8nllirlky"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003424; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f%21134&authkey=aaipzy8nllirlky"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003425; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003426; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003427; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003428; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003429; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003430; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003431; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003432; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003433; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13805&authkey=ae-zbfo2uwln_gg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003434; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13806&authkey=aakiq-ymrjjodns"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003435; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113805&authkey=ae-zbfo2uwln_gg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003436; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113806&authkey=aakiq-ymrjjodns"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003437; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4b676ea3ff139b93&resid=4b676ea3ff139b93!133&authkey=amfix63glytflgo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003438; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21127&authkey=ablg20r-aat_ob4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003439; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21131&authkey=akbwlkrrtso_bqm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003440; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4df11eda676a355f&resid=4df11eda676a355f!130&authkey=!akd6uxvljtlvpxu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003441; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b!108&authkey=anbjpqxg-iwr4g8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003442; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003443; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003444; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003445; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003446; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003447; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003448; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21119&authkey=amrs3-3hsvcmtfs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003449; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21158&authkey=aodderdrnvhruts"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003450; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21161&authkey=agdsfxdnre82jjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003451; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21192&authkey=agn2xvrvup-xvtg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003452; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21206&authkey=ai1r52mhtbdnm2y"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003453; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21247&authkey=ae6weny1fa4pday"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003454; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21252&authkey=aphl0oi4r6lrty0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003455; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21257&authkey=afnyvqwcghnyoas"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003456; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21265&authkey=abxqdhlwiurjvve"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003457; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21271&authkey=ae5qwlr5ceeptmy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003458; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21272&authkey=ahrqeoaynibwt14"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003459; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21275&authkey=af_sgsaxsmaxg7i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003460; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21289&authkey=angyngbqixtrjaa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003461; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21293&authkey=acvh08asxosbwfu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003462; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21299&authkey=amicxuotubpok2c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003463; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21306&authkey=ahpivoukyerzcjy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003464; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21314&authkey=aex2uv2-eiofr8q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003465; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21332&authkey=ad0jmjxgbaebvbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003466; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21335&authkey=ah0vupcfbdfa6g4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003467; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21357&authkey=ap8sswuqjjjexho"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003468; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21366&authkey=aoblpmbmx7o_v18"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003469; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21379&authkey=air-bsjj46et47q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003470; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21389&authkey=aduenohuq_rbyhm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003471; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21391&authkey=aa15sw51njbn_na"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003472; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21392&authkey=abp0heeg6ybn0lk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003473; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21393&authkey=aa1pmur8sy8xtwe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003474; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212718&authkey=aie0v1d-cusuabi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003475; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212725&authkey=aanrz9et3bym3lc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003476; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212728&authkey=ahsmbkltfrwgqjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003477; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!395&authkey=alwvub_yhtogjxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003478; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!398&authkey=abaa_tjd7ohh4so"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003479; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!406&authkey=aarnp48wumgu6tq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003480; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!415&authkey=aglzsd6-g0nzj7s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003481; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!420&authkey=akk5droung_ecww"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003482; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!440&authkey=ai7-dpr11wnzyq8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003483; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21395&authkey=alwvub_yhtogjxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003484; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21398&authkey=abaa_tjd7ohh4so"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003485; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21406&authkey=aarnp48wumgu6tq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003486; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21415&authkey=aglzsd6-g0nzj7s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003487; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21420&authkey=akk5droung_ecww"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003488; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21440&authkey=ai7-dpr11wnzyq8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003489; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211121&authkey=al_fmezwfay4za4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003490; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211122&authkey=anz_q5njlanv2mu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003491; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21110&authkey=akars6koxqzdwgi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003492; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21112&authkey=aadare1gec7nzy8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003493; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003494; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8&em=2"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003495; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d%21109&authkey=adriswrtwdpbuc8&em=2"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003496; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=53c5e6b8f6893887&resid=53c5e6b8f6893887!802&authkey=aapuufivkn2zwu8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003497; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!106&authkey=anzlf1ksptbqok8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003498; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!107&authkey=ag4dr58jrjuxfyq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003499; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21106&authkey=anzlf1ksptbqok8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003500; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21107&authkey=ag4dr58jrjuxfyq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003501; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=547b1e4a6b15bf97&resid=547b1e4a6b15bf97%21106&authkey=akgsmzqhemioz8g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003502; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=54f92c3a2f5d8033&resid=54f92c3a2f5d8033%21200&authkey=aofadhhfwlm2gum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003503; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=55381ffd75ef8cda&resid=55381ffd75ef8cda!270&authkey=aev4isgyubiofdi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003504; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613!157&authkey=an55tjzt-9vbjfy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003505; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613%21156&authkey=agiuawekkbxb_4o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003506; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=55c9feaf3907aae5&resid=55c9feaf3907aae5%21208&authkey=adwuyrapfdzkyoa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003507; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950!280&authkey=advq4p3xhfhinq8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003508; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950%21280&authkey=advq4p3xhfhinq8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003509; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5629da828892367d&resid=5629da828892367d!803&authkey=aphjbq-bsg7ohpc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003510; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21383&authkey=adldpuaya7kj1dk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003511; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21384&authkey=alsuxvtsof32vea"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003512; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3599&authkey=am4yicme6lrjpki"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003513; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3604&authkey=al6pb71mtq4jr1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003514; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213599&authkey=am4yicme6lrjpki"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003515; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213604&authkey=al6pb71mtq4jr1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003516; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b!68197&authkey=aowpm7ocl_21-oc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003517; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b%2168197&authkey=aowpm7ocl_21-oc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003518; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=59389d626d829e8c&resid=59389d626d829e8c%212940&authkey=anx1ngd27vqeiwo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003519; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211568&authkey=aemrnwoi75oflva"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003520; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211572&authkey=aelz-gxlrxcwtnc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003521; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211573&authkey=ahksfdvda0doles"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003522; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5c5404bd403dbdc9&resid=5c5404bd403dbdc9!4464&authkey=ajskjf2hshbudeg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003523; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!406&authkey=aeyeq5j9zfepgai"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003524; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!407&authkey=adnh8af-rvoxlcc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003525; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21406&authkey=aeyeq5j9zfepgai"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003526; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21407&authkey=adnh8af-rvoxlcc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003527; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21892&authkey=apwphufzjdtsedw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003528; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21897&authkey=aomt6el1av5ruc8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003529; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21121&authkey=adjzlorvgx_ezhq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003530; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21123&authkey=ancfnepawtbmnug"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003531; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21124&authkey=ao7bknnuodxtfua"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003532; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003533; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003534; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003535; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003536; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003537; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003538; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003539; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003540; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003541; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003542; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2!517&authkey=akfewcyiwlwomyk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003543; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21505&authkey=ag7xi3lcnvi_hji"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003544; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21517&authkey=akfewcyiwlwomyk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003545; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad!1421&authkey=adixg2-asekemjw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003546; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad%211421&authkey=adixg2-asekemjw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003547; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213096&authkey=aob-cm9vv6erxqg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003548; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213097&authkey=abcuevfyu6pdw70"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003549; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=69b503a3f081a183&resid=69b503a3f081a183%21111&authkey=aazm9wlg1rvgzoc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003550; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!112&authkey=aasndgbcwol3mys"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003551; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!113&authkey=ak3tzu1lg4uuh5m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003552; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21112&authkey=aasndgbcwol3mys"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003553; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21113&authkey=ak3tzu1lg4uuh5m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003554; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21108&authkey=ameouv2jdxo5obw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003555; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21119&authkey=aazzzrl7mv2xbwq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003556; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a7b40a2bc530c6c&resid=6a7b40a2bc530c6c%21112&authkey=afuov36rbymlvxm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003557; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3!118&authkey=aepf8f3mfmlsng0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003558; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3%21118&authkey=aepf8f3mfmlsng0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003559; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b61e983f930f79f&resid=6b61e983f930f79f!540&authkey=ap2n5w41ifew0i8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003560; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7!1154&authkey=acnbdscb8-rbmcu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003561; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7%211154&authkey=acnbdscb8-rbmcu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003562; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21106&authkey=apvhok6edhtogfu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003563; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21115&authkey=amc_k1nnlywdc4i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003564; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=724b5c509337556e&resid=724b5c509337556e%21908&authkey=agcbb3nakpteyam"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003565; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7285f51e65036769&resid=7285f51e65036769%21264&authkey=akyjvrz006qlble"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003566; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21243&authkey=apivjmxivosek60"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003567; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21256&authkey=adljht0ogfq775k"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003568; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21260&authkey=aig6cydr4_e-qj8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003569; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21262&authkey=ak4fiz1-a1ks8rg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003570; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21264&authkey=aizkjymvlgqwpte"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003571; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!106&authkey=ahu5s4ttjvxbnxo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003572; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!107&authkey=abj3eccentbeaqa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003573; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!108&authkey=amvcygo4prlgt4i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003574; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!110&authkey=ahzuehvk5nvzo90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003575; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21106&authkey=ahu5s4ttjvxbnxo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003576; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21107&authkey=abj3eccentbeaqa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003577; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21108&authkey=amvcygo4prlgt4i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003578; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21110&authkey=ahzuehvk5nvzo90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003579; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=77518d098ad4dfb0&resid=77518d098ad4dfb0%21939&authkey=akzqobxxxn89z34"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003580; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21111&authkey=aggnhgqj6uhxm2w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003581; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21112&authkey=abser1xtkpb3-ta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003582; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21117&authkey=aivf1ddcvvu22em"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003583; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!119&authkey=aozjai26izprqto"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003584; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!120&authkey=ajj7ueqjvobgfum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003585; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21119&authkey=aozjai26izprqto"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003586; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21120&authkey=ajj7ueqjvobgfum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003587; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c1fc7da38ab958e&resid=7c1fc7da38ab958e!146&authkey=aktmjqz8n4s_sbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003588; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5295&authkey=aasceqj1mdodeuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003589; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5296&authkey=ank3vz5syaf6bny"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003590; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5298&authkey=albzyizuqczfv9s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003591; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215295&authkey=aasceqj1mdodeuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003592; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215296&authkey=ank3vz5syaf6bny"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003593; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215298&authkey=albzyizuqczfv9s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003594; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7d109f249b512466&resid=7d109f249b512466!543&authkey=acqc4xjghclmwbs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003595; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7e81645429ac5a22&resid=7e81645429ac5a22%21105&authkey=aa691jwf5wqi80c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003596; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7fed4fbea32e3c1e&resid=7fed4fbea32e3c1e%21107&authkey=aeoxfycpolifch0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003597; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=806bac90dc071edf&resid=806bac90dc071edf!105&authkey=!ao7jyz6-licb8hq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003598; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=81c2d8b116274e17&resid=81c2d8b116274e17%21107&authkey=aaqw-t4dx2sbvda"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003599; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=82977114b1af209d&resid=82977114b1af209d!220&authkey=abuin5vdedjughm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003600; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=855b20b0e8399717&resid=855b20b0e8399717%21110&authkey=afhxx21ztsd7hbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003601; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=860a0980486c93fa&resid=860a0980486c93fa!303&authkey=!agcmlab4r6syfvk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003602; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21164&authkey=agbeiinncf8ok_4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003603; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21165&authkey=aiof8rdvxglnm-c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003604; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4!2402&authkey=amigiam45mt6jia"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003605; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4%212402&authkey=amigiam45mt6jia"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003606; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003607; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003608; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003609; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003610; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003611; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003612; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25!130&authkey=ais_g9dqoddonsc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003613; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21106&authkey=ahfgxp0p6nk0eby"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003614; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21109&authkey=akr1n3qxtmnttuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003615; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21113&authkey=ajpvf1h89sqstti"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003616; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!112&authkey=af43qpcgl0t2f5o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003617; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!113&authkey=ag92_wxfvrsuix8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003618; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21112&authkey=af43qpcgl0t2f5o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003619; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21113&authkey=ag92_wxfvrsuix8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003620; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21105&authkey=ah9x7rn0p03kd_m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003621; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21110&authkey=ammswulpdsjeu4w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003622; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3!107&authkey=ac-m9dlvo5l7wfk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003623; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3%21107&authkey=ac-m9dlvo5l7wfk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003624; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=96a54b19ff5f6bab&resid=96a54b19ff5f6bab%21107&authkey=anxv07ez7s5sh_k"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003625; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003626; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003627; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003628; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935!778&authkey=aaezyk4ypt-elma"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003629; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21772&authkey=akeozmv0aafqlbg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003630; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21774&authkey=aly_m3fnrvh6dfq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003631; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21775&authkey=abblpjxi4mwomgs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003632; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21777&authkey=ahmuwqi4jg8rvho"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003633; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003634; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003635; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003636; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211953&authkey=abdfqiyruwplpo0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003637; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211954&authkey=aok-srkhxjazccy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003638; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21172&authkey=ahharhcv0fmn5fm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003639; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21173&authkey=aecb3qcquacvzhi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003640; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21174&authkey=afv7cprqwxezgsi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003641; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21177&authkey=als6_be40lt5jk8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003642; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2!113&authkey=akeqdnxllfzf8hq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003643; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2%21113&authkey=akeqdnxllfzf8hq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003644; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9fb622acb27482ef&resid=9fb622acb27482ef%211197&authkey=aeacibxy2zlyxro"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003645; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9fba865c1fdce17f&resid=9fba865c1fdce17f%211109&authkey=achpeiyvsphyn9o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003646; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a023fe2d1ac611f2&resid=a023fe2d1ac611f2!514&authkey=alaxh02uycquui4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003647; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a04a98741fafee2b&resid=a04a98741fafee2b%211857&authkey=af3qhnjtfnffevi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003648; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340!997&authkey=akw6btyej2zht08"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003649; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340%21997&authkey=akw6btyej2zht08"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003650; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a1c8c8055848b889&resid=a1c8c8055848b889!111&authkey=agzlftsgr4lspvo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003651; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a2cd2cdb93584d7e&resid=a2cd2cdb93584d7e%21106&authkey=aeifpqbwo1s3dyq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003652; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e!108&authkey=amcjnb2j1bd4tyu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003653; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21107&authkey=ab9lanzt1aj_0ws"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003654; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21108&authkey=amcjnb2j1bd4tyu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003655; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21109&authkey=afhg_ay2_zz0kkg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003656; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211064&authkey=apebndb6tstxywi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003657; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211065&authkey=aca4_dggi5gbbfs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003658; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211067&authkey=ae-3ej9zzj4ibhw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003659; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211069&authkey=agx6b8qjt_clm-o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003660; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a502994ea313f5c7&resid=a502994ea313f5c7%21215&authkey=aiydvejv0l8stbs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003661; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114!256&authkey=aapnly5qifymcvw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003662; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21251&authkey=ainluv1ppu-8ogu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003663; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21256&authkey=aapnly5qifymcvw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003664; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21!6053&authkey=agfh0ahstj7rrki"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003665; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21%216053&authkey=agfh0ahstj7rrki"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003666; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003667; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21414&authkey=akf9uwwkitvhrvc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003668; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21415&authkey=ag_5kthuezprnoy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003669; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21416&authkey=airlma-pycgfkyc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003670; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21419&authkey=ab1-sgyv2gibyey"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003671; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21422&authkey=acphsmdy415izjg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003672; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21424&authkey=afvfwz5uvde1pui"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003673; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818!129&authkey=aesewk3cf5vbrxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003674; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818%21129&authkey=aesewk3cf5vbrxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003675; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=aa4e252db942faec&resid=aa4e252db942faec%21168&authkey=anlnjo7xnwtswuk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003676; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003677; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992!113&authkey=agh9q_zzyjjcspc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003678; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992%21113&authkey=agh9q_zzyjjcspc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003679; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=af84ebf13dd5499c&resid=af84ebf13dd5499c!167&authkey=anqr_yvn_hdh2_e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003680; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308!2152&authkey=abutaac83l5utks"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003681; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308%212152&authkey=abutaac83l5utks"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003682; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21650&authkey=aht-wbxsofyx33u"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003683; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21651&authkey=aebbyk6sevdmzgm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003684; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21652&authkey=afsw5wahxo5kwjy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003685; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b1c3a5ef115e135c&resid=b1c3a5ef115e135c%216219&authkey=ahr7bklirbub0pc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003686; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21120&authkey=aozmspl2dqkgkgy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003687; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21123&authkey=aj18p0rtfbtwa84"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003688; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21139&authkey=ahwfjvw4zmjukeo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003689; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21140&authkey=aksvfpmrfqrrggw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003690; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21141&authkey=acznh6clby0qyww"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003691; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21142&authkey=ajf7j1rr3d7jcxy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003692; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21143&authkey=ahs21wnsqb_vu9w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003693; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b50c4248502103d0&resid=b50c4248502103d0%21107&authkey=alf1nley7ja4dbq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003694; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6!164&authkey=adfsfcdaw3biboy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003695; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6%21164&authkey=adfsfcdaw3biboy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003696; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b7cb31db66675eb4&resid=b7cb31db66675eb4%21922&authkey=aghayyucvwey7lg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003697; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b86046e8cbd4254b&resid=b86046e8cbd4254b%21115&authkey=agwstptwpaquleg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003698; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b!7521&authkey=ablt9zdyq2d4rb0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003699; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003700; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003701; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003702; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003703; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003704; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003705; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b%21246&authkey=afyrchdutalpu90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003706; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=bf83d9247c2329e0&resid=bf83d9247c2329e0%211108&authkey=absaw-bpqrc6mpq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003707; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003708; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003709; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003710; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003711; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003712; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003713; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1338&authkey=ajngambosws75_c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003714; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1340&authkey=al1ay3fbtude6d8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003715; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1342&authkey=acpr_htn2jtaxfu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003716; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1343&authkey=abodysrxu9l2xxu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003717; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1344&authkey=aozerppd6mnokwy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003718; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1345&authkey=aevvyhonxhtcdh0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003719; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1346&authkey=achrnf5vlov1gf4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003720; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1347&authkey=al-zge-ttvr921s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003721; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211337&authkey=afnvu1fsuczht5e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003722; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211338&authkey=ajngambosws75_c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003723; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211340&authkey=al1ay3fbtude6d8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003724; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211342&authkey=acpr_htn2jtaxfu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003725; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211343&authkey=abodysrxu9l2xxu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003726; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211344&authkey=aozerppd6mnokwy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003727; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211345&authkey=aevvyhonxhtcdh0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003728; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211346&authkey=achrnf5vlov1gf4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003729; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211347&authkey=al-zge-ttvr921s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003730; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c701663053a57d59&resid=c701663053a57d59%211009&authkey=ahowgkak7j0p2q8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003731; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21486&authkey=amy4euf_rrlcykc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003732; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21489&authkey=ako3anwfnqfohnc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003733; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c80630c4d385fb9d&resid=c80630c4d385fb9d%21286&authkey=amgaucv8bld_5qs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003734; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21546&authkey=aa6q-ryiifnet5m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003735; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21547&authkey=aipm8qnwbgo4yga"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003736; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!355&authkey=aajjwf_sm4xdqdk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003737; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!357&authkey=alw3vqqxz6myrle"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003738; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!362&authkey=alycl9izrvfl7oc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003739; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21354&authkey=aa_ukeour7rex1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003740; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21355&authkey=aajjwf_sm4xdqdk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003741; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21357&authkey=alw3vqqxz6myrle"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003742; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21362&authkey=alycl9izrvfl7oc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003743; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca897bdd16fc7940&resid=ca897bdd16fc7940%21106&authkey=aniklpt8vtlahbg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003744; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2!109&authkey=ac4gxwjoopafr9a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003745; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2%21109&authkey=ac4gxwjoopafr9a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003746; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cbb66cac420484bc&resid=cbb66cac420484bc!10968&authkey=aj9bjkobu-rlnaw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003747; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c!44331&authkey=afohia-wo-alwiy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003748; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c%2144331&authkey=afohia-wo-alwiy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003749; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!742&authkey=akbxju17f8g0r2s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003750; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!744&authkey=adak4zftd0yhhhs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003751; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21742&authkey=akbxju17f8g0r2s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003752; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21744&authkey=adak4zftd0yhhhs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003753; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!872&authkey=ap9hchztywo8zuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003754; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!874&authkey=alkzcbxz-dscgum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003755; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!875&authkey=aka55ybdhqnoc6c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003756; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21872&authkey=ap9hchztywo8zuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003757; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21874&authkey=alkzcbxz-dscgum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003758; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21875&authkey=aka55ybdhqnoc6c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003759; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!499&authkey=adegfbfx54fy3qu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003760; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!510&authkey=aamxlkp3spxmvxc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003761; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb%21510&authkey=aamxlkp3spxmvxc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003762; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d2f3748954f6f8a8&resid=d2f3748954f6f8a8%21119&authkey=aex5s9uoun2zps0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003763; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d4d413b6e7cf7088&resid=d4d413b6e7cf7088%211271&authkey=akz65bxpgvdxjb8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003764; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!191&authkey=ajl2uegqunsgc3q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003765; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!192&authkey=acd_hx4bka3z0nw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003766; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003767; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003768; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003769; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!141&authkey=alya4infudqs53o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003770; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!142&authkey=aiemnxi-s-5vrz0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003771; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21141&authkey=alya4infudqs53o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003772; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003773; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0&c=3ii9gcd&r=5onulz3wldybwlmup37su3&k=7s1&s=kzymn52eroemh1tamvmlsfsn9jtvwguukky5hlxcfgw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003774; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003775; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003776; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003777; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dcd65237fcd1a1a9&resid=dcd65237fcd1a1a9%21162&authkey=aprqs0hugnfo6uq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003778; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7527&authkey=aipybipwht56um8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003779; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7530&authkey=am9p2ic6zdkgfmy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003780; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7532&authkey=aonjnubquvon_uk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003781; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217527&authkey=aipybipwht56um8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003782; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217530&authkey=am9p2ic6zdkgfmy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003783; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217532&authkey=aonjnubquvon_uk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003784; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2!1818&authkey=anh2wga7qmhbmuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003785; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2%211818&authkey=anh2wga7qmhbmuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003786; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21107&authkey=akrabrcroiddkxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003787; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21115&authkey=ad1ncwtj_zcjsh0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003788; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21132&authkey=akpbxohbtjebyn4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003789; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21150&authkey=aevazjbqnu7cmjs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003790; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21160&authkey=aiendf-9lyln0x0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003791; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e1065ab3e86a5fc2&resid=e1065ab3e86a5fc2%211443&authkey=apybkcvf4iwxp_q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003792; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2!107&authkey=af-bicrg1c6vgck"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003793; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2%21107&authkey=af-bicrg1c6vgck"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003794; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2!129&authkey=afk5vdt49soo3co"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003795; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2%21129&authkey=afk5vdt49soo3co"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003796; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e3ddc3980f743711&resid=e3ddc3980f743711%21795&authkey=aptivsvyk2we5xc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003797; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21745&authkey=ah1i_jo73zgdxpc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003798; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21746&authkey=ag1mhwlznwdxpw0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003799; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e43694f4bd6f68d1&resid=e43694f4bd6f68d1!563&authkey=aj8ovsob9ll6r-c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003800; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!509&authkey=akmdyqkzcsuf_gg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003801; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!511&authkey=agfs0q7dz7os1lu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003802; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c%21511&authkey=agfs0q7dz7os1lu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003803; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e54ea4e0368d023b&resid=e54ea4e0368d023b%21106&authkey=aozas6g9pm0fzvq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003804; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003805; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003806; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003807; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003808; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003809; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003810; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!148&authkey=agjcwq650c8wdbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003811; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!150&authkey=ami5aqoinvosjle"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003812; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21148&authkey=agjcwq650c8wdbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003813; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21150&authkey=ami5aqoinvosjle"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003814; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e97110434470423e&resid=e97110434470423e%21113&authkey=afowclex54if0g0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003815; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33!1192&authkey=apnhep6fmmxxdkw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003816; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33%211192&authkey=apnhep6fmmxxdkw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003817; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211215&authkey=ac1jr_bieufz0ai"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003818; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211219&authkey=akgo75rmvr4khlc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003819; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ebacca5dec27fd20&resid=ebacca5dec27fd20%2118735&authkey=ajfyl1mzidnylc8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003820; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21113&authkey=aovavpmokd2jrns"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003821; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21116&authkey=aadnj5xyfasugu8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003822; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003823; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003824; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!204&authkey=ad0nbzlscbg-0sa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003825; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21202&authkey=ah1gjq8j29darw4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003826; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21203&authkey=af8xr99mrqp8um8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003827; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21204&authkey=ad0nbzlscbg-0sa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003828; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21489&authkey=ads_gff3tjkd0w0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003829; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21490&authkey=aj_rld7xooge6aw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003830; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21492&authkey=ahdb75ptd1_uc8e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003831; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f06038a5f7dbd6d6&resid=f06038a5f7dbd6d6%215498&authkey=aiozi3z5qzdysmu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003832; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f293cebb54e5ea71&resid=f293cebb54e5ea71%21293&authkey=aha74rsqiuewnpq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003833; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21566&authkey=aevafh7rydhi19k"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003834; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21581&authkey=agx0b8ho87w4uie"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003835; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21582&authkey=af-9_xwysl1o7-c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003836; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21598&authkey=ah-gkc-b7fa8h-g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003837; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21599&authkey=aajunhe1ex_-zta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003838; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f79e41c0e32d3314&resid=f79e41c0e32d3314%211182&authkey=aiqtptberyvlgqk&em=2%22"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003839; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806!1368&authkey=anphh1fijhvzv6c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003840; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806%211368&authkey=anphh1fijhvzv6c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003841; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382!159&authkey=ai4_8srrzf48hw0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003842; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382%21159&authkey=ai4_8srrzf48hw0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003843; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fb2177c192eed796&resid=fb2177c192eed796%21124&authkey=abotnmdhu_tg7bc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003844; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fd50774e5ce0e314&resid=fd50774e5ce0e314%21778&authkey=aoxb2vhhz3qodiu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003845; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fd67fafc46d3c687&resid=fd67fafc46d3c687%21473&authkey=aoid_cp-jgffqvm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003846; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!847&authkey=aemnhwbhlskovgm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003847; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!848&authkey=ag1_e421v-t5r9w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003848; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21847&authkey=aemnhwbhlskovgm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003849; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21848&authkey=ag1_e421v-t5r9w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003850; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fe85161c3947f2c1&resid=fe85161c3947f2c1%211441&authkey=agb6c1ecr91svrw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003851; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!693&authkey=agcpkhnewfte_yc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003852; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!694&authkey=aa5jqzjsp0esr1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003853; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21693&authkey=agcpkhnewfte_yc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003854; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21694&authkey=aa5jqzjsp0esr1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003855; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!330&authkey=adxnzkb0a09pizw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003856; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!334&authkey=agsvox_t7qim4ta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003857; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!335&authkey=ach14e6omcghwgg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003858; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21330&authkey=adxnzkb0a09pizw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003859; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21333&authkey=aielwtaiuvcttlm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003860; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21334&authkey=agsvox_t7qim4ta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003861; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/raw/77jhk0iw"; endswith; nocase; http.host; content:"pastebin.com"; classtype:trojan-activity; sid:100003862; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/raw/89hkc7wb"; endswith; nocase; http.host; content:"pastebin.com"; classtype:trojan-activity; sid:100003863; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/raw/yqvsvlvq"; endswith; nocase; http.host; content:"pastebin.com"; classtype:trojan-activity; sid:100003864; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-admin/llc/mwcacs65xienqdp/"; endswith; nocase; http.host; content:"pierreconsulting.info"; classtype:trojan-activity; sid:100003865; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/uploads/2020/10/skoda22.jpg"; endswith; nocase; http.host; content:"procrossover.ru"; classtype:trojan-activity; sid:100003866; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/uploads/2020/10/skodaqq.jpg"; endswith; nocase; http.host; content:"procrossover.ru"; classtype:trojan-activity; sid:100003867; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-admin/zzcoiatsr5wujrwagsgbnm2wkjxldvgu/"; endswith; nocase; http.host; content:"qjbutterflyevents.co.za"; classtype:trojan-activity; sid:100003868; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dhlshipmentawb80326979402.ace"; endswith; nocase; http.host; content:"quen.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003869; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/maersk-bl+draft-copy-shipping-documents.ace"; endswith; nocase; http.host; content:"quen.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003870; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/po+for+april+shipment.ace"; endswith; nocase; http.host; content:"quen.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003871; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/arntsonl/calc_security_poc/master/dll/calc.dll"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003872; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/bero1985/berotinypascal/e34bd4164f4b7c27e7cf667dffd9274d33d6dfbe/bin/btpc.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003873; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/evil-coder66/defendercontrol/main/defendercontrol.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003874; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/fuzzbunch/fuzzbunch/master/payloads/doublepulsar-1.3.1.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003875; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/inquisb/shellcodeexec/master/windows/shellcodeexec.x32.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003876; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/malwares/webshell/master/ajax_php%20command%20shell.rar"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003877; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/myqseeaccount/one/main/one.htm"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003878; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/realtek25556/rhti2/gh-pages/90hfnvo69vk2ot.bmp"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003879; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/secwiki/windows-kernel-exploits/master/ms15-076/binary/trebuchet.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003880; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/secwiki/windows-kernel-exploits/master/ms16-098/bfill.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003881; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tennc/webshell/master/other/small_shell.txt"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003882; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/player/launch/2017/09/12/da5f9a1c23034353852750488feeaf36.exe"; endswith; nocase; http.host; content:"res.yeshen.com"; classtype:trojan-activity; sid:100003883; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/pro/dl/q05z91"; endswith; nocase; http.host; content:"sendspace.com"; classtype:trojan-activity; sid:100003884; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ey4lpx8rx.zip"; endswith; nocase; http.host; content:"shribharatvatika.com"; classtype:trojan-activity; sid:100003885; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/site/stormqk/dn/stormagent.apk?attredirects=0"; endswith; nocase; http.host; content:"sites.google.com"; classtype:trojan-activity; sid:100003886; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6ca94027662tilxa4p/base.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003887; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6cbd811626fvoj29vw/base64.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003888; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6cd19c87f44r9fomit/base64jef.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003889; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6e2cbda22efxk3t7x2/base64.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003890; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6e2f6c8c5adup2yiwx/basejefin.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003891; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6eab37b8dadmy1gx7c/base3.5.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003892; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6eb2aa215a8cvwcf6s/fudjs.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003893; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6fd6b4eb1c08aamus8/go.jpeg"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003894; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c7921a2cf26cunjcgvm/nanocoregomes.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003895; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c9e24cc08a4dlmv7cjo/cdt.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003896; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/a-nurse-ss8d9/z/"; endswith; nocase; http.host; content:"technologydistilled.com"; classtype:trojan-activity; sid:100003897; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/23.exe"; endswith; nocase; http.host; content:"tsrv4.ws"; classtype:trojan-activity; sid:100003898; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/crisanar/defis/jek_crackme1.7.zip"; endswith; nocase; http.host; content:"users.skynet.be"; classtype:trojan-activity; sid:100003899; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/gnuboard/data/scan/amowvegfrt9ja/"; endswith; nocase; http.host; content:"vniel.co.kr"; classtype:trojan-activity; sid:100003900; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/gnuboard/data/scan/fu6jvxzzs46uqlp7l/"; endswith; nocase; http.host; content:"vniel.co.kr"; classtype:trojan-activity; sid:100003901; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/kolya/.f/root/net.mit.edu/net/user/chris/winnt/mit_agenda2a.doc"; endswith; nocase; http.host; content:"web.mit.edu"; classtype:trojan-activity; sid:100003902; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/kolya/.f/root/net.mit.edu/sipb/user/kolya/afs/root.afs/net/user/chris/winnt/mit_agenda2a.doc"; endswith; nocase; http.host; content:"web.mit.edu"; classtype:trojan-activity; sid:100003903; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/136_140/flt_shovemydiscoupyourarse.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003904; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/136_140/kb%5efr_ouverture.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003905; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/136_140/kb^fr_ouverture.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003906; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/146_150/bc_memories_from_the_mcp.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003907; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/151_155/tidex_-_short_stuff.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003908; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/syria-files/attach/222/222051_instruction.zip"; endswith; nocase; http.host; content:"wikileaks.org"; classtype:trojan-activity; sid:100003909; rev:1;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/common/yz.vbs"; endswith; nocase; http.host; content:"yp.hnggzyjy.cn"; classtype:trojan-activity; sid:100003910; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wp.readhere.in"; classtype:trojan-activity; sid:100003073; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wpdemo.101clients.com.au"; classtype:trojan-activity; sid:100003074; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"writtendeer.com"; classtype:trojan-activity; sid:100003075; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ws5588.f3322.net"; classtype:trojan-activity; sid:100003076; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wsdyalgreenkelveskxz.dns.army"; classtype:trojan-activity; sid:100003077; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wsdykungsb2talenwsjf.dns.army"; classtype:trojan-activity; sid:100003078; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wsdyrkkrgorgiousejhd.dns.army"; classtype:trojan-activity; sid:100003079; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wsdysara1investvwsfs.dns.army"; classtype:trojan-activity; sid:100003080; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wsdysuresbonescagegp.dns.army"; classtype:trojan-activity; sid:100003081; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"wyklej.pl"; classtype:trojan-activity; sid:100003082; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"x2vn.com"; classtype:trojan-activity; sid:100003083; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xia.beihaixue.com"; classtype:trojan-activity; sid:100003084; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xixaoclothing.com"; classtype:trojan-activity; sid:100003085; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xk.996is.com"; classtype:trojan-activity; sid:100003086; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xn--80akinnkiib6h.xn--90ais"; classtype:trojan-activity; sid:100003087; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"xn--polimerbizmimarlk-rvc.com"; classtype:trojan-activity; sid:100003088; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ybom.urbanolab.com"; classtype:trojan-activity; sid:100003089; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yeichner.com"; classtype:trojan-activity; sid:100003090; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"ylfpremium.com"; classtype:trojan-activity; sid:100003091; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yoast.yourpageserver.com"; classtype:trojan-activity; sid:100003092; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"youtubetrainingacademy.com"; classtype:trojan-activity; sid:100003093; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yskadvisors.com"; classtype:trojan-activity; sid:100003094; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yummyyogaudaipur.com"; classtype:trojan-activity; sid:100003095; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"yzkzixun.com"; classtype:trojan-activity; sid:100003096; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"zmedcoach.com"; classtype:trojan-activity; sid:100003097; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"zytrox.tk"; classtype:trojan-activity; sid:100003098; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"zz.690tx.com"; classtype:trojan-activity; sid:100003099; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/64.exe"; endswith; nocase; http.host; content:"2.indexsinas.me:811"; classtype:trojan-activity; sid:100003100; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/86.exe"; endswith; nocase; http.host; content:"2.indexsinas.me:811"; classtype:trojan-activity; sid:100003101; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/c64.exe"; endswith; nocase; http.host; content:"2.indexsinas.me:811"; classtype:trojan-activity; sid:100003102; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/8/1/2/9/81294208/growtopiastaff_setup1.61.exe"; endswith; nocase; http.host; content:"amumufree.weebly.com"; classtype:trojan-activity; sid:100003103; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/files/proxyi.exe"; endswith; nocase; http.host; content:"analogx.com"; classtype:trojan-activity; sid:100003104; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/abernathyjorge711/y6788/downloads/bubblebrowserext1.0.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003105; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dvdfv/anjj/downloads/jami.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003106; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/heyhoeee/heyhoename1/downloads/1234.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003107; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/jpavelski/chpock/downloads/4.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003108; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/jpavelski/chpock/downloads/6.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003109; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/labesoftware/update/downloads/boost-fps.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003110; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/labesoftware/update/downloads/install_plugin_x64_x86.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003111; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/labesoftware/update/downloads/vpn_free.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003112; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/1.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003113; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/2.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003114; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/3.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003115; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/clr.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003116; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/dianthus.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003117; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/n.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003118; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/newred.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003119; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/omar.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003120; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/serv.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003121; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/test.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003122; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/updachrome.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003123; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/updatedata.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003124; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/updatev.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003125; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/work.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003126; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mminminminmin05/testtest/downloads/ya.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003127; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/player2012/rumpa1/downloads/component.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003128; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/player2012/rumpa1/downloads/nordvpnsetup.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003129; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/player2012/rumpa1/downloads/regsvc.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003130; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/skygaming/updates/downloads/update.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003131; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/001.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003132; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/1488.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003133; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/1_cr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003134; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/1cr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003135; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/1fc2d.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003136; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/26a5.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003137; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/6e7_2021-01-19_18-04.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003138; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/abjects.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003139; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/attached.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003140; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/b7f2c.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003141; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/battletext.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003142; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/bkghj_nowin.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003143; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/bsdasdasd333.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003144; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/build.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003145; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/build_makros.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003146; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/build_silent.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003147; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/build_sup.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003148; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/buildcmobiler.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003149; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/buildcmobiler.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003150; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/buildcr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003151; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/buildss.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003152; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/clientnik.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003153; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/clientrevers.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003154; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/dcrat.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003155; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/dllservices.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003156; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/dllservices2.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003157; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/exe_morris.mcdermott.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003158; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/hans.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003159; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/hulu.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003160; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/intelfive.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003161; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/intelfour.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003162; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/intelone.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003163; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/intelthree.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003164; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/inteltwo.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003165; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/jjuufksfn.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003166; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/kleiman.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003167; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/lucky_fixed.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003168; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/notepadplus.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003169; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/osiris_qqkz_nauto.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003170; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/out.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003171; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/out.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003172; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/pacbe_bin.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003173; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/putty.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003174; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/rockethcd.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003175; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/scvhost900.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003176; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/sessionwin.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003177; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/siliculose.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003178; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/statemobi.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003179; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/stealers.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003180; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/stealers2.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003181; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/stgedo.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003182; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/svcperf.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003183; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/symptomaticshon5.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003184; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/taurjok.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003185; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/taurusbabac.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003186; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/telekiller.exe"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003187; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/updateanddr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003188; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/updateandr.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003189; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/vhajeja.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003190; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/word.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003191; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/www.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003192; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tanake5518/fi/downloads/xlsd.txt"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003193; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/teaserex/tease/downloads/b_kfmhkk172.bin"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003194; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/teaserex/tease/downloads/macro_xmprohiq27.bin"; endswith; nocase; http.host; content:"bitbucket.org"; classtype:trojan-activity; sid:100003195; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/hmatrix/data/hack1226.exe"; endswith; nocase; http.host; content:"cd.textfiles.com"; classtype:trojan-activity; sid:100003196; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/775238059083038744/821062129347067924/wxhyhyciuesjdefkxcqddvfbjqrofjq"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003197; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/816070119281131570/816070273254162442/all.txt"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003198; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/825372018244583454/826848185246023750/loaddd.exe"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003199; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/825372018244583454/826848348342059008/zeppelin.exe"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003200; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/825372018244583454/826848405258633277/build.exe"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003201; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/826198252025675816/826537386485612574/china.png"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003202; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/826376903400751108/826431600383361065/remcmcmcm_mjvbsmlrc45.bin"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003203; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe"; endswith; nocase; http.host; content:"cdn.discordapp.com"; classtype:trojan-activity; sid:100003204; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/razor/rzr-winner_intro.zip"; endswith; nocase; http.host; content:"chiptune.com"; classtype:trojan-activity; sid:100003205; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v1/ws2/:suengpen/:buyerlist.js/buyerlist.js.xz"; endswith; nocase; http.host; content:"cloudme.com"; classtype:trojan-activity; sid:100003206; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v1/ws2/:suengpen/:buyerlist1/buyerlist1.rar"; endswith; nocase; http.host; content:"cloudme.com"; classtype:trojan-activity; sid:100003207; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/meteoradminz/hidden-tear/zip/master"; endswith; nocase; http.host; content:"codeload.github.com"; classtype:trojan-activity; sid:100003208; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tmp/protected-cek9qz4zvk2n65e-c5d84gi5/security-cloud/kypqw-52kkq0n9ywj9oa/"; endswith; nocase; http.host; content:"colfincas.com"; classtype:trojan-activity; sid:100003209; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq"; endswith; nocase; http.host; content:"docs.google.com"; classtype:trojan-activity; sid:100003210; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq"; endswith; nocase; http.host; content:"docs.google.com"; classtype:trojan-activity; sid:100003211; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/frm0reseen/prntscrnofamzorderid.jpg.exe"; endswith; nocase; http.host; content:"drive.google.com.it-barcelona.com"; classtype:trojan-activity; sid:100003212; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003213; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003214; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003215; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003216; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003217; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003218; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003219; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003220; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003221; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003222; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003223; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003224; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003225; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003226; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003227; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003228; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003229; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003230; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003231; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003232; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003233; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003234; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003235; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003236; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003237; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003238; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003239; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003240; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003241; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003242; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003243; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003244; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003245; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003246; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003247; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003248; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003249; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003250; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003251; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003252; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003253; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003254; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003255; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003256; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003257; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003258; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003259; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003260; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003261; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003262; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003263; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0"; endswith; nocase; http.host; content:"drive.google.com"; classtype:trojan-activity; sid:100003264; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-includes/1zilg/"; endswith; nocase; http.host; content:"drpamelageorge.com"; classtype:trojan-activity; sid:100003265; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-includes/qcgfmfvh/"; endswith; nocase; http.host; content:"drpamelageorge.com"; classtype:trojan-activity; sid:100003266; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/downloads/emclick.zip"; endswith; nocase; http.host; content:"e-mudhra.com"; classtype:trojan-activity; sid:100003267; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/informatica/informatica-actief/hoofdstuk1/extrasoftware/getallen.exe"; endswith; nocase; http.host; content:"evertkok.nl"; classtype:trojan-activity; sid:100003268; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/informatica/informatica-actief/hoofdstuk2/software/hksetup.exe"; endswith; nocase; http.host; content:"evertkok.nl"; classtype:trojan-activity; sid:100003269; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/register/phpcaptcha/images/19dnqhg1p/sbhvtqlysxhxn/"; endswith; nocase; http.host; content:"expeditionquest.com"; classtype:trojan-activity; sid:100003270; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/register/phpcaptcha/images/35egphpl5uzpvdmz9bncmvon3p/"; endswith; nocase; http.host; content:"expeditionquest.com"; classtype:trojan-activity; sid:100003271; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/x/"; endswith; nocase; http.host; content:"expeditionquest.com"; classtype:trojan-activity; sid:100003272; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf/"; endswith; nocase; http.host; content:"exxonabnie.ir"; classtype:trojan-activity; sid:100003273; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf//"; endswith; nocase; http.host; content:"exxonabnie.ir"; classtype:trojan-activity; sid:100003274; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf///"; endswith; nocase; http.host; content:"exxonabnie.ir"; classtype:trojan-activity; sid:100003275; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/orbi-slow-glero/ggkuv5jkrmkn1kgyelyvka973qrxnwf////"; endswith; nocase; http.host; content:"exxonabnie.ir"; classtype:trojan-activity; sid:100003276; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/web1/m00/8f/36/o4ybafy-2m2aarfzaahkaiik5pi122.exe"; endswith; nocase; http.host; content:"file.elecfans.com"; classtype:trojan-activity; sid:100003277; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/4cb7cebd101/e5fb4174-ab23-48e8-bf05-e80ec5fa2169.xls"; endswith; nocase; http.host; content:"files.constantcontact.com"; classtype:trojan-activity; sid:100003278; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ee304de9001/7e533e73-e272-4a44-9d9e-138cab64bf19.docx"; endswith; nocase; http.host; content:"files.constantcontact.com"; classtype:trojan-activity; sid:100003279; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zibri/19f9838ffd12349bb2c6c3afddc9388f/raw/01977fd3c7e036c3a38f062f626fd189ba1e1aa3/uefivar.exe"; endswith; nocase; http.host; content:"gist.githubusercontent.com"; classtype:trojan-activity; sid:100003280; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/cgi-bin/sni8w3fssb44iavmzss2nv0od6eiixlq6/"; endswith; nocase; http.host; content:"hqdecig.com"; classtype:trojan-activity; sid:100003281; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-admin/suy/"; endswith; nocase; http.host; content:"hsecaravans.co.uk"; classtype:trojan-activity; sid:100003282; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/19/items/startup_20210219/startup.txt"; endswith; nocase; http.host; content:"ia801802.us.archive.org"; classtype:trojan-activity; sid:100003283; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/online-timer-kvhxz/ilxl/"; endswith; nocase; http.host; content:"ie-best.net"; classtype:trojan-activity; sid:100003284; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/64.exe"; endswith; nocase; http.host; content:"indonesias.me:9998"; classtype:trojan-activity; sid:100003285; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/c64.exe"; endswith; nocase; http.host; content:"indonesias.me:9998"; classtype:trojan-activity; sid:100003286; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v/bnun9t30zqx9t6z944g7o9z9o2plcrswmwuv9/"; endswith; nocase; http.host; content:"insupportofchildren.co.uk"; classtype:trojan-activity; sid:100003287; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ebook/cs17.exe"; endswith; nocase; http.host; content:"jcedu.org"; classtype:trojan-activity; sid:100003288; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/1"; endswith; nocase; http.host; content:"jointings.org"; classtype:trojan-activity; sid:100003289; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/2"; endswith; nocase; http.host; content:"jointings.org"; classtype:trojan-activity; sid:100003290; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eng/wp-content/plugins/featurific-for-wordpress/3"; endswith; nocase; http.host; content:"jointings.org"; classtype:trojan-activity; sid:100003291; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/3/2/8/8/3288864/karma_koin_codes.exe"; endswith; nocase; http.host; content:"karmakoincodes.weebly.com"; classtype:trojan-activity; sid:100003292; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dg/etrac/nf4emwz/"; endswith; nocase; http.host; content:"kotakwarna.co.id"; classtype:trojan-activity; sid:100003293; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/docs/adatgyujtesek/elektra/csv_to_xml.exe"; endswith; nocase; http.host; content:"ksh.hu"; classtype:trojan-activity; sid:100003294; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/down/affiliate/kuaizip_setup_10029.exe"; endswith; nocase; http.host; content:"kuaizip.com"; classtype:trojan-activity; sid:100003295; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/linuxforensicscode.zip"; endswith; nocase; http.host; content:"linuxforensicsbook.com.s3.amazonaws.com"; classtype:trojan-activity; sid:100003296; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dl8.exe"; endswith; nocase; http.host; content:"lojavirtual.top"; classtype:trojan-activity; sid:100003297; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dl8v2.exe"; endswith; nocase; http.host; content:"lojavirtual.top"; classtype:trojan-activity; sid:100003298; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ds/1802.gif"; endswith; nocase; http.host; content:"marcostrombetta.com.br"; classtype:trojan-activity; sid:100003299; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/k/big5/1giof6/"; endswith; nocase; http.host; content:"minpic.de"; classtype:trojan-activity; sid:100003300; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/order+00843112.ace"; endswith; nocase; http.host; content:"miot2.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003301; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/shipping+docs(ci%2ccoo%2cbl%2cpl).ace"; endswith; nocase; http.host; content:"miot2.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003302; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-contentbak/t9m/"; endswith; nocase; http.host; content:"morrobaydrugandgift.com"; classtype:trojan-activity; sid:100003303; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v1/ws2/:gianni1962/:ie6setup/ie6setup.exe"; endswith; nocase; http.host; content:"my.cloudme.com"; classtype:trojan-activity; sid:100003304; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/components/aacenc.exe"; endswith; nocase; http.host; content:"nch.com.au"; classtype:trojan-activity; sid:100003305; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/components/doxillionsetup.exe"; endswith; nocase; http.host; content:"nch.com.au"; classtype:trojan-activity; sid:100003306; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/4/1/6/6/4166984/keygen.exe"; endswith; nocase; http.host; content:"newyarlfm.weebly.com"; classtype:trojan-activity; sid:100003307; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/efficiency-all-iuehb/bjug3jyhuyilwhcqs3ykssaqqw7tpyvmypb91wtzdbluio1ekope5vrbbcx8zhdar9yt/"; endswith; nocase; http.host; content:"nhipcauytevietnhat.com"; classtype:trojan-activity; sid:100003308; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/yws/api/personal/file/web3a243b322cf83ca7cae587a92916bac7?method=download&inline=true&sharekey=649ac0bb5d5b13d15cbf50b2609e193a"; endswith; nocase; http.host; content:"note.youdao.com"; classtype:trojan-activity; sid:100003309; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/spreadsheets/osv_stock_valuation-sample-dummy.exe"; endswith; nocase; http.host; content:"oldschoolvalue.s3.amazonaws.com"; classtype:trojan-activity; sid:100003310; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003311; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003312; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003313; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003314; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003315; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=b4c15a27928f663b!230&authkey=ancu1eabetiubzg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003316; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=b4c15a27928f663b!231&authkey=ai9h3sk_luxran0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003317; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?&resid=c127f9e0fb7cbbea!214&authkey=aat73nvghhjdr9g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003318; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?authkey=!aase4ma0-vo_cls&cid=4df11eda676a355f&resid=4df11eda676a355f!140"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003319; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?authkey=!akd6uxvljtlvpxu&cid=4df11eda676a355f&resid=4df11eda676a355f!130"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003320; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?authkey=!aomvnemlpgwfuie&cid=4df11eda676a355f&resid=4df11eda676a355f!135"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003321; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?authkey=adf5p_kn8rjf29y&cid=34224e3e49966a27&resid=34224e3e49966a27%211732"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003322; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=013413cfbbbcfae4&resid=13413cfbbbcfae4%211656&authkey=ai9wpcp_k9okgk4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003323; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c!111&authkey=aemrwamaaaiyyjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003324; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0153c2a7092ee91c&resid=153c2a7092ee91c%21111&authkey=aemrwamaaaiyyjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003325; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0175cdbe2d2944c5&resid=175cdbe2d2944c5%21107&authkey=al6uptubjmmugo0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003326; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!157&authkey=aagcsm7chqez6uu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003327; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4!158&authkey=amsoii5nr6pomhc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003328; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21157&authkey=aagcsm7chqez6uu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003329; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=01f191d863b4d5a4&resid=1f191d863b4d5a4%21158&authkey=amsoii5nr6pomhc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003330; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211177&authkey=am0i98nwgvzgqvq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003331; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=02e98840a4c9fd6c&resid=2e98840a4c9fd6c%211183&authkey=anv33trmzmi5cko"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003332; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0319bb40eba80dcc&resid=319bb40eba80dcc%21110&authkey=ag8bs48lq9n-piw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003333; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0412fba39d6c52de&resid=412fba39d6c52de%2122008&authkey=amn2bgbswxwgpma"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003334; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=045adcdfe91be4f5&resid=45adcdfe91be4f5%21318&authkey=aa6lutarluhyj48"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003335; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0489c74de4facb30&resid=489c74de4facb30!109&authkey=ajo32arrzl_vwdq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003336; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=062a585e433edce3&resid=62a585e433edce3%211618&authkey=ahzfppat_uettfg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003337; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=087f57dcf1bd61bc&resid=87f57dcf1bd61bc!113&authkey=ap0wsc-rsiegllw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003338; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=09eebe7829f6351d&resid=9eebe7829f6351d%21827&authkey=amysfuvfuc5jezq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003339; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d!184&authkey=ackbiiarirejcam"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003340; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0cc3238b46a1ac6d&resid=cc3238b46a1ac6d%21184&authkey=ackbiiarirejcam"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003341; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!273&authkey=ae2m69e5nu3rrea"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003342; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2!274&authkey=acqg0akutoxdpgo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003343; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21273&authkey=ae2m69e5nu3rrea"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003344; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d59c202e35694c2&resid=d59c202e35694c2%21274&authkey=acqg0akutoxdpgo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003345; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0!1667&authkey=an8otd7jzc7xgho"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003346; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0d7729ca9a2b7fa0&resid=d7729ca9a2b7fa0%211667&authkey=an8otd7jzc7xgho"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003347; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0e26b39babdbf63c&resid=e26b39babdbf63c%21137&authkey=anshbgxg1_qa2h4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003348; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242!309&authkey=alfe36drai1zmwc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003349; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0f0a5aadc4c3c242&resid=f0a5aadc4c3c242%21309&authkey=alfe36drai1zmwc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003350; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21123&authkey=aco5hiwppfq8vrw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003351; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=0f51d04c9d556964&resid=f51d04c9d556964%21124&authkey=ai6sfa2z-kqf6x0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003352; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=125290ca4dc682c9&resid=125290ca4dc682c9%21452&authkey=afdp5rurqhdqa2a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003353; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=13b301f1cb48f8cd&resid=13b301f1cb48f8cd%21106&authkey=aiae3olcs4lulz4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003354; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=14f52af71b98dbc5&resid=14f52af71b98dbc5%212449&authkey=anfs_n5cs1noojo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003355; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003356; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003357; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003358; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=16b1c02dce9ea41f&resid=16b1c02dce9ea41f!286&authkey=almwisomhv3c0zc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003359; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003360; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003361; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003362; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2!129&authkey=apqoonsrce0ari4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003363; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21126&authkey=ad4yflrisq6d82g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003364; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=18418adacefed6e2&resid=18418adacefed6e2%21129&authkey=apqoonsrce0ari4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003365; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=196e83840ef8c152&resid=196e83840ef8c152%21107&authkey=ah2lhjyd0ukjcve"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003366; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a162e8fcaaef5fa&resid=1a162e8fcaaef5fa%215495&authkey=aic7rmj1cm3rt2w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003367; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!106&authkey=aklmrzgetlbm5wc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003368; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4!107&authkey=albnx4ylxil-nog"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003369; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21106&authkey=aklmrzgetlbm5wc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003370; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1a9758d53646cdd4&resid=1a9758d53646cdd4%21107&authkey=albnx4ylxil-nog"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003371; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558!8182&authkey=aautw8tvzxr5v3a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003372; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1c14977b48a91558&resid=1c14977b48a91558%218182&authkey=aautw8tvzxr5v3a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003373; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1cbd82dd55d70086&resid=1cbd82dd55d70086%212526&authkey=aogaboensav3jrg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003374; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1dbdf62bc3c2b05b&resid=1dbdf62bc3c2b05b!134&authkey=ape6bhxn7c89z60"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003375; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003376; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003377; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003378; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003379; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003380; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003381; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003382; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003383; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003384; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003385; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003386; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003387; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003388; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003389; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f!191&authkey=ajvumpkzpla_nca"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003390; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=265daf943be0d06f&resid=265daf943be0d06f%21191&authkey=ajvumpkzpla_nca"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003391; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=26bbd7d5ad88dd29&resid=26bbd7d5ad88dd29%21115&authkey=acipfa3gbiqqcvu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003392; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=26f87316a7e32bb5&resid=26f87316a7e32bb5%21106&authkey=aepqo5hlkxn1t1k"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003393; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2831401bbac0235e&resid=2831401bbac0235e%211037&authkey=aagnkp6l76yhrlo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003394; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003395; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003396; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003397; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003398; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003399; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003400; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003401; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003402; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003403; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003404; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21115&authkey=aglznnsx71tbe9e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003405; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37!183&authkey=akon9i9zzhusiuk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003406; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2cbd310015bc2d37&resid=2cbd310015bc2d37%21183&authkey=akon9i9zzhusiuk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003407; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!116&authkey=!abwledjhfsqwap4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003408; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f4d6884e933cb1a&resid=2f4d6884e933cb1a!121&authkey=!aa0qbuuss-wb13w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003409; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1!119&authkey=apmakx2cqb9rimu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003410; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21118&authkey=acrl2iiem-zjer8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003411; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2f947402293c14c1&resid=2f947402293c14c1%21119&authkey=apmakx2cqb9rimu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003412; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=2ffaa48ef4bec51a&resid=2ffaa48ef4bec51a%21107&authkey=aiohrvrc3uuo_cw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003413; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3004cdd743a543f5&resid=3004cdd743a543f5%21170&authkey=ao8vz-4rkwuiyn8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003414; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!320&authkey=aooujzuf408dclw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003415; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693!321&authkey=almpxnbtsbzauna"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003416; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21320&authkey=aooujzuf408dclw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003417; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3112e77688f09693&resid=3112e77688f09693%21321&authkey=almpxnbtsbzauna"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003418; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3164ddeba70d2263&resid=3164ddeba70d2263%21106&authkey=afkvqrm4zoor8qq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003419; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=31771958ea3373a1&resid=31771958ea3373a1%21108&authkey=aiofxduo9rdb_-o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003420; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1!223&authkey=aajr842bzum0yg8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003421; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3258f281cd827eb1&resid=3258f281cd827eb1%21223&authkey=aajr842bzum0yg8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003422; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=34207675f7506d94&resid=34207675f7506d94%21137&authkey=angxnhqpe2x5koc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003423; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3447601ab357f8c1&resid=3447601ab357f8c1!114&authkey=aitwerxd-t2cxl0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003424; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003425; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=34ddb7fad56e5c0f&resid=34ddb7fad56e5c0f%21419&authkey=ah0olx87c2izsk8,standard,n/a,n/a,urlhaus"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003426; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866!107&authkey=af08d9zk1yestqa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003427; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3541c4a292f61866&resid=3541c4a292f61866%21107&authkey=af08d9zk1yestqa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003428; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c!139&authkey=ap4bbakgkikau-a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003429; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3674d56d2003f59c&resid=3674d56d2003f59c%21139&authkey=ap4bbakgkikau-a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003430; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!152&authkey=am09sv26njxzyn0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003431; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65!153&authkey=ajs0jkoeqkqjrze"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003432; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21152&authkey=am09sv26njxzyn0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003433; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3892a0364cb5da65&resid=3892a0364cb5da65%21153&authkey=ajs0jkoeqkqjrze"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003434; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3a1715e2cb964f25&resid=3a1715e2cb964f25%213713&authkey=aortxmfnibnoqkk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003435; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0!119&authkey=adkqcwv8_3k86z4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003436; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3afef9312d3573c0&resid=3afef9312d3573c0%21119&authkey=adkqcwv8_3k86z4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003437; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21432&authkey=aa_npsupyqb2kge"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003438; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3bcd34d8ac2d7789&resid=3bcd34d8ac2d7789%21435&authkey=admsjhgpkbtcqzs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003439; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3ee68228c34c236d&resid=3ee68228c34c236d%21129&authkey=apll6hu3-xetzxu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003440; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f!154&authkey=aasj15d0g_p2pog"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003441; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=3f2905efa1c7ac3f&resid=3f2905efa1c7ac3f%21154&authkey=aasj15d0g_p2pog"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003442; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f!134&authkey=aaipzy8nllirlky"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003443; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4000200b3fb8c24f&resid=4000200b3fb8c24f%21134&authkey=aaipzy8nllirlky"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003444; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003445; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003446; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003447; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=44d422e98133708b&resid=44d422e98133708b%21109&authkey=adzxmpjk-etbkjq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003448; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003449; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003450; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003451; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003452; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003453; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003454; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13805&authkey=ae-zbfo2uwln_gg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003455; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66!13806&authkey=aakiq-ymrjjodns"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003456; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113805&authkey=ae-zbfo2uwln_gg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003457; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=48ed7695f8804d66&resid=48ed7695f8804d66%2113806&authkey=aakiq-ymrjjodns"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003458; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4b676ea3ff139b93&resid=4b676ea3ff139b93!133&authkey=amfix63glytflgo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003459; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21127&authkey=ablg20r-aat_ob4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003460; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4d4d07581d39b63d&resid=4d4d07581d39b63d%21131&authkey=akbwlkrrtso_bqm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003461; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4df11eda676a355f&resid=4df11eda676a355f!130&authkey=!akd6uxvljtlvpxu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003462; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b!108&authkey=anbjpqxg-iwr4g8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003463; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003464; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003465; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003466; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003467; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003468; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003469; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003470; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21119&authkey=amrs3-3hsvcmtfs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003471; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21158&authkey=aodderdrnvhruts"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003472; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21161&authkey=agdsfxdnre82jjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003473; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21192&authkey=agn2xvrvup-xvtg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003474; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21206&authkey=ai1r52mhtbdnm2y"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003475; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21247&authkey=ae6weny1fa4pday"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003476; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21252&authkey=aphl0oi4r6lrty0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003477; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21257&authkey=afnyvqwcghnyoas"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003478; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21265&authkey=abxqdhlwiurjvve"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003479; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21271&authkey=ae5qwlr5ceeptmy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003480; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21272&authkey=ahrqeoaynibwt14"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003481; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21275&authkey=af_sgsaxsmaxg7i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003482; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21289&authkey=angyngbqixtrjaa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003483; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21293&authkey=acvh08asxosbwfu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003484; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21299&authkey=amicxuotubpok2c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003485; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21306&authkey=ahpivoukyerzcjy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003486; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21314&authkey=aex2uv2-eiofr8q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003487; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21332&authkey=ad0jmjxgbaebvbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003488; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21335&authkey=ah0vupcfbdfa6g4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003489; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21357&authkey=ap8sswuqjjjexho"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003490; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21366&authkey=aoblpmbmx7o_v18"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003491; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21379&authkey=air-bsjj46et47q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003492; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21389&authkey=aduenohuq_rbyhm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003493; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21391&authkey=aa15sw51njbn_na"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003494; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21392&authkey=abp0heeg6ybn0lk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003495; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21393&authkey=aa1pmur8sy8xtwe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003496; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212718&authkey=aie0v1d-cusuabi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003497; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212725&authkey=aanrz9et3bym3lc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003498; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=501b63131ab62dd6&resid=501b63131ab62dd6%212728&authkey=ahsmbkltfrwgqjc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003499; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!395&authkey=alwvub_yhtogjxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003500; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!398&authkey=abaa_tjd7ohh4so"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003501; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!406&authkey=aarnp48wumgu6tq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003502; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!415&authkey=aglzsd6-g0nzj7s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003503; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!420&authkey=akk5droung_ecww"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003504; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c!440&authkey=ai7-dpr11wnzyq8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003505; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21395&authkey=alwvub_yhtogjxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003506; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21398&authkey=abaa_tjd7ohh4so"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003507; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21406&authkey=aarnp48wumgu6tq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003508; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21415&authkey=aglzsd6-g0nzj7s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003509; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21420&authkey=akk5droung_ecww"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003510; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=505be76830f4dc4c&resid=505be76830f4dc4c%21440&authkey=ai7-dpr11wnzyq8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003511; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211121&authkey=al_fmezwfay4za4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003512; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=513190d240e51e0e&resid=513190d240e51e0e%211122&authkey=anz_q5njlanv2mu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003513; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21110&authkey=akars6koxqzdwgi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003514; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=52ca67cbc48c0212&resid=52ca67cbc48c0212%21112&authkey=aadare1gec7nzy8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003515; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003516; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d!109&authkey=adriswrtwdpbuc8&em=2"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003517; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=53965c96e65f4f6d&resid=53965c96e65f4f6d%21109&authkey=adriswrtwdpbuc8&em=2"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003518; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=53c5e6b8f6893887&resid=53c5e6b8f6893887!802&authkey=aapuufivkn2zwu8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003519; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!106&authkey=anzlf1ksptbqok8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003520; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3!107&authkey=ag4dr58jrjuxfyq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003521; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21106&authkey=anzlf1ksptbqok8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003522; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=541a106160d50be3&resid=541a106160d50be3%21107&authkey=ag4dr58jrjuxfyq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003523; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=547b1e4a6b15bf97&resid=547b1e4a6b15bf97%21106&authkey=akgsmzqhemioz8g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003524; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=54f92c3a2f5d8033&resid=54f92c3a2f5d8033%21200&authkey=aofadhhfwlm2gum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003525; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=55381ffd75ef8cda&resid=55381ffd75ef8cda!270&authkey=aev4isgyubiofdi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003526; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613!157&authkey=an55tjzt-9vbjfy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003527; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=554bbd19bdd72613&resid=554bbd19bdd72613%21156&authkey=agiuawekkbxb_4o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003528; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=55c9feaf3907aae5&resid=55c9feaf3907aae5%21208&authkey=adwuyrapfdzkyoa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003529; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950!280&authkey=advq4p3xhfhinq8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003530; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5607da13ee53f950&resid=5607da13ee53f950%21280&authkey=advq4p3xhfhinq8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003531; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5629da828892367d&resid=5629da828892367d!803&authkey=aphjbq-bsg7ohpc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003532; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21383&authkey=adldpuaya7kj1dk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003533; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5696478acb744989&resid=5696478acb744989%21384&authkey=alsuxvtsof32vea"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003534; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3599&authkey=am4yicme6lrjpki"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003535; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d!3604&authkey=al6pb71mtq4jr1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003536; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213599&authkey=am4yicme6lrjpki"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003537; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57b52435d7fee30d&resid=57b52435d7fee30d%213604&authkey=al6pb71mtq4jr1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003538; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b!68197&authkey=aowpm7ocl_21-oc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003539; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=57c0958db500fe0b&resid=57c0958db500fe0b%2168197&authkey=aowpm7ocl_21-oc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003540; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=59389d626d829e8c&resid=59389d626d829e8c%212940&authkey=anx1ngd27vqeiwo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003541; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211568&authkey=aemrnwoi75oflva"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003542; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211572&authkey=aelz-gxlrxcwtnc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003543; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5bf0e9600d9f9da0&resid=5bf0e9600d9f9da0%211573&authkey=ahksfdvda0doles"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003544; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5c5404bd403dbdc9&resid=5c5404bd403dbdc9!4464&authkey=ajskjf2hshbudeg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003545; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!406&authkey=aeyeq5j9zfepgai"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003546; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052!407&authkey=adnh8af-rvoxlcc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003547; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21406&authkey=aeyeq5j9zfepgai"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003548; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5f3a7a50acb94052&resid=5f3a7a50acb94052%21407&authkey=adnh8af-rvoxlcc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003549; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21892&authkey=apwphufzjdtsedw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003550; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=5fb9958ff55c0123&resid=5fb9958ff55c0123%21897&authkey=aomt6el1av5ruc8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003551; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21121&authkey=adjzlorvgx_ezhq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003552; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21123&authkey=ancfnepawtbmnug"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003553; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21124&authkey=ao7bknnuodxtfua"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003554; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003555; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003556; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003557; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003558; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003559; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003560; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003561; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003562; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003563; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e!1094&authkey=anqjzd7pr18fu90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003564; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211094&authkey=anqjzd7pr18fu90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003565; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211099&authkey=alxq-bvz7nqbv4c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003566; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003567; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003568; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003569; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2!517&authkey=akfewcyiwlwomyk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003570; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21505&authkey=ag7xi3lcnvi_hji"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003571; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67daf26e53a5f9c2&resid=67daf26e53a5f9c2%21517&authkey=akfewcyiwlwomyk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003572; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad!1421&authkey=adixg2-asekemjw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003573; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=67f7a3925acbb2ad&resid=67f7a3925acbb2ad%211421&authkey=adixg2-asekemjw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003574; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213096&authkey=aob-cm9vv6erxqg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003575; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6819bca13312697b&resid=6819bca13312697b%213097&authkey=abcuevfyu6pdw70"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003576; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=69b503a3f081a183&resid=69b503a3f081a183%21111&authkey=aazm9wlg1rvgzoc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003577; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!112&authkey=aasndgbcwol3mys"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003578; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072!113&authkey=ak3tzu1lg4uuh5m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003579; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21112&authkey=aasndgbcwol3mys"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003580; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a1602e410531072&resid=6a1602e410531072%21113&authkey=ak3tzu1lg4uuh5m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003581; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21108&authkey=ameouv2jdxo5obw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003582; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a4147b45f4b0876&resid=6a4147b45f4b0876%21119&authkey=aazzzrl7mv2xbwq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003583; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6a7b40a2bc530c6c&resid=6a7b40a2bc530c6c%21112&authkey=afuov36rbymlvxm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003584; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3!118&authkey=aepf8f3mfmlsng0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003585; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b3ee3b3b5fb10d3&resid=6b3ee3b3b5fb10d3%21118&authkey=aepf8f3mfmlsng0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003586; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b61e983f930f79f&resid=6b61e983f930f79f!540&authkey=ap2n5w41ifew0i8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003587; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7!1154&authkey=acnbdscb8-rbmcu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003588; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=6b71cecfb2f8c8a7&resid=6b71cecfb2f8c8a7%211154&authkey=acnbdscb8-rbmcu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003589; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21106&authkey=apvhok6edhtogfu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003590; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=70c4976fc04ddb54&resid=70c4976fc04ddb54%21115&authkey=amc_k1nnlywdc4i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003591; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=724b5c509337556e&resid=724b5c509337556e%21908&authkey=agcbb3nakpteyam"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003592; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7285f51e65036769&resid=7285f51e65036769%21264&authkey=akyjvrz006qlble"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003593; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21243&authkey=apivjmxivosek60"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003594; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21256&authkey=adljht0ogfq775k"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003595; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21260&authkey=aig6cydr4_e-qj8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003596; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21262&authkey=ak4fiz1-a1ks8rg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003597; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7366fefc2190d2e3&resid=7366fefc2190d2e3%21264&authkey=aizkjymvlgqwpte"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003598; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!106&authkey=ahu5s4ttjvxbnxo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003599; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!107&authkey=abj3eccentbeaqa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003600; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!108&authkey=amvcygo4prlgt4i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003601; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe!110&authkey=ahzuehvk5nvzo90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003602; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21106&authkey=ahu5s4ttjvxbnxo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003603; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21107&authkey=abj3eccentbeaqa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003604; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21108&authkey=amvcygo4prlgt4i"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003605; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7621307c0282fefe&resid=7621307c0282fefe%21110&authkey=ahzuehvk5nvzo90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003606; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=77518d098ad4dfb0&resid=77518d098ad4dfb0%21939&authkey=akzqobxxxn89z34"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003607; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21111&authkey=aggnhgqj6uhxm2w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003608; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21112&authkey=abser1xtkpb3-ta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003609; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=78bfb08e0f7bc86f&resid=78bfb08e0f7bc86f%21117&authkey=aivf1ddcvvu22em"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003610; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!119&authkey=aozjai26izprqto"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003611; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f!120&authkey=ajj7ueqjvobgfum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003612; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21119&authkey=aozjai26izprqto"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003613; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7a5e689dd1dc641f&resid=7a5e689dd1dc641f%21120&authkey=ajj7ueqjvobgfum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003614; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c1fc7da38ab958e&resid=7c1fc7da38ab958e!146&authkey=aktmjqz8n4s_sbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003615; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5295&authkey=aasceqj1mdodeuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003616; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5296&authkey=ank3vz5syaf6bny"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003617; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7!5298&authkey=albzyizuqczfv9s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003618; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215295&authkey=aasceqj1mdodeuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003619; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215296&authkey=ank3vz5syaf6bny"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003620; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7c41ddcfa01aeff7&resid=7c41ddcfa01aeff7%215298&authkey=albzyizuqczfv9s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003621; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7d109f249b512466&resid=7d109f249b512466!543&authkey=acqc4xjghclmwbs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003622; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7e81645429ac5a22&resid=7e81645429ac5a22%21105&authkey=aa691jwf5wqi80c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003623; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=7fed4fbea32e3c1e&resid=7fed4fbea32e3c1e%21107&authkey=aeoxfycpolifch0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003624; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=806bac90dc071edf&resid=806bac90dc071edf!105&authkey=!ao7jyz6-licb8hq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003625; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=81c2d8b116274e17&resid=81c2d8b116274e17%21107&authkey=aaqw-t4dx2sbvda"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003626; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=82977114b1af209d&resid=82977114b1af209d!220&authkey=abuin5vdedjughm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003627; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=855b20b0e8399717&resid=855b20b0e8399717%21110&authkey=afhxx21ztsd7hbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003628; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=860a0980486c93fa&resid=860a0980486c93fa!303&authkey=!agcmlab4r6syfvk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003629; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21164&authkey=agbeiinncf8ok_4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003630; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=87dc3e587977c459&resid=87dc3e587977c459%21165&authkey=aiof8rdvxglnm-c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003631; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4!2402&authkey=amigiam45mt6jia"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003632; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=883587d3e32ee1c4&resid=883587d3e32ee1c4%212402&authkey=amigiam45mt6jia"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003633; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003634; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003635; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003636; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003637; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003638; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003639; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003640; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003641; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25!130&authkey=ais_g9dqoddonsc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003642; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21106&authkey=ahfgxp0p6nk0eby"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003643; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21109&authkey=akr1n3qxtmnttuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003644; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=914146ba02b70d25&resid=914146ba02b70d25%21113&authkey=ajpvf1h89sqstti"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003645; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!112&authkey=af43qpcgl0t2f5o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003646; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2!113&authkey=ag92_wxfvrsuix8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003647; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21112&authkey=af43qpcgl0t2f5o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003648; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=92462ab265d53cb2&resid=92462ab265d53cb2%21113&authkey=ag92_wxfvrsuix8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003649; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21105&authkey=ah9x7rn0p03kd_m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003650; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=944cfbbd7823d265&resid=944cfbbd7823d265%21110&authkey=ammswulpdsjeu4w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003651; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3!107&authkey=ac-m9dlvo5l7wfk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003652; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=94fefff7000581d3&resid=94fefff7000581d3%21107&authkey=ac-m9dlvo5l7wfk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003653; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=96a54b19ff5f6bab&resid=96a54b19ff5f6bab%21107&authkey=anxv07ez7s5sh_k"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003654; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003655; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003656; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003657; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003658; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003659; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003660; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211953&authkey=abdfqiyruwplpo0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003661; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211954&authkey=aok-srkhxjazccy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003662; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21172&authkey=ahharhcv0fmn5fm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003663; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21173&authkey=aecb3qcquacvzhi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003664; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21174&authkey=afv7cprqwxezgsi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003665; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9a8688776fe2dbf4&resid=9a8688776fe2dbf4%21177&authkey=als6_be40lt5jk8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003666; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2!113&authkey=akeqdnxllfzf8hq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003667; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9e4e4faca91ad3d2&resid=9e4e4faca91ad3d2%21113&authkey=akeqdnxllfzf8hq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003668; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9fb622acb27482ef&resid=9fb622acb27482ef%211197&authkey=aeacibxy2zlyxro"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003669; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=9fba865c1fdce17f&resid=9fba865c1fdce17f%211109&authkey=achpeiyvsphyn9o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003670; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a023fe2d1ac611f2&resid=a023fe2d1ac611f2!514&authkey=alaxh02uycquui4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003671; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a04a98741fafee2b&resid=a04a98741fafee2b%211857&authkey=af3qhnjtfnffevi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003672; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340!997&authkey=akw6btyej2zht08"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003673; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a0fb3cde2e262340&resid=a0fb3cde2e262340%21997&authkey=akw6btyej2zht08"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003674; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a1c8c8055848b889&resid=a1c8c8055848b889!111&authkey=agzlftsgr4lspvo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003675; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a2cd2cdb93584d7e&resid=a2cd2cdb93584d7e%21106&authkey=aeifpqbwo1s3dyq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003676; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e!108&authkey=amcjnb2j1bd4tyu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003677; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21107&authkey=ab9lanzt1aj_0ws"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003678; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21108&authkey=amcjnb2j1bd4tyu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003679; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a31988151cf6813e&resid=a31988151cf6813e%21109&authkey=afhg_ay2_zz0kkg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003680; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211064&authkey=apebndb6tstxywi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003681; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211065&authkey=aca4_dggi5gbbfs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003682; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211067&authkey=ae-3ej9zzj4ibhw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003683; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a4000de54b92dcc6&resid=a4000de54b92dcc6%211069&authkey=agx6b8qjt_clm-o"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003684; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a502994ea313f5c7&resid=a502994ea313f5c7%21215&authkey=aiydvejv0l8stbs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003685; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114!256&authkey=aapnly5qifymcvw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003686; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21251&authkey=ainluv1ppu-8ogu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003687; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6d02acf038b0114&resid=a6d02acf038b0114%21256&authkey=aapnly5qifymcvw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003688; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21!6053&authkey=agfh0ahstj7rrki"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003689; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a6dd95780c6c7e21&resid=a6dd95780c6c7e21%216053&authkey=agfh0ahstj7rrki"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003690; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003691; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21414&authkey=akf9uwwkitvhrvc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003692; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21415&authkey=ag_5kthuezprnoy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003693; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21416&authkey=airlma-pycgfkyc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003694; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21419&authkey=ab1-sgyv2gibyey"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003695; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21422&authkey=acphsmdy415izjg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003696; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a7d52fea62ebd0f0&resid=a7d52fea62ebd0f0%21424&authkey=afvfwz5uvde1pui"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003697; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818!129&authkey=aesewk3cf5vbrxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003698; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=a88c38fdad791818&resid=a88c38fdad791818%21129&authkey=aesewk3cf5vbrxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003699; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=aa4e252db942faec&resid=aa4e252db942faec%21168&authkey=anlnjo7xnwtswuk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003700; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003701; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992!113&authkey=agh9q_zzyjjcspc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003702; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ae80108520d75992&resid=ae80108520d75992%21113&authkey=agh9q_zzyjjcspc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003703; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=af84ebf13dd5499c&resid=af84ebf13dd5499c!167&authkey=anqr_yvn_hdh2_e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003704; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308!2152&authkey=abutaac83l5utks"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003705; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b03ee17d51411308&resid=b03ee17d51411308%212152&authkey=abutaac83l5utks"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003706; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21650&authkey=aht-wbxsofyx33u"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003707; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21651&authkey=aebbyk6sevdmzgm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003708; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b1239884e2deb3b9&resid=b1239884e2deb3b9%21652&authkey=afsw5wahxo5kwjy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003709; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b1c3a5ef115e135c&resid=b1c3a5ef115e135c%216219&authkey=ahr7bklirbub0pc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003710; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21120&authkey=aozmspl2dqkgkgy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003711; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3805920e5eb0711&resid=b3805920e5eb0711%21123&authkey=aj18p0rtfbtwa84"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003712; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21139&authkey=ahwfjvw4zmjukeo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003713; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21140&authkey=aksvfpmrfqrrggw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003714; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21141&authkey=acznh6clby0qyww"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003715; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21142&authkey=ajf7j1rr3d7jcxy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003716; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b3a118354e81d1bb&resid=b3a118354e81d1bb%21143&authkey=ahs21wnsqb_vu9w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003717; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b50c4248502103d0&resid=b50c4248502103d0%21107&authkey=alf1nley7ja4dbq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003718; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6!164&authkey=adfsfcdaw3biboy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003719; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b5ea8d4249d866e6&resid=b5ea8d4249d866e6%21164&authkey=adfsfcdaw3biboy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003720; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b7cb31db66675eb4&resid=b7cb31db66675eb4%21922&authkey=aghayyucvwey7lg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003721; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b86046e8cbd4254b&resid=b86046e8cbd4254b%21115&authkey=agwstptwpaquleg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003722; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b!7521&authkey=ablt9zdyq2d4rb0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003723; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003724; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003725; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003726; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003727; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003728; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003729; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003730; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b%21246&authkey=afyrchdutalpu90"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003731; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=bf83d9247c2329e0&resid=bf83d9247c2329e0%211108&authkey=absaw-bpqrc6mpq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003732; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003733; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003734; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003735; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003736; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003737; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003738; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003739; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1338&authkey=ajngambosws75_c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003740; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1340&authkey=al1ay3fbtude6d8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003741; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1342&authkey=acpr_htn2jtaxfu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003742; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1343&authkey=abodysrxu9l2xxu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003743; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1344&authkey=aozerppd6mnokwy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003744; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1345&authkey=aevvyhonxhtcdh0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003745; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1346&authkey=achrnf5vlov1gf4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003746; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1347&authkey=al-zge-ttvr921s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003747; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211337&authkey=afnvu1fsuczht5e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003748; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211338&authkey=ajngambosws75_c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003749; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211340&authkey=al1ay3fbtude6d8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003750; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211342&authkey=acpr_htn2jtaxfu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003751; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211343&authkey=abodysrxu9l2xxu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003752; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211344&authkey=aozerppd6mnokwy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003753; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211345&authkey=aevvyhonxhtcdh0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003754; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211346&authkey=achrnf5vlov1gf4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003755; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e%211347&authkey=al-zge-ttvr921s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003756; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c701663053a57d59&resid=c701663053a57d59%211009&authkey=ahowgkak7j0p2q8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003757; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21486&authkey=amy4euf_rrlcykc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003758; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c71b410673c49a80&resid=c71b410673c49a80%21489&authkey=ako3anwfnqfohnc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003759; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=c80630c4d385fb9d&resid=c80630c4d385fb9d%21286&authkey=amgaucv8bld_5qs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003760; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21546&authkey=aa6q-ryiifnet5m"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003761; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca308e3d3912d9e7&resid=ca308e3d3912d9e7%21547&authkey=aipm8qnwbgo4yga"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003762; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!355&authkey=aajjwf_sm4xdqdk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003763; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!357&authkey=alw3vqqxz6myrle"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003764; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b!362&authkey=alycl9izrvfl7oc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003765; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21354&authkey=aa_ukeour7rex1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003766; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21355&authkey=aajjwf_sm4xdqdk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003767; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21357&authkey=alw3vqqxz6myrle"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003768; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca50a85094f0b78b&resid=ca50a85094f0b78b%21362&authkey=alycl9izrvfl7oc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003769; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ca897bdd16fc7940&resid=ca897bdd16fc7940%21106&authkey=aniklpt8vtlahbg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003770; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2!109&authkey=ac4gxwjoopafr9a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003771; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cb64e6e1a6ce15a2&resid=cb64e6e1a6ce15a2%21109&authkey=ac4gxwjoopafr9a"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003772; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cbb66cac420484bc&resid=cbb66cac420484bc!10968&authkey=aj9bjkobu-rlnaw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003773; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c!44331&authkey=afohia-wo-alwiy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003774; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cda6c13b54bbe48c&resid=cda6c13b54bbe48c%2144331&authkey=afohia-wo-alwiy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003775; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!742&authkey=akbxju17f8g0r2s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003776; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d!744&authkey=adak4zftd0yhhhs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003777; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21742&authkey=akbxju17f8g0r2s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003778; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=cf0c6d1a4c15233d&resid=cf0c6d1a4c15233d%21744&authkey=adak4zftd0yhhhs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003779; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!872&authkey=ap9hchztywo8zuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003780; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!874&authkey=alkzcbxz-dscgum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003781; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85!875&authkey=aka55ybdhqnoc6c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003782; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21872&authkey=ap9hchztywo8zuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003783; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21874&authkey=alkzcbxz-dscgum"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003784; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d06d60404544fb85&resid=d06d60404544fb85%21875&authkey=aka55ybdhqnoc6c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003785; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!499&authkey=adegfbfx54fy3qu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003786; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb!510&authkey=aamxlkp3spxmvxc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003787; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d27ef4e21fbf6ecb&resid=d27ef4e21fbf6ecb%21510&authkey=aamxlkp3spxmvxc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003788; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d2f3748954f6f8a8&resid=d2f3748954f6f8a8%21119&authkey=aex5s9uoun2zps0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003789; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d4d413b6e7cf7088&resid=d4d413b6e7cf7088%211271&authkey=akz65bxpgvdxjb8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003790; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!191&authkey=ajl2uegqunsgc3q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003791; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0!192&authkey=acd_hx4bka3z0nw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003792; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003793; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003794; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003795; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003796; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003797; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003798; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dcd65237fcd1a1a9&resid=dcd65237fcd1a1a9%21162&authkey=aprqs0hugnfo6uq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003799; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7527&authkey=aipybipwht56um8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003800; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7530&authkey=am9p2ic6zdkgfmy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003801; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5!7532&authkey=aonjnubquvon_uk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003802; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217527&authkey=aipybipwht56um8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003803; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217530&authkey=am9p2ic6zdkgfmy"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003804; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=dd0a0ec58f4ac5f5&resid=dd0a0ec58f4ac5f5%217532&authkey=aonjnubquvon_uk"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003805; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2!1818&authkey=anh2wga7qmhbmuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003806; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e0837d627665c3e2&resid=e0837d627665c3e2%211818&authkey=anh2wga7qmhbmuo"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003807; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21107&authkey=akrabrcroiddkxw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003808; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21115&authkey=ad1ncwtj_zcjsh0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003809; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21132&authkey=akpbxohbtjebyn4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003810; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21150&authkey=aevazjbqnu7cmjs"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003811; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e08e2d452e10fc69&resid=e08e2d452e10fc69%21160&authkey=aiendf-9lyln0x0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003812; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e1065ab3e86a5fc2&resid=e1065ab3e86a5fc2%211443&authkey=apybkcvf4iwxp_q"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003813; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2!107&authkey=af-bicrg1c6vgck"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003814; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e1a2f9756fffc8d2&resid=e1a2f9756fffc8d2%21107&authkey=af-bicrg1c6vgck"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003815; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2!129&authkey=afk5vdt49soo3co"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003816; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e2ea0eaee1f43ce2&resid=e2ea0eaee1f43ce2%21129&authkey=afk5vdt49soo3co"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003817; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e3ddc3980f743711&resid=e3ddc3980f743711%21795&authkey=aptivsvyk2we5xc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003818; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21745&authkey=ah1i_jo73zgdxpc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003819; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e424d4f4fe44dedf&resid=e424d4f4fe44dedf%21746&authkey=ag1mhwlznwdxpw0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003820; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e43694f4bd6f68d1&resid=e43694f4bd6f68d1!563&authkey=aj8ovsob9ll6r-c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003821; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!509&authkey=akmdyqkzcsuf_gg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003822; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c!511&authkey=agfs0q7dz7os1lu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003823; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e4b1e1072dc91f5c&resid=e4b1e1072dc91f5c%21511&authkey=agfs0q7dz7os1lu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003824; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e54ea4e0368d023b&resid=e54ea4e0368d023b%21106&authkey=aozas6g9pm0fzvq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003825; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003826; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003827; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003828; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21349&authkey=ae9ea8jdsa7vmom"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003829; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003830; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003831; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003832; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!148&authkey=agjcwq650c8wdbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003833; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8!150&authkey=ami5aqoinvosjle"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003834; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21148&authkey=agjcwq650c8wdbm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003835; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e8a5ad7ff91ed1b8&resid=e8a5ad7ff91ed1b8%21150&authkey=ami5aqoinvosjle"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003836; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e97110434470423e&resid=e97110434470423e%21113&authkey=afowclex54if0g0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003837; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33!1192&authkey=apnhep6fmmxxdkw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003838; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=e9a57719b11feb33&resid=e9a57719b11feb33%211192&authkey=apnhep6fmmxxdkw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003839; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211215&authkey=ac1jr_bieufz0ai"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003840; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ead0e1196bd04320&resid=ead0e1196bd04320%211219&authkey=akgo75rmvr4khlc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003841; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ebacca5dec27fd20&resid=ebacca5dec27fd20%2118735&authkey=ajfyl1mzidnylc8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003842; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21113&authkey=aovavpmokd2jrns"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003843; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=edd7401a7180b54c&resid=edd7401a7180b54c%21116&authkey=aadnj5xyfasugu8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003844; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003845; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003846; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!204&authkey=ad0nbzlscbg-0sa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003847; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21202&authkey=ah1gjq8j29darw4"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003848; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21203&authkey=af8xr99mrqp8um8"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003849; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928%21204&authkey=ad0nbzlscbg-0sa"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003850; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21489&authkey=ads_gff3tjkd0w0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003851; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21490&authkey=aj_rld7xooge6aw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003852; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f05e45800a084e63&resid=f05e45800a084e63%21492&authkey=ahdb75ptd1_uc8e"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003853; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f06038a5f7dbd6d6&resid=f06038a5f7dbd6d6%215498&authkey=aiozi3z5qzdysmu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003854; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f293cebb54e5ea71&resid=f293cebb54e5ea71%21293&authkey=aha74rsqiuewnpq"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003855; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21566&authkey=aevafh7rydhi19k"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003856; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21581&authkey=agx0b8ho87w4uie"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003857; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21582&authkey=af-9_xwysl1o7-c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003858; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21598&authkey=ah-gkc-b7fa8h-g"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003859; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f40a6c678d20c1eb&resid=f40a6c678d20c1eb%21599&authkey=aajunhe1ex_-zta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003860; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f79e41c0e32d3314&resid=f79e41c0e32d3314%211182&authkey=aiqtptberyvlgqk&em=2%22"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003861; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806!1368&authkey=anphh1fijhvzv6c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003862; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f7ae097903082806&resid=f7ae097903082806%211368&authkey=anphh1fijhvzv6c"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003863; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382!159&authkey=ai4_8srrzf48hw0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003864; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=f824f5d726d5c382&resid=f824f5d726d5c382%21159&authkey=ai4_8srrzf48hw0"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003865; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fb2177c192eed796&resid=fb2177c192eed796%21124&authkey=abotnmdhu_tg7bc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003866; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fd50774e5ce0e314&resid=fd50774e5ce0e314%21778&authkey=aoxb2vhhz3qodiu"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003867; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fd67fafc46d3c687&resid=fd67fafc46d3c687%21473&authkey=aoid_cp-jgffqvm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003868; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!847&authkey=aemnhwbhlskovgm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003869; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352!848&authkey=ag1_e421v-t5r9w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003870; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21847&authkey=aemnhwbhlskovgm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003871; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fdc68d2b6039f352&resid=fdc68d2b6039f352%21848&authkey=ag1_e421v-t5r9w"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003872; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=fe85161c3947f2c1&resid=fe85161c3947f2c1%211441&authkey=agb6c1ecr91svrw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003873; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!693&authkey=agcpkhnewfte_yc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003874; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73!694&authkey=aa5jqzjsp0esr1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003875; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21693&authkey=agcpkhnewfte_yc"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003876; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff1d187273dfbf73&resid=ff1d187273dfbf73%21694&authkey=aa5jqzjsp0esr1s"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003877; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!330&authkey=adxnzkb0a09pizw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003878; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!334&authkey=agsvox_t7qim4ta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003879; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469!335&authkey=ach14e6omcghwgg"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003880; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21330&authkey=adxnzkb0a09pizw"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003881; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21333&authkey=aielwtaiuvcttlm"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003882; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download?cid=ff9d39cbb0e96469&resid=ff9d39cbb0e96469%21334&authkey=agsvox_t7qim4ta"; endswith; nocase; http.host; content:"onedrive.live.com"; classtype:trojan-activity; sid:100003883; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/r/a39ev"; endswith; nocase; http.host; content:"paste.ee"; classtype:trojan-activity; sid:100003884; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/raw/77jhk0iw"; endswith; nocase; http.host; content:"pastebin.com"; classtype:trojan-activity; sid:100003885; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/raw/89hkc7wb"; endswith; nocase; http.host; content:"pastebin.com"; classtype:trojan-activity; sid:100003886; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/raw/yqvsvlvq"; endswith; nocase; http.host; content:"pastebin.com"; classtype:trojan-activity; sid:100003887; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-admin/llc/mwcacs65xienqdp/"; endswith; nocase; http.host; content:"pierreconsulting.info"; classtype:trojan-activity; sid:100003888; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/uploads/2020/10/skoda22.jpg"; endswith; nocase; http.host; content:"procrossover.ru"; classtype:trojan-activity; sid:100003889; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/uploads/2020/10/skodaqq.jpg"; endswith; nocase; http.host; content:"procrossover.ru"; classtype:trojan-activity; sid:100003890; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-admin/zzcoiatsr5wujrwagsgbnm2wkjxldvgu/"; endswith; nocase; http.host; content:"qjbutterflyevents.co.za"; classtype:trojan-activity; sid:100003891; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dhlshipmentawb80326979402.ace"; endswith; nocase; http.host; content:"quen.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003892; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/maersk-bl+draft-copy-shipping-documents.ace"; endswith; nocase; http.host; content:"quen.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003893; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/po+for+april+shipment.ace"; endswith; nocase; http.host; content:"quen.s3.us-east-2.amazonaws.com"; classtype:trojan-activity; sid:100003894; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/arntsonl/calc_security_poc/master/dll/calc.dll"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003895; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/bero1985/berotinypascal/e34bd4164f4b7c27e7cf667dffd9274d33d6dfbe/bin/btpc.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003896; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/evil-coder66/defendercontrol/main/defendercontrol.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003897; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/fuzzbunch/fuzzbunch/master/payloads/doublepulsar-1.3.1.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003898; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/inquisb/shellcodeexec/master/windows/shellcodeexec.x32.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003899; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/malwares/webshell/master/ajax_php%20command%20shell.rar"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003900; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/myqseeaccount/one/main/one.htm"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003901; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/realtek25556/rhti2/gh-pages/90hfnvo69vk2ot.bmp"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003902; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/secwiki/windows-kernel-exploits/master/ms15-076/binary/trebuchet.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003903; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/secwiki/windows-kernel-exploits/master/ms16-098/bfill.exe"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003904; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tennc/webshell/master/other/small_shell.txt"; endswith; nocase; http.host; content:"raw.githubusercontent.com"; classtype:trojan-activity; sid:100003905; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/player/launch/2017/09/12/da5f9a1c23034353852750488feeaf36.exe"; endswith; nocase; http.host; content:"res.yeshen.com"; classtype:trojan-activity; sid:100003906; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/pro/dl/q05z91"; endswith; nocase; http.host; content:"sendspace.com"; classtype:trojan-activity; sid:100003907; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ey4lpx8rx.zip"; endswith; nocase; http.host; content:"shribharatvatika.com"; classtype:trojan-activity; sid:100003908; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/site/stormqk/dn/stormagent.apk?attredirects=0"; endswith; nocase; http.host; content:"sites.google.com"; classtype:trojan-activity; sid:100003909; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6ca94027662tilxa4p/base.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003910; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6cbd811626fvoj29vw/base64.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003911; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6cd19c87f44r9fomit/base64jef.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003912; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6e2cbda22efxk3t7x2/base64.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003913; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6e2f6c8c5adup2yiwx/basejefin.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003914; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6eab37b8dadmy1gx7c/base3.5.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003915; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6eb2aa215a8cvwcf6s/fudjs.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003916; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c6fd6b4eb1c08aamus8/go.jpeg"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003917; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c7921a2cf26cunjcgvm/nanocoregomes.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003918; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wzukusers/user-34654398/documents/5c9e24cc08a4dlmv7cjo/cdt.txt"; endswith; nocase; http.host; content:"storage.googleapis.com"; classtype:trojan-activity; sid:100003919; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/a-nurse-ss8d9/z/"; endswith; nocase; http.host; content:"technologydistilled.com"; classtype:trojan-activity; sid:100003920; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/23.exe"; endswith; nocase; http.host; content:"tsrv4.ws"; classtype:trojan-activity; sid:100003921; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/crisanar/defis/jek_crackme1.7.zip"; endswith; nocase; http.host; content:"users.skynet.be"; classtype:trojan-activity; sid:100003922; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/gnuboard/data/scan/amowvegfrt9ja/"; endswith; nocase; http.host; content:"vniel.co.kr"; classtype:trojan-activity; sid:100003923; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/gnuboard/data/scan/fu6jvxzzs46uqlp7l/"; endswith; nocase; http.host; content:"vniel.co.kr"; classtype:trojan-activity; sid:100003924; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/kolya/.f/root/net.mit.edu/net/user/chris/winnt/mit_agenda2a.doc"; endswith; nocase; http.host; content:"web.mit.edu"; classtype:trojan-activity; sid:100003925; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/kolya/.f/root/net.mit.edu/sipb/user/kolya/afs/root.afs/net/user/chris/winnt/mit_agenda2a.doc"; endswith; nocase; http.host; content:"web.mit.edu"; classtype:trojan-activity; sid:100003926; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/136_140/flt_shovemydiscoupyourarse.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003927; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/136_140/kb%5efr_ouverture.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003928; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/136_140/kb^fr_ouverture.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003929; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/146_150/bc_memories_from_the_mcp.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003930; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/issues/151_155/tidex_-_short_stuff.exe"; endswith; nocase; http.host; content:"websound.ru"; classtype:trojan-activity; sid:100003931; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/syria-files/attach/222/222051_instruction.zip"; endswith; nocase; http.host; content:"wikileaks.org"; classtype:trojan-activity; sid:100003932; rev:1;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/common/yz.vbs"; endswith; nocase; http.host; content:"yp.hnggzyjy.cn"; classtype:trojan-activity; sid:100003933; rev:1;) diff --git a/urlhaus-filter-unbound-online.conf b/urlhaus-filter-unbound-online.conf index 65ad2501..3364bbf1 100644 --- a/urlhaus-filter-unbound-online.conf +++ b/urlhaus-filter-unbound-online.conf @@ -1,5 +1,5 @@ # Title: Online Malicious Domains Unbound Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -10,12 +10,11 @@ local-zone: "1008691.com" always_nxdomain local-zone: "14karatvisions.com" always_nxdomain local-zone: "1am.co.nz" always_nxdomain local-zone: "21robo.com" always_nxdomain -local-zone: "32792.prolocksmithwinterpark.com" always_nxdomain local-zone: "360.lcy2zzx.pw" always_nxdomain local-zone: "360down7.miiyun.cn" always_nxdomain +local-zone: "4et3ja.am.files.1drv.com" always_nxdomain local-zone: "77st.net" always_nxdomain local-zone: "8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com" always_nxdomain -local-zone: "87du.vip" always_nxdomain local-zone: "8poieq.bn.files.1drv.com" always_nxdomain local-zone: "aatreefelling.co.za" always_nxdomain local-zone: "abcd.bg" always_nxdomain @@ -29,7 +28,6 @@ local-zone: "accesslinksgroup.com" always_nxdomain local-zone: "aceeprc.com.aceeprc.com" always_nxdomain local-zone: "acellr.co.uk" always_nxdomain local-zone: "acteon.com.ar" always_nxdomain -local-zone: "activecost.com.au" always_nxdomain local-zone: "addahealingmusic.com" always_nxdomain local-zone: "adithimedia.com" always_nxdomain local-zone: "adithimedia.memengers.com" always_nxdomain @@ -89,11 +87,14 @@ local-zone: "aps-sv.com" always_nxdomain local-zone: "artedibujoyarquitectura.com" always_nxdomain local-zone: "arwenyapi.com" always_nxdomain local-zone: "ask-regard.call-save.biz" always_nxdomain +local-zone: "asucssa.live" always_nxdomain local-zone: "atfile.com" always_nxdomain local-zone: "athenacapsg.com" always_nxdomain +local-zone: "atlasconcreteworks.com" always_nxdomain local-zone: "attach.66rpg.com" always_nxdomain local-zone: "atteuqpotentialunlimited.com" always_nxdomain local-zone: "augustair.com" always_nxdomain +local-zone: "aulist.com" always_nxdomain local-zone: "automaticrefreshments.com" always_nxdomain local-zone: "avadhanagames.com" always_nxdomain local-zone: "ayahuascasp.com.br" always_nxdomain @@ -109,6 +110,7 @@ local-zone: "bangladeshunbound.com" always_nxdomain local-zone: "bary.sz4h.com" always_nxdomain local-zone: "bash.givemexyz.in" always_nxdomain local-zone: "bausch.kr-atlas.monaxikoslykos@zytrox.tk" always_nxdomain +local-zone: "bavhome.com" always_nxdomain local-zone: "bbia.co.uk" always_nxdomain local-zone: "bcmt.elin.co.za" always_nxdomain local-zone: "bcrg.co.za" always_nxdomain @@ -160,7 +162,6 @@ local-zone: "browardinsurancemiami.solucioneslink.com" always_nxdomain local-zone: "bt2.elin.co.za" always_nxdomain local-zone: "btdapi.robotake.com" always_nxdomain local-zone: "buigiaphat.com.vn" always_nxdomain -local-zone: "bulkyfoodja.com" always_nxdomain local-zone: "bullseyemedia.in" always_nxdomain local-zone: "busandvanrentalmalaysia.com" always_nxdomain local-zone: "buscascolegios.diit.cl" always_nxdomain @@ -174,11 +175,8 @@ local-zone: "cacaoprojects.com" always_nxdomain local-zone: "calgaryautorepairservice.com" always_nxdomain local-zone: "callbury.in" always_nxdomain local-zone: "camminachetipassa.it" always_nxdomain -local-zone: "canadianwork.cc" always_nxdomain local-zone: "capitalgroup-kw.com" always_nxdomain local-zone: "capoeiraventrelivre.com" always_nxdomain -local-zone: "carlsbadre.com" always_nxdomain -local-zone: "carsidecor.com" always_nxdomain local-zone: "cashyinvestment.org" always_nxdomain local-zone: "catchperch.com" always_nxdomain local-zone: "catchpoolshetlands.co.uk" always_nxdomain @@ -215,7 +213,6 @@ local-zone: "colinde.pricesne.com" always_nxdomain local-zone: "colorpak.pl" always_nxdomain local-zone: "columbia.aula-web.net" always_nxdomain local-zone: "community.reimclub.com" always_nxdomain -local-zone: "comosairdoburaco.com.br" always_nxdomain local-zone: "competancy.indigoconsult.net" always_nxdomain local-zone: "conceptimagine.ro" always_nxdomain local-zone: "config.cqhbkjzx.com" always_nxdomain @@ -224,12 +221,14 @@ local-zone: "constructoralyon.com" always_nxdomain local-zone: "consulateins.solucioneslink.com" always_nxdomain local-zone: "contributeindustry.com" always_nxdomain local-zone: "copelandscapes.com" always_nxdomain +local-zone: "corwin-tommie06f.ru.com" always_nxdomain local-zone: "coulsongraphics.com" always_nxdomain local-zone: "count.mail.163.com.impactmedfoundation.com" always_nxdomain local-zone: "covid19.cyberschool.or.id" always_nxdomain local-zone: "cpanel.shivay.net" always_nxdomain local-zone: "cr-sq.com" always_nxdomain local-zone: "craftech.nxtnet.ga" always_nxdomain +local-zone: "crearechile.cl" always_nxdomain local-zone: "creationskateboards.com" always_nxdomain local-zone: "crecerco.com" always_nxdomain local-zone: "crittersbythebay.com" always_nxdomain @@ -239,6 +238,7 @@ local-zone: "crmroche.manivelasst.com" always_nxdomain local-zone: "crscorretordeimoveis.com.br" always_nxdomain local-zone: "cse-engineer.com" always_nxdomain local-zone: "csnserver.com" always_nxdomain +local-zone: "ctracknxt.in" always_nxdomain local-zone: "cubescargoexpress.com" always_nxdomain local-zone: "curasoles.co.za" always_nxdomain local-zone: "currantmedia.com" always_nxdomain @@ -257,7 +257,6 @@ local-zone: "datapolish.com" always_nxdomain local-zone: "dating.khokhas.co.za" always_nxdomain local-zone: "datsom.vn" always_nxdomain local-zone: "davethompson.me.uk" always_nxdomain -local-zone: "davidmcguinness.info" always_nxdomain local-zone: "dayspringdaisies.com" always_nxdomain local-zone: "dd.qiyuea.cn" always_nxdomain local-zone: "ddns.cyberium.cc" always_nxdomain @@ -291,14 +290,11 @@ local-zone: "dl.198424.com" always_nxdomain local-zone: "dl.installcdn-aws.com" always_nxdomain local-zone: "dl.packetstormsecurity.net" always_nxdomain local-zone: "dl.rina-roleplay.com" always_nxdomain -local-zone: "dnn.alibuf.com" always_nxdomain -local-zone: "dns.alibuf.com" always_nxdomain local-zone: "dockerupdate.anondns.net" always_nxdomain local-zone: "docman.orientalservices.in" always_nxdomain local-zone: "dodsonimaging.com" always_nxdomain local-zone: "doitunlimited.com" always_nxdomain local-zone: "dokan.blueberrytec.com" always_nxdomain -local-zone: "dom-chel74.ru" always_nxdomain local-zone: "dom.daf.free.fr" always_nxdomain local-zone: "doncedyhall.com" always_nxdomain local-zone: "donghobinhminh.com" always_nxdomain @@ -308,6 +304,7 @@ local-zone: "dosame.com" always_nxdomain local-zone: "dosman.pl" always_nxdomain local-zone: "dovberger.com" always_nxdomain local-zone: "down.pcclear.com" always_nxdomain +local-zone: "down.udashi.com" always_nxdomain local-zone: "down.webbora.com" always_nxdomain local-zone: "down1.arpun.com" always_nxdomain local-zone: "download.caihong.com" always_nxdomain @@ -338,6 +335,7 @@ local-zone: "e.sldov.ru" always_nxdomain local-zone: "eandgdesign.com.ng" always_nxdomain local-zone: "eastsheen-glaziers.co.uk" always_nxdomain local-zone: "ebruyatkin.com" always_nxdomain +local-zone: "edu.saicraftsman.com" always_nxdomain local-zone: "eedo.ee" always_nxdomain local-zone: "efficientegroup.com" always_nxdomain local-zone: "elbauldenora.com" always_nxdomain @@ -352,8 +350,8 @@ local-zone: "erp.nanotechproautocare.com" always_nxdomain local-zone: "erp.zilymax.com" always_nxdomain local-zone: "escola.probommar.org.br" always_nxdomain local-zone: "esnconsultants.com" always_nxdomain -local-zone: "esrhf04.top" always_nxdomain local-zone: "essentia.org.br" always_nxdomain +local-zone: "estjh05.top" always_nxdomain local-zone: "ethereality.info" always_nxdomain local-zone: "eubanks7.com" always_nxdomain local-zone: "europeanzonexxi.com" always_nxdomain @@ -422,9 +420,11 @@ local-zone: "goldcoastoffice365.com" always_nxdomain local-zone: "goldcoastoffice365.com.au" always_nxdomain local-zone: "golden-memories-funerals.yourpageserver.com" always_nxdomain local-zone: "goldenasiacapital.com" always_nxdomain +local-zone: "goldmen.in" always_nxdomain local-zone: "gpotecnosystems.com" always_nxdomain local-zone: "gracejukes.com" always_nxdomain local-zone: "grupoinmare.com" always_nxdomain +local-zone: "gruposelt.000webhostapp.com" always_nxdomain local-zone: "gs.monerorx.com" always_nxdomain local-zone: "guide-to-cell-phones.com" always_nxdomain local-zone: "gulfac-house.com" always_nxdomain @@ -452,6 +452,7 @@ local-zone: "hitstation.nl" always_nxdomain local-zone: "hmpmall.co.kr" always_nxdomain local-zone: "hoagietesting10.com" always_nxdomain local-zone: "hoayeuthuong-my.sharepoint.com" always_nxdomain +local-zone: "holmesservices.mobiledevsite.co" always_nxdomain local-zone: "homefindersolutions.com" always_nxdomain local-zone: "hongluosi.com" always_nxdomain local-zone: "hookedupboatclub.com" always_nxdomain @@ -464,6 +465,7 @@ local-zone: "hsmwebapp.com" always_nxdomain local-zone: "htownbars.com" always_nxdomain local-zone: "hubtech.co.za" always_nxdomain local-zone: "huellacero.cl" always_nxdomain +local-zone: "hunchomusichub.com" always_nxdomain local-zone: "hunggiang.vn" always_nxdomain local-zone: "husamiyahschool.com" always_nxdomain local-zone: "iabmixx2020.rayadigital.online" always_nxdomain @@ -515,7 +517,6 @@ local-zone: "jathra.co.uk" always_nxdomain local-zone: "jay.diamondrelationscrm.us" always_nxdomain local-zone: "jebs.net.au" always_nxdomain local-zone: "jeffdahlke.com" always_nxdomain -local-zone: "jhayesconsulting.com" always_nxdomain local-zone: "jiaoyuzixun.cn" always_nxdomain local-zone: "jing-da.com.tw" always_nxdomain local-zone: "jmtc.91756.cn" always_nxdomain @@ -529,7 +530,6 @@ local-zone: "jumpmanualjacobhiller.com" always_nxdomain local-zone: "jupiter.toxsl.in" always_nxdomain local-zone: "justinscott.com.au" always_nxdomain local-zone: "kadigital.co.uk" always_nxdomain -local-zone: "kaizenjanitorial.com" always_nxdomain local-zone: "kalawatihomes.com" always_nxdomain local-zone: "kalogirosfinance.com" always_nxdomain local-zone: "kaptaanchapal.com" always_nxdomain @@ -540,17 +540,15 @@ local-zone: "kensingtondriving.com" always_nxdomain local-zone: "ketofitnessexpert.com" always_nxdomain local-zone: "kevinjewelry.com.co" always_nxdomain local-zone: "keywatch.yourpageserver.com" always_nxdomain -local-zone: "khmerosja.net" always_nxdomain local-zone: "kingssa.co.za" always_nxdomain local-zone: "kizitox.ga" always_nxdomain local-zone: "kjcpromo.com" always_nxdomain -local-zone: "kldatabase.com" always_nxdomain local-zone: "kleinendeli.co.za" always_nxdomain local-zone: "korrectconceptservices.com" always_nxdomain local-zone: "krisbadminton.com" always_nxdomain local-zone: "ktb.sch.id" always_nxdomain local-zone: "kubatoglubaklava.com.tr" always_nxdomain -local-zone: "kullumanalitours.com" always_nxdomain +local-zone: "kumaralok.in" always_nxdomain local-zone: "kwanfromhongkong.com" always_nxdomain local-zone: "kz.sldov.ru" always_nxdomain local-zone: "lacasadelosalebrijes.com" always_nxdomain @@ -559,7 +557,6 @@ local-zone: "lameguard.ru" always_nxdomain local-zone: "laodongnhat.vn" always_nxdomain local-zone: "laravel.pointersoftwares.com.br" always_nxdomain local-zone: "lasermobilesounds.co.uk" always_nxdomain -local-zone: "laura9630fr.com" always_nxdomain local-zone: "lauratomismith.com" always_nxdomain local-zone: "lautarosanmiguel.com" always_nxdomain local-zone: "lawforall.edu.lk" always_nxdomain @@ -661,14 +658,12 @@ local-zone: "mis.nbcc.ac.th" always_nxdomain local-zone: "misterson.com" always_nxdomain local-zone: "mkontakt.az" always_nxdomain local-zone: "mktf.mx" always_nxdomain -local-zone: "mmdx.com" always_nxdomain local-zone: "mmogollon.com.mx" always_nxdomain local-zone: "mncarteam.com" always_nxdomain local-zone: "modelhouseturkey.com" always_nxdomain local-zone: "modernmanna.org" always_nxdomain local-zone: "monetization.business" always_nxdomain local-zone: "moninediy.com" always_nxdomain -local-zone: "mopai.sg" always_nxdomain local-zone: "motorcomunicacion.com" always_nxdomain local-zone: "moumitas.com" always_nxdomain local-zone: "msacontabil.com.br" always_nxdomain @@ -687,7 +682,7 @@ local-zone: "namnyak.co.ke" always_nxdomain local-zone: "nap.mgsservers.com" always_nxdomain local-zone: "navayurveda.in" always_nxdomain local-zone: "nec-i.com" always_nxdomain -local-zone: "nellaimasthanbiryani.com" always_nxdomain +local-zone: "nelitrianggraeni.000webhostapp.com" always_nxdomain local-zone: "nerve.untergrund.net" always_nxdomain local-zone: "nettube.com.br" always_nxdomain local-zone: "networkwheels.co.za" always_nxdomain @@ -706,6 +701,7 @@ local-zone: "nilehouse.co.ug" always_nxdomain local-zone: "nilinkeji.com" always_nxdomain local-zone: "nimboohomes.com" always_nxdomain local-zone: "njtiledesigncenter.com" always_nxdomain +local-zone: "nmxwllwsdyminoragenw.dns.army" always_nxdomain local-zone: "nobius.org" always_nxdomain local-zone: "nocalnoodle.elin.co.za" always_nxdomain local-zone: "nomadicbees.com" always_nxdomain @@ -719,6 +715,7 @@ local-zone: "nyasabigbullets.com" always_nxdomain local-zone: "nyeh2o.com.au" always_nxdomain local-zone: "obseques-conseils.com" always_nxdomain local-zone: "oecteam.com" always_nxdomain +local-zone: "ohe.ie" always_nxdomain local-zone: "ohsewgorgeous.co.uk" always_nxdomain local-zone: "oknoplastik.sk" always_nxdomain local-zone: "oleholeh.memangbeda.website" always_nxdomain @@ -751,6 +748,7 @@ local-zone: "pacwebdesigns.com" always_nxdomain local-zone: "pagos.krayem.com.mx" always_nxdomain local-zone: "palbas.cl" always_nxdomain local-zone: "palochusvet.szm.com" always_nxdomain +local-zone: "panslimiterd.com" always_nxdomain local-zone: "parallel.rockvideos.at" always_nxdomain local-zone: "parejasfelices.mi-fs.com" always_nxdomain local-zone: "parkhussion.com" always_nxdomain @@ -781,6 +779,7 @@ local-zone: "pink99.com" always_nxdomain local-zone: "plasfan.ind.br" always_nxdomain local-zone: "playground2.grupoaliadasca.com" always_nxdomain local-zone: "pmglance.startwriteup.com" always_nxdomain +local-zone: "pmrimewsdylimtewsogh.dns.army" always_nxdomain local-zone: "pokojewewladyslawowie.pl" always_nxdomain local-zone: "pole.com.vc" always_nxdomain local-zone: "pool.phxdir.com" always_nxdomain @@ -794,7 +793,6 @@ local-zone: "preview2.behalen.com" always_nxdomain local-zone: "prishaartcreations.com" always_nxdomain local-zone: "production.sparshims.com" always_nxdomain local-zone: "programaoperadoronline.com.br" always_nxdomain -local-zone: "project.exquitec.com" always_nxdomain local-zone: "promotoradescomplica.com.br" always_nxdomain local-zone: "promoversdubai.com" always_nxdomain local-zone: "propertiq.elin.co.za" always_nxdomain @@ -804,7 +802,6 @@ local-zone: "prosupport.cl" always_nxdomain local-zone: "prosyarmakassar.com" always_nxdomain local-zone: "provence.elin.co.za" always_nxdomain local-zone: "prox.realunix.cc" always_nxdomain -local-zone: "prueba.danielluza.com" always_nxdomain local-zone: "pujashoppe.in" always_nxdomain local-zone: "punchdialogues.com" always_nxdomain local-zone: "punjabdevelopersassociation.com.pk" always_nxdomain @@ -819,7 +816,6 @@ local-zone: "radioafifense.deploys.live" always_nxdomain local-zone: "rainbowisp.info" always_nxdomain local-zone: "rajeshtailang.com" always_nxdomain local-zone: "rakeshkhatri.in" always_nxdomain -local-zone: "raodigitalmedia.com" always_nxdomain local-zone: "raquelhelena.com.br" always_nxdomain local-zone: "rarlabarchiver.ac" always_nxdomain local-zone: "rasadbar.ir" always_nxdomain @@ -833,7 +829,6 @@ local-zone: "readwrite26.nl" always_nxdomain local-zone: "readymmade.com" always_nxdomain local-zone: "recyclethesurplus.com" always_nxdomain local-zone: "redbats.co.in" always_nxdomain -local-zone: "redboxmultimedia.com" always_nxdomain local-zone: "redchillicrackers.com" always_nxdomain local-zone: "reifenquick.de" always_nxdomain local-zone: "relaxindulge.co.nz" always_nxdomain @@ -916,7 +911,6 @@ local-zone: "shopsofe.com" always_nxdomain local-zone: "sibernetix.fr" always_nxdomain local-zone: "sigapresschennai.com" always_nxdomain local-zone: "sige.brisainformatica.com.br" always_nxdomain -local-zone: "signatureads.co.in" always_nxdomain local-zone: "siili.net" always_nxdomain local-zone: "simoneporzi.it" always_nxdomain local-zone: "simorsint.com" always_nxdomain @@ -952,7 +946,6 @@ local-zone: "spent.com.pl" always_nxdomain local-zone: "spetsesyachtcharter.gr" always_nxdomain local-zone: "spititourism.com" always_nxdomain local-zone: "spittinfire.com" always_nxdomain -local-zone: "springbedspetroleum.com" always_nxdomain local-zone: "src1.minibai.com" always_nxdomain local-zone: "sreenivasapaintingworks.com" always_nxdomain local-zone: "sriglobalit.com" always_nxdomain @@ -994,12 +987,12 @@ local-zone: "tafsantoursandtravels.com" always_nxdomain local-zone: "tajushariya.com" always_nxdomain local-zone: "tallyinvoicecustomization.com" always_nxdomain local-zone: "taltus.co.uk" always_nxdomain -local-zone: "tapalkoedacoffee.com" always_nxdomain local-zone: "tarravalleyfoods.com.au" always_nxdomain local-zone: "tavo.cl" always_nxdomain local-zone: "tc.snpsresidential.com" always_nxdomain local-zone: "tcy.198424.com" always_nxdomain local-zone: "tdsp.yngw518.com" always_nxdomain +local-zone: "tech332.synology.me" always_nxdomain local-zone: "techgms.com" always_nxdomain local-zone: "teduae.com" always_nxdomain local-zone: "teleargentina.com" always_nxdomain @@ -1038,6 +1031,7 @@ local-zone: "themansionkasauli.com" always_nxdomain local-zone: "theprofinn.com" always_nxdomain local-zone: "thesummitpc.net" always_nxdomain local-zone: "theurbantutors.com" always_nxdomain +local-zone: "theviewsdyjupcazfeqv.dns.army" always_nxdomain local-zone: "thosewebbs.com" always_nxdomain local-zone: "thriveink.com" always_nxdomain local-zone: "tianangdep.com" always_nxdomain @@ -1055,6 +1049,7 @@ local-zone: "topcell9.com" always_nxdomain local-zone: "toplevel.com.br" always_nxdomain local-zone: "topmask.co.za" always_nxdomain local-zone: "torresquinterocorp.com" always_nxdomain +local-zone: "towme.services" always_nxdomain local-zone: "toyotacollege.ac.th" always_nxdomain local-zone: "tpke.hu" always_nxdomain local-zone: "translaterjemah.com" always_nxdomain @@ -1078,8 +1073,7 @@ local-zone: "ultimate-24.de" always_nxdomain local-zone: "umwelt-kirchhof.de" always_nxdomain local-zone: "unicorpbrunei.com" always_nxdomain local-zone: "uniengrisb.com" always_nxdomain -local-zone: "unisoftcc.com" always_nxdomain -local-zone: "unityindiversity.in" always_nxdomain +local-zone: "unitedwsdykesokowskg.dns.army" always_nxdomain local-zone: "unyazitelecom.com" always_nxdomain local-zone: "upcbpta.com" always_nxdomain local-zone: "urbantrapfest.cl" always_nxdomain @@ -1087,6 +1081,7 @@ local-zone: "used-jeans.fr" always_nxdomain local-zone: "useformoney.000webhostapp.com" always_nxdomain local-zone: "uss.ac.th" always_nxdomain local-zone: "uzzepay.com.br" always_nxdomain +local-zone: "v2consultores.com" always_nxdomain local-zone: "vanzare.cabanabrazi2.ro" always_nxdomain local-zone: "vbcargo.hu" always_nxdomain local-zone: "vcah.co.uk" always_nxdomain @@ -1146,11 +1141,14 @@ local-zone: "wolfgang-brodte.de" always_nxdomain local-zone: "woodsytech.com" always_nxdomain local-zone: "wordpress.saleensuporte.com.br" always_nxdomain local-zone: "workingsolutionsrome.org" always_nxdomain -local-zone: "wozata.000webhostapp.com" always_nxdomain local-zone: "wp.readhere.in" always_nxdomain local-zone: "wpdemo.101clients.com.au" always_nxdomain local-zone: "writtendeer.com" always_nxdomain local-zone: "ws5588.f3322.net" always_nxdomain +local-zone: "wsdyalgreenkelveskxz.dns.army" always_nxdomain +local-zone: "wsdykungsb2talenwsjf.dns.army" always_nxdomain +local-zone: "wsdyrkkrgorgiousejhd.dns.army" always_nxdomain +local-zone: "wsdysara1investvwsfs.dns.army" always_nxdomain local-zone: "wsdysuresbonescagegp.dns.army" always_nxdomain local-zone: "wyklej.pl" always_nxdomain local-zone: "x2vn.com" always_nxdomain diff --git a/urlhaus-filter-unbound.conf b/urlhaus-filter-unbound.conf index 162140b1..efa3e4e3 100644 --- a/urlhaus-filter-unbound.conf +++ b/urlhaus-filter-unbound.conf @@ -1,5 +1,5 @@ # Title: Malicious Domains Unbound Blocklist -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -238,6 +238,7 @@ local-zone: "123mobile.store" always_nxdomain local-zone: "123moviesfx.com" always_nxdomain local-zone: "123sellfast.com" always_nxdomain local-zone: "123sex.co" always_nxdomain +local-zone: "123tadi.com" always_nxdomain local-zone: "123xyz.xyz" always_nxdomain local-zone: "124.com.ua" always_nxdomain local-zone: "124.cpanel.realwebsitesite.com" always_nxdomain @@ -1190,6 +1191,7 @@ local-zone: "4drakona.ru" always_nxdomain local-zone: "4ele.pl" always_nxdomain local-zone: "4ertybhdfrt.gq" always_nxdomain local-zone: "4esports.de" always_nxdomain +local-zone: "4et3ja.am.files.1drv.com" always_nxdomain local-zone: "4evakleen.com.au" always_nxdomain local-zone: "4eventfacilities.nl" always_nxdomain local-zone: "4evernails.nl" always_nxdomain @@ -1776,6 +1778,7 @@ local-zone: "998awol.com" always_nxdomain local-zone: "999.buzz" always_nxdomain local-zone: "999.co.id" always_nxdomain local-zone: "999.rajaojek.com" always_nxdomain +local-zone: "999080321newfolder1002002131-service1002.space" always_nxdomain local-zone: "999102com.cn" always_nxdomain local-zone: "99bkx.com" always_nxdomain local-zone: "99centsdigitals.com" always_nxdomain @@ -3963,6 +3966,7 @@ local-zone: "ahiraatfashion.com" always_nxdomain local-zone: "ahiskatv.net" always_nxdomain local-zone: "ahitekniktarti.com" always_nxdomain local-zone: "ahiyangrup.com.tr" always_nxdomain +local-zone: "ahjianlong.cf" always_nxdomain local-zone: "ahjuric.si" always_nxdomain local-zone: "ahk.smu8street.ru" always_nxdomain local-zone: "ahkha.com" always_nxdomain @@ -4387,6 +4391,7 @@ local-zone: "akito.be" always_nxdomain local-zone: "akivj07.top" always_nxdomain local-zone: "akktis.com" always_nxdomain local-zone: "akkurtmadencilik.com" always_nxdomain +local-zone: "aklatdelmundo.com" always_nxdomain local-zone: "akleigh.com" always_nxdomain local-zone: "aklin.ir" always_nxdomain local-zone: "aklocalshop.com" always_nxdomain @@ -5099,7 +5104,6 @@ local-zone: "alladinonlinee.com" always_nxdomain local-zone: "allainesconsultancyinc.com" always_nxdomain local-zone: "allamanolibrary.com" always_nxdomain local-zone: "allan-it.com" always_nxdomain -local-zone: "allanabolicsteam.net" always_nxdomain local-zone: "allanelect.co.uk" always_nxdomain local-zone: "allangillphotography.com" always_nxdomain local-zone: "allanhollowell.com" always_nxdomain @@ -5373,6 +5377,7 @@ local-zone: "alona.org.cy" always_nxdomain local-zone: "aloneintheweb.com" always_nxdomain local-zone: "aloneskisehir.com" always_nxdomain local-zone: "alongthelines.com" always_nxdomain +local-zone: "alongwalker.com" always_nxdomain local-zone: "alonhadat24h.vn" always_nxdomain local-zone: "alooshop.ir" always_nxdomain local-zone: "aloravan.com" always_nxdomain @@ -6130,7 +6135,6 @@ local-zone: "an9news.com" always_nxdomain local-zone: "ana.plecko.eu" always_nxdomain local-zone: "anaaj.pk" always_nxdomain local-zone: "anabim.com" always_nxdomain -local-zone: "anabolicsteroidsbuy.info" always_nxdomain local-zone: "anaceb.com" always_nxdomain local-zone: "anadearmas.net" always_nxdomain local-zone: "anadelgbt.org" always_nxdomain @@ -10103,7 +10107,6 @@ local-zone: "b94yhzk.com" always_nxdomain local-zone: "b97pm6.com" always_nxdomain local-zone: "ba3capital.com" always_nxdomain local-zone: "baacsetu.org" always_nxdomain -local-zone: "baadababada.ru" always_nxdomain local-zone: "baaders-namibia.com" always_nxdomain local-zone: "baakcafe.com" always_nxdomain local-zone: "baamiraan.ir" always_nxdomain @@ -10225,7 +10228,6 @@ local-zone: "backup.utlitslaekning.is" always_nxdomain local-zone: "backup.xn----8sba7bmrlhv0a.xn--p1ai" always_nxdomain local-zone: "backup2.robinandelaine.com" always_nxdomain local-zone: "backupcom.e-twow.uk" always_nxdomain -local-zone: "backupez.com" always_nxdomain local-zone: "backupfashions.com" always_nxdomain local-zone: "backupsitedev.flywheelsites.com" always_nxdomain local-zone: "backupsql.datasiswebcontable.com" always_nxdomain @@ -11608,7 +11610,6 @@ local-zone: "belayadver.com" always_nxdomain local-zone: "belaythakayni.com" always_nxdomain local-zone: "belboks.com" always_nxdomain local-zone: "belboy.in" always_nxdomain -local-zone: "belcineloweek.ru" always_nxdomain local-zone: "belconger.com" always_nxdomain local-zone: "belcorpisl.com" always_nxdomain local-zone: "belcvet.com" always_nxdomain @@ -14167,7 +14168,6 @@ local-zone: "bobbyterry.top" always_nxdomain local-zone: "bobbyworld.top" always_nxdomain local-zone: "bobcar.com.my" always_nxdomain local-zone: "bobcatofchico.com" always_nxdomain -local-zone: "bobcatofredding.com" always_nxdomain local-zone: "bobcook.ca" always_nxdomain local-zone: "bobdolph.com" always_nxdomain local-zone: "bobenstetter.net" always_nxdomain @@ -15419,7 +15419,6 @@ local-zone: "bucketlistrecipes.com" always_nxdomain local-zone: "bucketstrong.s3-us-west-1.amazonaws.com" always_nxdomain local-zone: "buckeyechartershiltonhead.com" always_nxdomain local-zone: "buckeyeoptical.com" always_nxdomain -local-zone: "buckeyesecurity.net" always_nxdomain local-zone: "buckinghamandlloyds.com" always_nxdomain local-zone: "buckleman.co.id" always_nxdomain local-zone: "bucklindata.net" always_nxdomain @@ -15508,6 +15507,7 @@ local-zone: "buildchem.pk" always_nxdomain local-zone: "buildcraftindia.com" always_nxdomain local-zone: "buildentconstructions.com" always_nxdomain local-zone: "builder.acasia.mx" always_nxdomain +local-zone: "builder.makemoneywith.website" always_nxdomain local-zone: "buildersmerchantsfederation-my.sharepoint.com" always_nxdomain local-zone: "buildgreenindustries.com" always_nxdomain local-zone: "building-company.lt" always_nxdomain @@ -16051,7 +16051,6 @@ local-zone: "c.mymortgagegenius.ca" always_nxdomain local-zone: "c.oooooooooo.ga" always_nxdomain local-zone: "c.pieshua.com" always_nxdomain local-zone: "c.teamworx.ph" always_nxdomain -local-zone: "c.top4top.io" always_nxdomain local-zone: "c.top4top.net" always_nxdomain local-zone: "c.vivi.casa" always_nxdomain local-zone: "c.vollar.ga" always_nxdomain @@ -16723,6 +16722,7 @@ local-zone: "capitalnewsagency.com" always_nxdomain local-zone: "capitalonefinanceltd.in" always_nxdomain local-zone: "capitalpellets.com" always_nxdomain local-zone: "capitalpremiumfinancinginc.com" always_nxdomain +local-zone: "capitalprint.co.za" always_nxdomain local-zone: "capitalprivateasset.com" always_nxdomain local-zone: "capitalrealestate.us" always_nxdomain local-zone: "capitalrh.com.br" always_nxdomain @@ -21563,6 +21563,7 @@ local-zone: "covid19.peaceforchildren.net" always_nxdomain local-zone: "covid19map.digital" always_nxdomain local-zone: "covid19quarantin.com" always_nxdomain local-zone: "covid19safety.myftp.org" always_nxdomain +local-zone: "covid19vaccinations.hopto.org" always_nxdomain local-zone: "covid19vaccine.hopto.org" always_nxdomain local-zone: "covid2023.info" always_nxdomain local-zone: "covidbase.info" always_nxdomain @@ -22921,6 +22922,7 @@ local-zone: "dacle.eu" always_nxdomain local-zone: "daclim.ro" always_nxdomain local-zone: "daco-precision.thomaswebs.net" always_nxdomain local-zone: "daco.nyccomputerconsulting.com" always_nxdomain +local-zone: "dacsancaonguyen.vn" always_nxdomain local-zone: "dactridaudaday.com" always_nxdomain local-zone: "dactyltech.co.za" always_nxdomain local-zone: "dacviadokese.com" always_nxdomain @@ -31565,6 +31567,7 @@ local-zone: "estiloraropremium.com.br" always_nxdomain local-zone: "estimating.training" always_nxdomain local-zone: "estimatorfind.com" always_nxdomain local-zone: "estimetercume.com" always_nxdomain +local-zone: "estjh05.top" always_nxdomain local-zone: "estore.qurvex.com" always_nxdomain local-zone: "estoyadieta.com" always_nxdomain local-zone: "estrategias-corporativas.com" always_nxdomain @@ -31740,7 +31743,6 @@ local-zone: "etwqsx23.duckdns.org" always_nxdomain local-zone: "etxse.xyz" always_nxdomain local-zone: "etysu02scnabr03wzaxue.com" always_nxdomain local-zone: "eu-easy.com" always_nxdomain -local-zone: "eu.wildfire.paloaltonetworks.com" always_nxdomain local-zone: "eu1.salesforce.com" always_nxdomain local-zone: "eu283iwoqodjspqisjdf.com" always_nxdomain local-zone: "eu5-cdn.devid.info" always_nxdomain @@ -33884,7 +33886,6 @@ local-zone: "files.danwin1210.me" always_nxdomain local-zone: "files.dropmybin.me" always_nxdomain local-zone: "files.enjin.com" always_nxdomain local-zone: "files.gathercdn.com" always_nxdomain -local-zone: "files.hrloo.com" always_nxdomain local-zone: "files.l-d.tech" always_nxdomain local-zone: "files.martellexpress.us" always_nxdomain local-zone: "files.mirai-2viv.vn" always_nxdomain @@ -35617,6 +35618,7 @@ local-zone: "friendsstarintl.com" always_nxdomain local-zone: "friendzonecafe.com" always_nxdomain local-zone: "frietfun.be" always_nxdomain local-zone: "frigolutasima.net" always_nxdomain +local-zone: "frigoprehrana.com" always_nxdomain local-zone: "frigoriferivignola.it" always_nxdomain local-zone: "frigotechniek.be" always_nxdomain local-zone: "frigsales.com" always_nxdomain @@ -36098,7 +36100,6 @@ local-zone: "fuzzymiles.com" always_nxdomain local-zone: "fv1-2.failiem.lv" always_nxdomain local-zone: "fv13.failiem.lv" always_nxdomain local-zone: "fv15.failiem.lv" always_nxdomain -local-zone: "fv2-2.failiem.lv" always_nxdomain local-zone: "fv2-7.failiem.lv" always_nxdomain local-zone: "fv3.failiem.lv" always_nxdomain local-zone: "fv6.failiem.lv" always_nxdomain @@ -36176,7 +36177,6 @@ local-zone: "g0ogle.free.fr" always_nxdomain local-zone: "g0zh8lb3.com" always_nxdomain local-zone: "g15aocbenedict.com" always_nxdomain local-zone: "g1ba4tt4ngq5nl7w.xyz" always_nxdomain -local-zone: "g1smurt.ru" always_nxdomain local-zone: "g20digital.com.br" always_nxdomain local-zone: "g237.cn" always_nxdomain local-zone: "g2creditsolutions.com" always_nxdomain @@ -36264,9 +36264,6 @@ local-zone: "gadanie-lidia.ru" always_nxdomain local-zone: "gadaniya-magiya.site" always_nxdomain local-zone: "gadcoafrica.com" always_nxdomain local-zone: "gaddco.com" always_nxdomain -local-zone: "gade4senate.com" always_nxdomain -local-zone: "gadebrigade.com" always_nxdomain -local-zone: "gadeforussenate.com" always_nxdomain local-zone: "gadem.ug" always_nxdomain local-zone: "gadesoluciones.pe" always_nxdomain local-zone: "gadget-plaza.ru" always_nxdomain @@ -38414,6 +38411,7 @@ local-zone: "gomiles.vn" always_nxdomain local-zone: "gomitra.com" always_nxdomain local-zone: "gomovies.cl" always_nxdomain local-zone: "gomsubattrangxuatkhau.com" always_nxdomain +local-zone: "gomsuminhlongthainguyen.vn" always_nxdomain local-zone: "gomus.com.br" always_nxdomain local-zone: "gomyfiles.info" always_nxdomain local-zone: "gomypass.com" always_nxdomain @@ -39912,7 +39910,6 @@ local-zone: "h-w-c.net" always_nxdomain local-zone: "h.epelcdn.com" always_nxdomain local-zone: "h.eurotrading.com.pl" always_nxdomain local-zone: "h.j990981.ru" always_nxdomain -local-zone: "h.top4top.io" always_nxdomain local-zone: "h.valerana44.ru" always_nxdomain local-zone: "h002295863.nichost.ru" always_nxdomain local-zone: "h0h.org" always_nxdomain @@ -42142,7 +42139,6 @@ local-zone: "home-spy-shop.com" always_nxdomain local-zone: "home.99eurowebsite.ie" always_nxdomain local-zone: "home.barley-plus.com" always_nxdomain local-zone: "home.dawang.ink" always_nxdomain -local-zone: "home.earthlink.net" always_nxdomain local-zone: "home.evrstudio.com" always_nxdomain local-zone: "home.healthiestu.com" always_nxdomain local-zone: "home.isdes.com" always_nxdomain @@ -42512,6 +42508,7 @@ local-zone: "hosteriapuestadelsol.com" always_nxdomain local-zone: "hostfleek.com" always_nxdomain local-zone: "hostgo.com.br" always_nxdomain local-zone: "hostile-gaming.fr" always_nxdomain +local-zone: "hostimpel.com" always_nxdomain local-zone: "hosting-c.iuro.nl" always_nxdomain local-zone: "hosting.drupwayinfotech.in" always_nxdomain local-zone: "hosting.mrsofttech.com" always_nxdomain @@ -48968,6 +48965,7 @@ local-zone: "kabek.vn" always_nxdomain local-zone: "kabelinieseti.ru" always_nxdomain local-zone: "kabiguru.org" always_nxdomain local-zone: "kabiledans.com" always_nxdomain +local-zone: "kabimmo.com" always_nxdomain local-zone: "kabinarf.ru" always_nxdomain local-zone: "kabiru.ru" always_nxdomain local-zone: "kabiryogashramlimbdi.com" always_nxdomain @@ -50385,7 +50383,6 @@ local-zone: "killu.in" always_nxdomain local-zone: "kilnrefractory.com" always_nxdomain local-zone: "kilolo.site" always_nxdomain local-zone: "kilop.goodvibeskickin.com" always_nxdomain -local-zone: "kilopaskal.ru" always_nxdomain local-zone: "kimaco.com" always_nxdomain local-zone: "kimberly.digital" always_nxdomain local-zone: "kimberly5esthetique.com" always_nxdomain @@ -50717,7 +50714,6 @@ local-zone: "klasterpolskanatura.pl" always_nxdomain local-zone: "klaus-moersch.de" always_nxdomain local-zone: "klausnerlaw.com" always_nxdomain local-zone: "klaussen.net" always_nxdomain -local-zone: "klaustrofebia.ru" always_nxdomain local-zone: "klavze28.com" always_nxdomain local-zone: "klbay.net" always_nxdomain local-zone: "kldatabase.com" always_nxdomain @@ -53619,6 +53615,7 @@ local-zone: "library.arihantmbainstitute.ac.in" always_nxdomain local-zone: "library.cifor.org" always_nxdomain local-zone: "library.dhl-xom.com" always_nxdomain local-zone: "library.iainbengkulu.ac.id" always_nxdomain +local-zone: "library.mju.ac.th" always_nxdomain local-zone: "library.phibi.my.id" always_nxdomain local-zone: "library.piet.co.in" always_nxdomain local-zone: "library.strophicmusic.com" always_nxdomain @@ -55391,7 +55388,6 @@ local-zone: "luminousinvestment.com" always_nxdomain local-zone: "luminouspla.net" always_nxdomain local-zone: "luminouspneuma.com" always_nxdomain local-zone: "lumnus.com.br" always_nxdomain -local-zone: "lumoura.com" always_nxdomain local-zone: "lumperpush.com" always_nxdomain local-zone: "lumsdancorp.com" always_nxdomain local-zone: "lun.otrweb.ru" always_nxdomain @@ -55553,6 +55549,7 @@ local-zone: "lyhnb.club" always_nxdomain local-zone: "lykangblog.com" always_nxdomain local-zone: "lykusglobal.com" always_nxdomain local-zone: "lylevr.com" always_nxdomain +local-zone: "lyllacarter.com" always_nxdomain local-zone: "lylydressforless.com" always_nxdomain local-zone: "lymcomercial.cl" always_nxdomain local-zone: "lymfodrenaze.eu" always_nxdomain @@ -58709,6 +58706,7 @@ local-zone: "medicina.uanl.mx" always_nxdomain local-zone: "medicinadellavoromb.it" always_nxdomain local-zone: "medicinaesteticaorlandini.it" always_nxdomain local-zone: "medicinageriatrica.com.br" always_nxdomain +local-zone: "medicinainterna-critica.com" always_nxdomain local-zone: "medicinaonline.rjsrwaco.watchdogdns.duckdns.org" always_nxdomain local-zone: "medicine.softberg.ro" always_nxdomain local-zone: "mediclaim.odhavnidhi.org" always_nxdomain @@ -61879,6 +61877,7 @@ local-zone: "mtbplus.de" always_nxdomain local-zone: "mtcinteriordesign.co.uk" always_nxdomain local-zone: "mtcr.co.za" always_nxdomain local-zone: "mtcuadrado.com" always_nxdomain +local-zone: "mtdc.com.my" always_nxdomain local-zone: "mte1.cn" always_nxdomain local-zone: "mtechagency.com" always_nxdomain local-zone: "mteestore.com" always_nxdomain @@ -62575,7 +62574,6 @@ local-zone: "myhygienemart.com" always_nxdomain local-zone: "myimmigrationlawmarketingpartner.com" always_nxdomain local-zone: "myimmogroup.be" always_nxdomain local-zone: "myinfoart.online" always_nxdomain -local-zone: "myinstabuzzz.co" always_nxdomain local-zone: "myinstantguru.com" always_nxdomain local-zone: "myinternetjobs.com" always_nxdomain local-zone: "myintromationsz.win" always_nxdomain @@ -62601,6 +62599,7 @@ local-zone: "mylifestoryfilm.com" always_nxdomain local-zone: "mylinkguard.com" always_nxdomain local-zone: "mylistbuildingtraffic.com" always_nxdomain local-zone: "mylisting.martinface.com" always_nxdomain +local-zone: "myliverpoolnews.cf" always_nxdomain local-zone: "myloanbaazar.com" always_nxdomain local-zone: "myloanexpert.in" always_nxdomain local-zone: "mylocal.dk" always_nxdomain @@ -64190,6 +64189,7 @@ local-zone: "news.iid-mit.com.tw" always_nxdomain local-zone: "news.intertours.org.rs" always_nxdomain local-zone: "news.leta.com.vn" always_nxdomain local-zone: "news.lwinmoenaing.me" always_nxdomain +local-zone: "news.makemoneywith.website" always_nxdomain local-zone: "news.medicaid.ir" always_nxdomain local-zone: "news.omumusic.net" always_nxdomain local-zone: "news.palette69.com" always_nxdomain @@ -64973,6 +64973,7 @@ local-zone: "nms.evertechit.live" always_nxdomain local-zone: "nmsk.online" always_nxdomain local-zone: "nmsr.info" always_nxdomain local-zone: "nmvconstructions.com" always_nxdomain +local-zone: "nmxwllwsdyminoragenw.dns.army" always_nxdomain local-zone: "nn-webdesign.be" always_nxdomain local-zone: "nn.5ctelematics.com" always_nxdomain local-zone: "nnasout.com" always_nxdomain @@ -65753,7 +65754,6 @@ local-zone: "nvdvdgp.com" always_nxdomain local-zone: "nvdweb.azurewebsites.net" always_nxdomain local-zone: "nveeusa.com" always_nxdomain local-zone: "nvelj12qyyfi03kqxy.xyz" always_nxdomain -local-zone: "nvgeeforsegt.ru" always_nxdomain local-zone: "nvgp.com.au" always_nxdomain local-zone: "nvi.edu.vn" always_nxdomain local-zone: "nvl.netsmartz.net" always_nxdomain @@ -66971,7 +66971,6 @@ local-zone: "onlusarcadia.it" always_nxdomain local-zone: "only4atalg.ml" always_nxdomain local-zone: "onlyapteka.ru" always_nxdomain local-zone: "onlyart.in" always_nxdomain -local-zone: "onlybamboofabrics.com" always_nxdomain local-zone: "onlycane.in" always_nxdomain local-zone: "onlychild.org" always_nxdomain local-zone: "onlycocktaildresses.com" always_nxdomain @@ -68961,6 +68960,7 @@ local-zone: "payyosafoolayzp.com" always_nxdomain local-zone: "pazarcheto.com" always_nxdomain local-zone: "pazargezer.com" always_nxdomain local-zone: "pazcomau-my.sharepoint.com" always_nxdomain +local-zone: "pazpus.com" always_nxdomain local-zone: "pb-xt.com" always_nxdomain local-zone: "pb.divaasolutions.com" always_nxdomain local-zone: "pb128o6c2favwk.com" always_nxdomain @@ -70706,6 +70706,7 @@ local-zone: "pmrimesndylimtdvensn.dns.army" always_nxdomain local-zone: "pmrimestdylimtdvenst.dns.army" always_nxdomain local-zone: "pmrimestdylimtdvests.dns.army" always_nxdomain local-zone: "pmrimestdylimtstwork.dns.army" always_nxdomain +local-zone: "pmrimewsdylimtewsogh.dns.army" always_nxdomain local-zone: "pmrimewsdylimtwswods.dns.army" always_nxdomain local-zone: "pms.stercomagento.com" always_nxdomain local-zone: "pmsports.de" always_nxdomain @@ -72424,6 +72425,7 @@ local-zone: "prostranstvorosta.ru" always_nxdomain local-zone: "prosupport.cl" always_nxdomain local-zone: "prosvyaz.kz" always_nxdomain local-zone: "prosyarmakassar.com" always_nxdomain +local-zone: "prosystemsug.com" always_nxdomain local-zone: "prosysvinorosso.com" always_nxdomain local-zone: "prot.drupal8.softikom.lv" always_nxdomain local-zone: "protaciohospital.com" always_nxdomain @@ -72434,7 +72436,6 @@ local-zone: "protech.binarybizz.com" always_nxdomain local-zone: "protech.mn" always_nxdomain local-zone: "protechcarpetcare.com" always_nxdomain local-zone: "protechgroup1.com" always_nxdomain -local-zone: "protect.mimecast-offshore.com" always_nxdomain local-zone: "protectiadatelor.biz" always_nxdomain local-zone: "protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org" always_nxdomain local-zone: "protection.pecol.eu" always_nxdomain @@ -73634,6 +73635,7 @@ local-zone: "quatanggmt.com" always_nxdomain local-zone: "quatanghoanglong.com" always_nxdomain local-zone: "quatangluuniemhue.com" always_nxdomain local-zone: "quatangtaynguyen.com" always_nxdomain +local-zone: "quatangtaynguyen.vn" always_nxdomain local-zone: "quatest.sixstarsent.com" always_nxdomain local-zone: "quatet365.com" always_nxdomain local-zone: "quatram.de" always_nxdomain @@ -73699,6 +73701,7 @@ local-zone: "quickbook.online" always_nxdomain local-zone: "quickbookstechnicalsupportphonenumber.com" always_nxdomain local-zone: "quickboooks.host" always_nxdomain local-zone: "quickboooks.space" always_nxdomain +local-zone: "quickcompanyreg.co.za" always_nxdomain local-zone: "quickfingers.net" always_nxdomain local-zone: "quickinsolutions.com" always_nxdomain local-zone: "quicklifecare.com" always_nxdomain @@ -76300,7 +76303,6 @@ local-zone: "roads.stamperinc.org" always_nxdomain local-zone: "roadscompass.com" always_nxdomain local-zone: "roadtravelcars.com" always_nxdomain local-zone: "roanokecellphonerepair.com" always_nxdomain -local-zone: "roanokemortgages.com" always_nxdomain local-zone: "roastedguarmeal.com" always_nxdomain local-zone: "roba.nu" always_nxdomain local-zone: "robaitec.com" always_nxdomain @@ -78672,6 +78674,7 @@ local-zone: "savannaopticalsgh.com" always_nxdomain local-zone: "savasaachi.systems" always_nxdomain local-zone: "savaspark.com.tr" always_nxdomain local-zone: "save-room.info" always_nxdomain +local-zone: "save.makemoneywith.website" always_nxdomain local-zone: "save24x7.com" always_nxdomain local-zone: "saveanimal.org" always_nxdomain local-zone: "savecannabis.org" always_nxdomain @@ -82332,6 +82335,7 @@ local-zone: "slrent.com" always_nxdomain local-zone: "slrpros.com" always_nxdomain local-zone: "sls-eg.com" always_nxdomain local-zone: "sls-security.ru" always_nxdomain +local-zone: "slsbearings.com.sg" always_nxdomain local-zone: "slservicebd.com" always_nxdomain local-zone: "slubnefury.pl" always_nxdomain local-zone: "slugard.5gbfree.com" always_nxdomain @@ -84264,7 +84268,6 @@ local-zone: "srmfiresafety.com" always_nxdomain local-zone: "srnirob.com" always_nxdomain local-zone: "srno.hu" always_nxdomain local-zone: "sromano.it" always_nxdomain -local-zone: "sromecorlduce.ru" always_nxdomain local-zone: "sroomf70nasiru.duckdns.org" always_nxdomain local-zone: "srooooiva.ru" always_nxdomain local-zone: "srpresse.fr" always_nxdomain @@ -86093,7 +86096,6 @@ local-zone: "sunfloro.com" always_nxdomain local-zone: "sunflowerschoolandcollege.com" always_nxdomain local-zone: "sunfruit.com.tn" always_nxdomain local-zone: "sunganak.in" always_nxdomain -local-zone: "sungardspo.com" always_nxdomain local-zone: "sungazer.com.au" always_nxdomain local-zone: "sunglasses2020.com" always_nxdomain local-zone: "sungvalopkhongsam.com" always_nxdomain @@ -89493,6 +89495,7 @@ local-zone: "thefoxfestival.com" always_nxdomain local-zone: "thefragrancefreeshop.com" always_nxdomain local-zone: "thefranssons.com" always_nxdomain local-zone: "thefreelancerschool.com" always_nxdomain +local-zone: "thefrees.com" always_nxdomain local-zone: "thefreewaterfoundation.org.za" always_nxdomain local-zone: "thefront.in" always_nxdomain local-zone: "thefuel.be" always_nxdomain @@ -90077,6 +90080,7 @@ local-zone: "theviestdyjupcafgcms.dns.army" always_nxdomain local-zone: "theviestdyjupcafgmcn.dns.army" always_nxdomain local-zone: "theviestdyjupcafgsvb.dns.army" always_nxdomain local-zone: "theviestdyjupcazfest.dns.navy" always_nxdomain +local-zone: "theviewsdyjupcazfeqv.dns.army" always_nxdomain local-zone: "theviewsdyjupcazwsgv.dns.army" always_nxdomain local-zone: "thevilla46.com" always_nxdomain local-zone: "thevine-organizasyon.com" always_nxdomain @@ -90580,6 +90584,7 @@ local-zone: "timelyent.com" always_nxdomain local-zone: "timelyrain.top" always_nxdomain local-zone: "timenard.top" always_nxdomain local-zone: "timenotbesea.xyz" always_nxdomain +local-zone: "timenow.pw" always_nxdomain local-zone: "timenowis1.top" always_nxdomain local-zone: "timeoffer.site" always_nxdomain local-zone: "timeofvape.tk" always_nxdomain @@ -92345,7 +92350,6 @@ local-zone: "trusticar.lt" always_nxdomain local-zone: "trustinspect.com" always_nxdomain local-zone: "trustlancers.com" always_nxdomain local-zone: "trustorbit.com" always_nxdomain -local-zone: "trustpilot-scam.com" always_nxdomain local-zone: "trustpropertyholdings.com" always_nxdomain local-zone: "trustrambusinesssolutions.com" always_nxdomain local-zone: "trustrobins.info" always_nxdomain @@ -92392,6 +92396,7 @@ local-zone: "ts-deals.me" always_nxdomain local-zone: "ts.7rb.xyz" always_nxdomain local-zone: "ts0ev73.com" always_nxdomain local-zone: "tsal.com" always_nxdomain +local-zone: "tsapparel.com.my" always_nxdomain local-zone: "tsareva-garden.ru" always_nxdomain local-zone: "tsatsi.co.za" always_nxdomain local-zone: "tsauctions.com" always_nxdomain @@ -92953,7 +92958,6 @@ local-zone: "u0649681.cp.regruhosting.ru" always_nxdomain local-zone: "u0707115.cp.regruhosting.ru" always_nxdomain local-zone: "u0746219.cp.regruhosting.ru" always_nxdomain local-zone: "u0774849.cp.regruhosting.ru" always_nxdomain -local-zone: "u1.huatu.com" always_nxdomain local-zone: "u1.innerpeer.com" always_nxdomain local-zone: "u11123p7833.web0104.zxcs.nl" always_nxdomain local-zone: "u1141p8807.web0103.zxcs.nl" always_nxdomain @@ -93696,6 +93700,7 @@ local-zone: "unitedworks.info" always_nxdomain local-zone: "unitedwsdy5defenceforgorvermentsocialeme.duckdns.org" always_nxdomain local-zone: "unitedwsdykesokowsbv.dns.army" always_nxdomain local-zone: "unitedwsdykesokowsgs.dns.army" always_nxdomain +local-zone: "unitedwsdykesokowskg.dns.army" always_nxdomain local-zone: "unitedwsdykesokowsku.dns.army" always_nxdomain local-zone: "unitedwsdykesokowsri.dns.navy" always_nxdomain local-zone: "unitedyfl.com" always_nxdomain @@ -94096,7 +94101,6 @@ local-zone: "url5459.41southbar.com" always_nxdomain local-zone: "url675.textilmallorca.com" always_nxdomain local-zone: "url9823.ville.labrecque.qc.ca" always_nxdomain local-zone: "urlac.de" always_nxdomain -local-zone: "urldefense.us" always_nxdomain local-zone: "urleddrug.at" always_nxdomain local-zone: "urlfrance.fr" always_nxdomain local-zone: "urlm.ir" always_nxdomain @@ -94223,7 +94227,6 @@ local-zone: "uspeshnybusiness.ru" always_nxdomain local-zone: "uspslabel.itemdb.com" always_nxdomain local-zone: "uss.ac.th" always_nxdomain local-zone: "uss21.com" always_nxdomain -local-zone: "ussbd.net" always_nxdomain local-zone: "usselfstoragenetwork.com" always_nxdomain local-zone: "ussrback.com" always_nxdomain local-zone: "ussrgun.000webhostapp.com" always_nxdomain @@ -94338,6 +94341,7 @@ local-zone: "uy-akwaibom.ru" always_nxdomain local-zone: "uyaiblog.com" always_nxdomain local-zone: "uycqawua.applekid.cn" always_nxdomain local-zone: "uydu.antalyaelektrikariza.net" always_nxdomain +local-zone: "uyen.vn" always_nxdomain local-zone: "uyencometics.bmt.city" always_nxdomain local-zone: "uyencuentra.com" always_nxdomain local-zone: "uyf.com.ua" always_nxdomain @@ -98810,7 +98814,6 @@ local-zone: "wotan.info" always_nxdomain local-zone: "wotehb.com" always_nxdomain local-zone: "wotsuper.pw" always_nxdomain local-zone: "wotsuper3.exe" always_nxdomain -local-zone: "wouatiareves.ru" always_nxdomain local-zone: "wourionlion.ru" always_nxdomain local-zone: "woutaalexp.com" always_nxdomain local-zone: "wouterwolf.com" always_nxdomain @@ -99031,6 +99034,7 @@ local-zone: "wsdshipping.com" always_nxdomain local-zone: "wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org" always_nxdomain local-zone: "wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org" always_nxdomain local-zone: "wsdyalgreenkeghewsmq.dns.army" always_nxdomain +local-zone: "wsdyalgreenkelveskxz.dns.army" always_nxdomain local-zone: "wsdyalhjchfonlinedws.dns.navy" always_nxdomain local-zone: "wsdyalhjchfonlinwsdf.dns.army" always_nxdomain local-zone: "wsdyalhjchfonlinwsed.dns.army" always_nxdomain @@ -99054,10 +99058,12 @@ local-zone: "wsdyclntnjkcloudwsgh.dns.army" always_nxdomain local-zone: "wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org" always_nxdomain local-zone: "wsdyibgreenkegheedws.dns.navy" always_nxdomain local-zone: "wsdyibgreenkeghewsyt.dns.army" always_nxdomain +local-zone: "wsdyibgreenventureqx.dns.army" always_nxdomain local-zone: "wsdykalamikonlinedeliverystoreservwspmq.ydns.eu" always_nxdomain local-zone: "wsdykung38communicationtarisupliermgapc.duckdns.org" always_nxdomain local-zone: "wsdykungsb2gotchtsub.dns.army" always_nxdomain local-zone: "wsdykungsb2gotchtwsp.dns.army" always_nxdomain +local-zone: "wsdykungsb2talenwsjf.dns.army" always_nxdomain local-zone: "wsdykungsb2talenwsmz.dns.army" always_nxdomain local-zone: "wsdymsloginvestmwsqd.dns.army" always_nxdomain local-zone: "wsdymsloginvestmwsrw.dns.army" always_nxdomain @@ -99070,9 +99076,11 @@ local-zone: "wsdynitengymndynatem.dns.army" always_nxdomain local-zone: "wsdynitengymndynatin.dns.army" always_nxdomain local-zone: "wsdypmrimelimtdvenws.dns.army" always_nxdomain local-zone: "wsdypmrimelimtdvewsd.dns.army" always_nxdomain +local-zone: "wsdyrkkrgorgiousejhd.dns.army" always_nxdomain local-zone: "wsdyrkkrsuccessmorev.dns.army" always_nxdomain local-zone: "wsdyrkkrsuccessmoven.dns.army" always_nxdomain local-zone: "wsdyrmtcntlfarmtwsvb.dns.army" always_nxdomain +local-zone: "wsdysara1investvwsfs.dns.army" always_nxdomain local-zone: "wsdyshgshg2induswsjg.dns.army" always_nxdomain local-zone: "wsdyshgshgnationalindustrialandgoogledns.duckdns.org" always_nxdomain local-zone: "wsdyshgshgnationalobjindustrialat23fty.duckdns.org" always_nxdomain @@ -100119,7 +100127,6 @@ local-zone: "xnjwkaelsf.gq" always_nxdomain local-zone: "xnk.jbzie.com" always_nxdomain local-zone: "xnkwintech.com" always_nxdomain local-zone: "xnxxchannel.com" always_nxdomain -local-zone: "xnxxfullhd.com" always_nxdomain local-zone: "xo4z0sl.com" always_nxdomain local-zone: "xo57.com" always_nxdomain local-zone: "xoangyduong.com.vn" always_nxdomain @@ -100668,7 +100675,6 @@ local-zone: "yeu49.com" always_nxdomain local-zone: "yeu81.com" always_nxdomain local-zone: "yeu82.com" always_nxdomain local-zone: "yeuhang.tk" always_nxdomain -local-zone: "yeumoitruong.vn" always_nxdomain local-zone: "yeuromndy.cf" always_nxdomain local-zone: "yeutocviet.com" always_nxdomain local-zone: "yewonder.com" always_nxdomain diff --git a/urlhaus-filter-vivaldi-online.txt b/urlhaus-filter-vivaldi-online.txt index 44648503..69df584e 100644 --- a/urlhaus-filter-vivaldi-online.txt +++ b/urlhaus-filter-vivaldi-online.txt @@ -1,5 +1,5 @@ ! Title: Online Malicious URL Blocklist (Vivaldi) -! Updated: Thu, 08 Apr 2021 00:12:42 UTC +! Updated: Thu, 08 Apr 2021 12:12:46 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/urlhaus-filter ! License: https://gitlab.com/curben/urlhaus-filter#license @@ -7,7 +7,6 @@ ||0-24bpautomentes.hu$document ||0cl.sldov.ru$document ||1.10.147.48$document -||1.207.196.135$document ||1.222.196.60$document ||1.245.4.163$document ||1.246.222.107$document @@ -17,10 +16,10 @@ ||1.246.222.134$document ||1.246.222.138$document ||1.246.222.14$document +||1.246.222.153$document ||1.246.222.16$document ||1.246.222.165$document ||1.246.222.20$document -||1.246.222.228$document ||1.246.222.234$document ||1.246.222.237$document ||1.246.222.245$document @@ -47,14 +46,13 @@ ||1.246.223.148$document ||1.246.223.15$document ||1.246.223.151$document -||1.246.223.22$document ||1.246.223.223$document ||1.246.223.4$document ||1.246.223.48$document -||1.246.223.54$document ||1.246.223.58$document ||1.246.223.59$document ||1.246.223.6$document +||1.246.223.61$document ||1.246.223.71$document ||1.246.223.83$document ||1.246.223.94$document @@ -80,7 +78,6 @@ ||102.141.240.139$document ||103.113.99.79$document ||103.125.218.107$document -||103.141.138.118$document ||103.16.145.25$document ||103.204.168.34$document ||103.217.215.21$document @@ -93,15 +90,11 @@ ||103.4.117.26$document ||103.79.112.254$document ||103.82.98.170$document -||103.91.123.92$document +||103.84.240.228$document +||103.84.241.94$document ||103.91.245.12$document ||103.91.245.14$document ||103.91.245.16$document -||103.91.245.17$document -||103.91.245.23$document -||103.91.245.25$document -||103.91.245.28$document -||103.91.245.36$document ||103.91.245.46$document ||103.91.245.47$document ||103.92.25.90$document @@ -121,6 +114,7 @@ ||107.172.193.132$document ||107.172.249.148$document ||107.173.219.80$document +||107.173.23.240$document ||107.174.250.107$document ||107.174.61.139$document ||107.175.197.135$document @@ -134,44 +128,41 @@ ||108.190.201.37$document ||108.190.250.48$document ||108.249.194.121$document -||109.104.151.108$document ||109.124.90.229$document ||109.233.196.232$document ||109.235.7.228$document +||109.248.58.238$document ||109.86.85.253$document -||109.88.185.119$document ||109.95.200.102$document ||109.95.200.230$document ||109.96.127.90$document ||109.96.57.246$document ||109.99.37.97$document ||110.14.58.190$document -||110.187.229.182$document ||110.228.195.46$document ||110.248.124.254$document ||110.248.175.141$document ||110.248.251.194$document ||110.251.10.18$document -||110.253.150.248$document ||110.253.213.198$document ||110.255.101.184$document ||110.35.145.127$document ||110.35.208.21$document ||110.35.221.77$document ||110.35.223.92$document -||110.35.225.24$document +||110.35.233.147$document ||110.35.235.57$document ||110.35.4.2$document ||110.89.10.147$document ||110.89.222.213$document -||111.118.111.207$document +||111.118.41.173$document +||111.118.88.128$document ||111.118.88.61$document ||111.119.245.114$document ||111.125.67.125$document ||111.163.50.120$document ||111.170.86.31$document ||111.172.57.20$document -||111.182.235.252$document ||111.185.171.111$document ||111.185.177.85$document ||111.185.23.84$document @@ -186,7 +177,6 @@ ||111.38.121.223$document ||111.38.121.226$document ||111.38.121.228$document -||111.38.123.136$document ||111.38.26.243$document ||111.38.8.81$document ||112.111.108.184$document @@ -211,7 +201,6 @@ ||112.236.171.69$document ||112.237.141.241$document ||112.237.144.226$document -||112.237.209.30$document ||112.237.75.157$document ||112.237.99.207$document ||112.238.143.135$document @@ -241,6 +230,7 @@ ||112.254.208.123$document ||112.255.6.129$document ||112.255.8.235$document +||112.26.212.80$document ||112.27.124.111$document ||112.27.124.117$document ||112.27.124.131$document @@ -277,6 +267,7 @@ ||112.30.1.219$document ||112.30.1.229$document ||112.30.1.230$document +||112.30.1.245$document ||112.30.1.247$document ||112.30.1.90$document ||112.30.1.91$document @@ -284,6 +275,7 @@ ||112.30.110.38$document ||112.30.110.43$document ||112.30.110.48$document +||112.30.110.62$document ||112.30.38.19$document ||112.30.4.103$document ||112.30.4.124$document @@ -293,16 +285,20 @@ ||112.30.97.184$document ||112.31.0.113$document ||112.31.176.16$document +||112.31.177.39$document ||112.31.240.239$document ||112.31.87.98$document ||112.53.224.79$document +||112.53.227.66$document ||112.65.53.175$document ||112.72.153.37$document +||112.72.162.159$document ||112.72.162.49$document ||112.72.175.147$document ||112.72.176.112$document ||112.72.176.84$document ||112.72.226.202$document +||112.72.231.35$document ||112.78.45.158$document ||112.80.127.91$document ||112.80.215.101$document @@ -314,23 +310,20 @@ ||113.122.238.68$document ||113.161.58.249$document ||113.161.78.185$document -||113.226.42.250$document ||113.227.194.172$document ||113.227.35.229$document ||113.231.211.131$document ||113.254.169.251$document ||113.59.128.133$document ||113.59.133.16$document +||113.59.136.39$document ||113.59.144.42$document -||113.59.154.21$document +||113.59.191.47$document ||113.61.204.205$document -||113.87.226.255$document ||113.87.32.93$document ||113.89.43.185$document ||114.111.242.3$document ||114.224.203.128$document -||114.226.100.56$document -||114.228.205.101$document ||114.229.165.194$document ||114.30.54.64$document ||114.79.172.42$document @@ -338,28 +331,27 @@ ||115.201.38.185$document ||115.42.47.36$document ||115.50.227.209$document -||115.50.92.195$document +||115.53.254.187$document ||115.55.158.93$document ||115.56.131.242$document ||115.56.133.96$document -||115.56.135.210$document ||115.56.152.194$document ||115.58.132.140$document ||115.59.233.160$document -||115.61.112.199$document ||115.73.3.11$document ||115.92.174.231$document +||115.97.142.58$document ||116.124.219.2$document ||116.132.151.60$document ||116.206.164.46$document ||116.211.100.26$document -||117.196.50.5$document +||116.75.197.220$document ||117.20.204.138$document ||117.20.204.5$document -||117.20.210.52$document ||117.20.220.126$document ||117.20.243.40$document ||117.200.76.54$document +||117.251.59.16$document ||117.26.104.74$document ||117.63.113.146$document ||117.63.195.140$document @@ -384,7 +376,6 @@ ||118.233.65.93$document ||118.42.125.246$document ||118.43.180.33$document -||118.79.125.92$document ||118.79.50.203$document ||118.79.58.82$document ||118.99.179.164$document @@ -396,7 +387,6 @@ ||119.123.238.52$document ||119.14.143.145$document ||119.147.213.57$document -||119.163.93.191$document ||119.164.18.235$document ||119.164.218.229$document ||119.165.107.93$document @@ -435,8 +425,9 @@ ||119.56.144.75$document ||119.56.148.115$document ||119.56.155.57$document -||119.56.173.24$document ||119.56.195.90$document +||119.56.206.43$document +||119.56.220.170$document ||12.132.113.2$document ||12.15.69.83$document ||12.178.187.6$document @@ -462,10 +453,10 @@ ||120.193.91.233$document ||120.209.126.235$document ||120.209.126.239$document +||120.209.126.250$document ||120.209.126.60$document ||120.209.127.187$document ||120.209.99.127$document -||120.210.89.79$document ||120.50.66.60$document ||120.50.93.115$document ||120.6.8.11$document @@ -492,6 +483,7 @@ ||122.100.150.204$document ||122.160.147.53$document ||122.188.86.225$document +||122.199.66.28$document ||122.199.72.23$document ||122.199.79.27$document ||122.202.37.85$document @@ -502,6 +494,7 @@ ||123.110.170.237$document ||123.110.182.187$document ||123.110.19.248$document +||123.110.200.98$document ||123.110.238.188$document ||123.129.2.28$document ||123.129.84.36$document @@ -538,9 +531,8 @@ ||123.241.148.58$document ||123.241.184.124$document ||123.28.217.23$document -||123.4.44.113$document ||123.5.5.242$document -||123.8.17.78$document +||123.9.193.157$document ||124.129.221.150$document ||124.129.76.230$document ||124.129.78.176$document @@ -553,6 +545,7 @@ ||124.132.110.150$document ||124.135.34.49$document ||124.152.26.45$document +||124.153.136.175$document ||124.153.236.6$document ||124.160.126.238$document ||124.163.65.64$document @@ -561,6 +554,7 @@ ||124.199.56.198$document ||124.230.174.233$document ||124.254.251.54$document +||124.5.112.43$document ||124.5.92.20$document ||124.6.0.4$document ||124.67.89.28$document @@ -571,7 +565,6 @@ ||125.128.28.161$document ||125.142.93.34$document ||125.191.113.212$document -||125.209.71.6$document ||125.40.1.235$document ||125.40.73.68$document ||125.43.23.193$document @@ -580,6 +573,7 @@ ||128.116.133.92$document ||130.255.159.133$document ||134.195.139.4$document +||134.236.252.28$document ||135.148.36.127$document ||138.99.204.224$document ||139.159.226.180$document @@ -592,6 +586,7 @@ ||14.189.247.118$document ||14.232.33.212$document ||14.37.222.190$document +||14.42.237.237$document ||14.45.127.110$document ||14.46.25.17$document ||14.46.98.241$document @@ -624,7 +619,6 @@ ||163.53.206.228$document ||165.90.16.5$document ||167.114.172.177$document -||168.205.223.254$document ||170.81.238.178$document ||171.120.222.98$document ||171.121.255.12$document @@ -634,11 +628,13 @@ ||171.35.162.156$document ||171.35.174.198$document ||172.105.36.168$document +||172.105.68.51$document ||172.114.244.127$document ||172.245.186.107$document ||172.245.5.185$document ||172.245.5.190$document ||172.245.81.19$document +||172.93.176.142$document ||172.93.194.114$document ||173.167.85.89$document ||173.169.46.85$document @@ -651,14 +647,11 @@ ||173.56.119.108$document ||173.56.92.166$document ||173.63.64.213$document -||174.106.33.85$document ||174.61.3.149$document -||174.61.48.94$document ||174.73.246.193$document ||174.81.78.7$document ||174.83.73.163$document ||175.10.147.167$document -||175.11.193.66$document ||175.11.65.112$document ||175.117.66.74$document ||175.169.13.182$document @@ -679,38 +672,40 @@ ||176.113.161.76$document ||176.113.161.84$document ||176.113.161.91$document +||176.113.174.139$document ||176.12.117.70$document ||176.123.7.115$document ||176.123.7.127$document -||176.123.9.243$document ||176.124.7.225$document -||176.221.188.251$document -||176.221.251.238$document ||176.240.84.106$document ||177.11.92.78$document ||177.131.226.235$document ||177.54.82.154$document ||178.124.182.187$document -||178.134.185.112$document ||178.150.174.65$document ||178.151.143.2$document ||178.165.122.141$document +||178.17.171.144$document +||178.175.0.143$document ||178.175.1.179$document ||178.175.10.164$document +||178.175.10.76$document ||178.175.10.94$document ||178.175.101.51$document ||178.175.102.138$document ||178.175.102.142$document ||178.175.102.162$document ||178.175.102.25$document -||178.175.103.143$document ||178.175.103.173$document +||178.175.103.52$document ||178.175.104.112$document +||178.175.104.67$document ||178.175.104.69$document ||178.175.105.213$document ||178.175.105.238$document ||178.175.105.7$document ||178.175.107.0$document +||178.175.107.71$document ||178.175.108.173$document ||178.175.108.87$document ||178.175.109.118$document @@ -718,57 +713,56 @@ ||178.175.111.135$document ||178.175.111.171$document ||178.175.111.190$document -||178.175.112.111$document ||178.175.112.135$document ||178.175.112.159$document ||178.175.112.198$document ||178.175.112.85$document +||178.175.114.146$document ||178.175.114.151$document -||178.175.114.178$document ||178.175.114.57$document ||178.175.115.166$document ||178.175.116.101$document ||178.175.116.138$document +||178.175.116.20$document ||178.175.116.242$document ||178.175.118.112$document -||178.175.118.116$document -||178.175.118.244$document ||178.175.119.69$document ||178.175.12.135$document ||178.175.120.154$document -||178.175.121.0$document ||178.175.121.228$document +||178.175.121.54$document ||178.175.122.28$document ||178.175.123.213$document -||178.175.123.223$document ||178.175.123.232$document ||178.175.123.248$document ||178.175.123.26$document ||178.175.123.91$document ||178.175.124.4$document ||178.175.125.14$document +||178.175.125.149$document ||178.175.126.129$document -||178.175.126.254$document ||178.175.126.46$document ||178.175.127.202$document -||178.175.127.63$document +||178.175.127.223$document ||178.175.14.14$document +||178.175.14.155$document ||178.175.15.199$document ||178.175.15.232$document ||178.175.15.44$document -||178.175.17.194$document +||178.175.16.26$document ||178.175.17.236$document -||178.175.18.75$document +||178.175.19.160$document ||178.175.19.163$document ||178.175.2.158$document ||178.175.2.217$document ||178.175.2.225$document +||178.175.2.254$document ||178.175.2.59$document ||178.175.20.126$document ||178.175.20.7$document ||178.175.20.74$document -||178.175.21.149$document -||178.175.23.119$document +||178.175.21.41$document +||178.175.22.120$document ||178.175.24.166$document ||178.175.24.232$document ||178.175.25.129$document @@ -776,9 +770,15 @@ ||178.175.27.32$document ||178.175.27.46$document ||178.175.29.233$document +||178.175.3.86$document +||178.175.30.109$document ||178.175.30.133$document ||178.175.30.151$document +||178.175.31.55$document ||178.175.32.146$document +||178.175.32.186$document +||178.175.33.179$document +||178.175.33.32$document ||178.175.34.230$document ||178.175.35.170$document ||178.175.35.193$document @@ -792,108 +792,109 @@ ||178.175.38.12$document ||178.175.4.227$document ||178.175.4.29$document +||178.175.40.209$document +||178.175.42.46$document ||178.175.43.121$document ||178.175.43.217$document -||178.175.43.238$document ||178.175.44.186$document -||178.175.44.241$document ||178.175.45.125$document ||178.175.45.26$document -||178.175.46.41$document ||178.175.46.59$document -||178.175.47.15$document -||178.175.47.181$document +||178.175.47.220$document ||178.175.47.222$document ||178.175.47.80$document -||178.175.48.40$document +||178.175.48.140$document +||178.175.48.223$document +||178.175.48.67$document ||178.175.5.254$document ||178.175.5.44$document -||178.175.5.74$document ||178.175.50.217$document ||178.175.50.42$document +||178.175.50.54$document ||178.175.53.101$document ||178.175.54.186$document -||178.175.54.234$document ||178.175.54.58$document ||178.175.55.99$document -||178.175.56.11$document ||178.175.56.185$document ||178.175.56.56$document -||178.175.57.134$document +||178.175.56.64$document ||178.175.57.14$document ||178.175.57.183$document +||178.175.57.204$document ||178.175.58.230$document ||178.175.58.234$document ||178.175.58.235$document ||178.175.59.106$document ||178.175.60.247$document ||178.175.61.103$document -||178.175.61.210$document -||178.175.62.241$document ||178.175.62.60$document ||178.175.64.156$document -||178.175.64.17$document ||178.175.64.35$document +||178.175.65.189$document ||178.175.65.208$document +||178.175.66.186$document ||178.175.68.123$document -||178.175.68.209$document ||178.175.68.44$document ||178.175.68.57$document +||178.175.69.79$document ||178.175.7.156$document ||178.175.70.218$document ||178.175.70.250$document ||178.175.70.74$document -||178.175.72.148$document +||178.175.72.126$document ||178.175.72.158$document ||178.175.72.75$document ||178.175.73.238$document ||178.175.75.181$document ||178.175.75.205$document +||178.175.75.214$document +||178.175.77.248$document ||178.175.77.47$document ||178.175.78.2$document ||178.175.78.242$document -||178.175.78.243$document ||178.175.79.146$document +||178.175.79.198$document ||178.175.79.66$document -||178.175.8.248$document ||178.175.8.85$document +||178.175.8.93$document ||178.175.80.142$document +||178.175.80.167$document ||178.175.81.185$document ||178.175.81.192$document ||178.175.81.226$document -||178.175.83.224$document +||178.175.81.240$document ||178.175.84.195$document ||178.175.84.215$document +||178.175.86.117$document ||178.175.86.182$document -||178.175.86.47$document ||178.175.86.59$document -||178.175.87.146$document ||178.175.87.16$document ||178.175.87.207$document ||178.175.87.42$document ||178.175.88.102$document -||178.175.88.207$document +||178.175.88.85$document ||178.175.89.121$document +||178.175.89.132$document ||178.175.89.45$document ||178.175.89.69$document ||178.175.91.223$document ||178.175.92.144$document -||178.175.92.33$document ||178.175.93.113$document -||178.175.93.200$document ||178.175.93.234$document ||178.175.93.98$document ||178.175.94.224$document +||178.175.94.248$document ||178.175.94.27$document ||178.175.94.32$document ||178.175.94.40$document -||178.175.95.60$document -||178.175.96.106$document +||178.175.95.105$document +||178.175.95.188$document ||178.175.96.125$document +||178.175.96.93$document ||178.175.97.127$document -||178.175.97.227$document ||178.175.99.106$document ||178.175.99.209$document +||178.175.99.21$document ||178.19.183.14$document ||178.205.101.33$document ||178.21.164.68$document @@ -904,7 +905,6 @@ ||178.48.235.59$document ||178.95.136.35$document ||179.159.58.134$document -||179.4.187.39$document ||179.43.176.41$document ||179.43.176.48$document ||179.60.84.7$document @@ -941,6 +941,7 @@ ||181.49.236.4$document ||181.49.59.162$document ||181.80.69.94$document +||182.112.177.134$document ||182.115.179.201$document ||182.119.206.219$document ||182.119.225.221$document @@ -953,13 +954,14 @@ ||182.233.0.252$document ||182.235.252.31$document ||182.53.197.62$document -||183.105.104.83$document ||183.105.225.154$document ||183.109.169.45$document ||183.143.148.105$document ||183.188.50.93$document -||183.83.8.225$document +||183.83.1.1$document +||183.83.14.20$document ||184.164.185.41$document +||184.175.115.10$document ||184.74.149.230$document ||184.82.15.135$document ||185.106.209.68$document @@ -974,7 +976,6 @@ ||185.215.113.93$document ||185.221.3.244$document ||185.222.58.152$document -||185.224.129.224$document ||185.228.141.74$document ||185.233.186.151$document ||185.245.96.94$document @@ -984,6 +985,7 @@ ||185.55.1.182$document ||185.68.230.207$document ||185.8.173.159$document +||185.81.154.208$document ||185.81.157.186$document ||185.82.217.185$document ||185.82.217.213$document @@ -1011,6 +1013,8 @@ ||188.152.41.141$document ||188.169.178.50$document ||188.169.179.127$document +||188.169.199.59$document +||188.169.30.30$document ||188.169.36.163$document ||188.242.167.159$document ||188.242.242.144$document @@ -1040,6 +1044,7 @@ ||190.216.140.123$document ||190.65.206.162$document ||190.85.213.51$document +||190.92.4.231$document ||190.98.37.135$document ||190.98.37.200$document ||190.98.41.33$document @@ -1053,7 +1058,6 @@ ||192.227.230.72$document ||192.227.230.74$document ||192.227.230.76$document -||192.236.147.58$document ||192.99.240.77$document ||194.113.107.243$document ||194.147.142.230$document @@ -1065,11 +1069,10 @@ ||195.24.94.187$document ||195.5.3.87$document ||196.202.26.182$document +||196.218.48.82$document ||196.221.148.90$document ||196.221.166.203$document ||197.50.27.115$document -||198.23.133.218$document -||198.23.174.104$document ||198.23.213.61$document ||198.23.251.105$document ||198.46.132.132$document @@ -1077,6 +1080,7 @@ ||2.239.22.188$document ||2.36.231.201$document ||2.37.149.230$document +||2.37.203.65$document ||2.45.111.158$document ||2.45.4.24$document ||2.55.125.182$document @@ -1093,32 +1097,29 @@ ||200.194.4.24$document ||200.30.132.50$document ||201.170.46.2$document +||201.171.40.215$document ||201.184.163.170$document ||201.187.102.73$document ||201.200.254.86$document ||201.203.221.20$document ||201.203.27.37$document ||202.107.233.41$document -||202.150.176.100$document ||202.166.217.54$document ||202.175.103.10$document ||202.29.95.12$document ||202.4.124.58$document ||202.51.176.114$document ||202.51.191.174$document -||202.74.236.9$document ||203.109.201.243$document ||203.159.80.128$document ||203.159.80.129$document +||203.159.80.164$document ||203.170.123.78$document ||203.189.156.107$document ||203.204.232.18$document ||203.229.21.56$document ||203.236.190.28$document -||203.238.86.202$document -||203.243.142.132$document ||203.70.166.107$document -||203.77.80.159$document ||203.80.119.166$document ||203.80.171.138$document ||203.82.36.34$document @@ -1133,7 +1134,6 @@ ||209.141.40.31$document ||209.146.98.50$document ||210.124.149.19$document -||210.180.17.140$document ||210.216.152.122$document ||210.216.153.142$document ||210.57.234.93$document @@ -1142,19 +1142,20 @@ ||210.68.242.114$document ||211.187.132.204$document ||211.187.75.220$document -||211.200.160.239$document ||211.204.215.157$document ||211.210.66.179$document ||211.210.93.93$document ||211.216.66.105$document ||211.237.114.96$document ||211.237.120.13$document +||211.237.246.137$document ||211.238.83.238$document ||211.247.5.96$document ||211.32.122.110$document ||211.93.191.153$document ||212.122.86.105$document ||212.143.227.22$document +||212.156.215.178$document ||212.46.197.114$document ||212.56.197.230$document ||213.123.206.197$document @@ -1165,28 +1166,30 @@ ||213.163.104.99$document ||213.163.111.201$document ||213.163.114.136$document -||213.163.114.165$document -||213.163.115.104$document ||213.163.116.153$document +||213.163.118.10$document +||213.163.118.216$document ||213.163.126.20$document ||213.163.126.201$document -||213.163.126.243$document ||213.163.126.7$document +||213.186.69.101$document ||213.189.178.163$document ||213.240.218.15$document ||213.249.156.189$document -||213.91.244.58$document ||213.92.254.52$document ||216.158.238.236$document ||216.170.240.98$document ||216.183.54.169$document +||216.183.54.196$document ||216.36.12.98$document ||217.11.75.162$document +||217.12.209.82$document ||218.12.181.110$document -||218.161.69.135$document ||218.2.40.34$document ||218.234.165.18$document ||218.238.246.3$document +||218.255.226.166$document +||218.32.118.1$document ||218.35.207.119$document ||218.35.227.133$document ||218.35.68.35$document @@ -1196,11 +1199,10 @@ ||218.79.103.159$document ||218.93.102.63$document ||218.93.102.75$document +||219.155.234.33$document ||219.155.29.165$document ||219.155.64.104$document ||219.157.139.165$document -||219.157.202.92$document -||219.157.214.235$document ||219.241.6.180$document ||219.68.1.148$document ||219.68.1.84$document @@ -1214,8 +1216,8 @@ ||21robo.com$document ||220.118.168.155$document ||220.126.237.74$document -||220.132.89.154$document ||220.200.22.163$document +||220.81.44.181$document ||220.90.159.188$document ||221.0.133.84$document ||221.124.78.15$document @@ -1241,11 +1243,13 @@ ||222.132.125.138$document ||222.133.103.120$document ||222.135.9.5$document +||222.137.133.125$document ||222.137.139.86$document ||222.137.73.214$document -||222.138.201.129$document ||222.140.17.245$document +||222.142.210.144$document ||222.185.116.233$document +||222.186.20.19$document ||222.187.9.178$document ||222.211.72.66$document ||222.236.85.220$document @@ -1268,6 +1272,7 @@ ||23.24.213.121$document ||23.243.149.13$document ||23.243.21.167$document +||23.95.122.24$document ||23.95.89.21$document ||24.103.74.180$document ||24.11.141.134$document @@ -1302,7 +1307,6 @@ ||27.147.40.128$document ||27.184.251.135$document ||27.193.217.210$document -||27.194.149.142$document ||27.194.192.66$document ||27.197.23.215$document ||27.199.232.65$document @@ -1332,7 +1336,6 @@ ||27.208.247.130$document ||27.208.25.59$document ||27.208.34.2$document -||27.209.208.122$document ||27.209.231.15$document ||27.21.151.205$document ||27.210.107.125$document @@ -1375,10 +1378,10 @@ ||27.223.242.164$document ||27.35.129.198$document ||27.35.154.13$document -||27.35.2.30$document +||27.35.171.36$document ||27.35.212.124$document ||27.35.58.5$document -||27.7.204.255$document +||27.6.255.101$document ||31.0.98.131$document ||31.11.51.57$document ||31.13.23.180$document @@ -1405,7 +1408,6 @@ ||31.30.119.23$document ||31.32.120.79$document ||32.208.157.193$document -||32792.prolocksmithwinterpark.com$document ||34.122.44.188$document ||35.184.169.169$document ||36.108.231.218$document @@ -1421,6 +1423,7 @@ ||36.66.105.159$document ||36.66.133.125$document ||36.66.139.36$document +||36.67.152.161$document ||36.89.18.133$document ||36.91.89.187$document ||360.lcy2zzx.pw$document @@ -1497,33 +1500,32 @@ ||40.88.2.151$document ||41.139.209.46$document ||41.165.130.43$document -||41.190.63.174$document ||41.193.192.100$document ||41.219.185.171$document ||41.226.60.115$document ||41.72.203.82$document ||41.76.157.2$document ||41.86.18.200$document -||41.86.18.201$document +||41.86.5.164$document ||41.86.5.197$document +||42.202.101.118$document ||42.202.101.199$document +||42.224.51.229$document ||42.228.60.114$document ||42.229.173.80$document ||42.230.91.1$document ||42.231.208.64$document +||42.236.212.157$document ||42.56.15.227$document ||42.61.99.155$document -||42.82.217.241$document +||43.230.207.204$document ||43.241.106.183$document -||43.241.108.134$document -||43.252.8.94$document ||45.133.1.242$document ||45.133.203.192$document ||45.135.134.228$document ||45.14.149.178$document ||45.14.149.182$document ||45.14.149.204$document -||45.141.84.182$document ||45.141.84.184$document ||45.144.225.118$document ||45.144.225.135$document @@ -1533,6 +1535,7 @@ ||45.144.225.27$document ||45.148.10.47$document ||45.148.10.94$document +||45.156.22.230$document ||45.176.109.205$document ||45.176.111.159$document ||45.176.111.35$document @@ -1550,7 +1553,6 @@ ||45.92.108.35$document ||45.95.169.153$document ||46.114.28.132$document -||46.161.185.15$document ||46.172.75.231$document ||46.20.63.218$document ||46.214.27.4$document @@ -1582,6 +1584,7 @@ ||49.213.170.49$document ||49.213.178.183$document ||49.213.179.129$document +||4et3ja.am.files.1drv.com$document ||5.14.122.233$document ||5.188.62.111$document ||5.2.70.50$document @@ -1600,10 +1603,8 @@ ||58.115.174.4$document ||58.125.191.4$document ||58.126.247.118$document -||58.141.122.109$document ||58.142.166.120$document ||58.142.200.124$document -||58.218.67.253$document ||58.22.212.107$document ||58.226.129.29$document ||58.229.194.122$document @@ -1614,7 +1615,6 @@ ||58.241.78.55$document ||58.243.126.133$document ||58.72.165.153$document -||58.72.165.39$document ||58.76.151.51$document ||58.97.206.33$document ||59.0.211.161$document @@ -1625,6 +1625,7 @@ ||59.151.246.125$document ||59.173.193.208$document ||59.23.114.97$document +||59.26.181.228$document ||59.30.12.254$document ||60.13.61.12$document ||60.208.135.42$document @@ -1648,7 +1649,6 @@ ||60.253.44.99$document ||60.253.51.127$document ||60.253.60.174$document -||60.253.8.81$document ||60.7.10.121$document ||60.7.8.43$document ||61.164.96.98$document @@ -1679,17 +1679,19 @@ ||62.141.73.58$document ||62.219.131.205$document ||62.219.143.46$document -||62.219.227.31$document ||62.31.126.33$document ||62.38.149.66$document ||62.38.222.98$document ||62.43.207.148$document ||62.90.165.236$document ||63.245.122.93$document +||64.233.154.99$document +||65.0.168.152$document ||65.125.128.196$document ||65.21.58.252$document ||65.26.155.131$document ||65.35.61.255$document +||66.108.199.144$document ||66.229.214.115$document ||66.57.55.210$document ||66.74.7.197$document @@ -1750,7 +1752,6 @@ ||73.70.164.42$document ||74.101.1.159$document ||74.108.224.112$document -||74.119.195.101$document ||74.194.117.165$document ||74.195.115.176$document ||74.199.84.77$document @@ -1854,6 +1855,7 @@ ||84.40.127.242$document ||84.42.20.217$document ||8402d53c-17e9-4250-8011-20f28f5d404f.certbooster.com$document +||85.105.11.216$document ||85.105.123.251$document ||85.105.135.187$document ||85.105.180.33$document @@ -1866,13 +1868,13 @@ ||85.74.215.180$document ||85.97.130.227$document ||86.35.43.220$document -||87.110.105.250$document +||87.117.11.46$document ||87.172.19.130$document ||87.61.89.40$document -||87du.vip$document ||88.119.171.253$document ||88.2.208.71$document ||88.2.219.179$document +||88.218.17.110$document ||88.218.17.149$document ||88.225.222.128$document ||88.247.96.19$document @@ -1881,10 +1883,12 @@ ||88.249.244.180$document ||88.250.204.12$document ||88.250.226.26$document +||88.250.240.245$document ||88.250.254.90$document ||89.122.183.130$document ||89.136.197.170$document ||89.22.152.244$document +||89.248.112.202$document ||89.29.213.33$document ||89.40.85.166$document ||8poieq.bn.files.1drv.com$document @@ -1960,7 +1964,6 @@ ||aceeprc.com.aceeprc.com$document ||acellr.co.uk$document ||acteon.com.ar$document -||activecost.com.au$document ||addahealingmusic.com$document ||adithimedia.com$document ||adithimedia.memengers.com$document @@ -2023,11 +2026,14 @@ ||artedibujoyarquitectura.com$document ||arwenyapi.com$document ||ask-regard.call-save.biz$document +||asucssa.live$document ||atfile.com$document ||athenacapsg.com$document +||atlasconcreteworks.com$document ||attach.66rpg.com$document ||atteuqpotentialunlimited.com$document ||augustair.com$document +||aulist.com$document ||automaticrefreshments.com$document ||avadhanagames.com$document ||ayahuascasp.com.br$document @@ -2043,6 +2049,7 @@ ||bary.sz4h.com$document ||bash.givemexyz.in$document ||bausch.kr-atlas.monaxikoslykos@zytrox.tk$document +||bavhome.com$document ||bbia.co.uk$document ||bcmt.elin.co.za$document ||bcrg.co.za$document @@ -2076,8 +2083,17 @@ ||bitbucket.org/labesoftware/update/downloads/install_plugin_x64_x86.exe$document ||bitbucket.org/labesoftware/update/downloads/vpn_free.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/1.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/2.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/3.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/clr.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/dianthus.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/n.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/newred.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/omar.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/serv.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/test.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/updachrome.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/updatedata.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/updatev.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/work.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/ya.exe$document @@ -2176,7 +2192,6 @@ ||bt2.elin.co.za$document ||btdapi.robotake.com$document ||buigiaphat.com.vn$document -||bulkyfoodja.com$document ||bullseyemedia.in$document ||busandvanrentalmalaysia.com$document ||buscascolegios.diit.cl$document @@ -2190,11 +2205,8 @@ ||calgaryautorepairservice.com$document ||callbury.in$document ||camminachetipassa.it$document -||canadianwork.cc$document ||capitalgroup-kw.com$document ||capoeiraventrelivre.com$document -||carlsbadre.com$document -||carsidecor.com$document ||cashyinvestment.org$document ||catchperch.com$document ||catchpoolshetlands.co.uk$document @@ -2245,7 +2257,6 @@ ||colorpak.pl$document ||columbia.aula-web.net$document ||community.reimclub.com$document -||comosairdoburaco.com.br$document ||competancy.indigoconsult.net$document ||conceptimagine.ro$document ||config.cqhbkjzx.com$document @@ -2254,12 +2265,14 @@ ||consulateins.solucioneslink.com$document ||contributeindustry.com$document ||copelandscapes.com$document +||corwin-tommie06f.ru.com$document ||coulsongraphics.com$document ||count.mail.163.com.impactmedfoundation.com$document ||covid19.cyberschool.or.id$document ||cpanel.shivay.net$document ||cr-sq.com$document ||craftech.nxtnet.ga$document +||crearechile.cl$document ||creationskateboards.com$document ||crecerco.com$document ||crittersbythebay.com$document @@ -2269,6 +2282,7 @@ ||crscorretordeimoveis.com.br$document ||cse-engineer.com$document ||csnserver.com$document +||ctracknxt.in$document ||cubescargoexpress.com$document ||curasoles.co.za$document ||currantmedia.com$document @@ -2287,7 +2301,6 @@ ||dating.khokhas.co.za$document ||datsom.vn$document ||davethompson.me.uk$document -||davidmcguinness.info$document ||dayspringdaisies.com$document ||dd.qiyuea.cn$document ||ddns.cyberium.cc$document @@ -2321,15 +2334,13 @@ ||dl.installcdn-aws.com$document ||dl.packetstormsecurity.net$document ||dl.rina-roleplay.com$document -||dnn.alibuf.com$document -||dns.alibuf.com$document ||dockerupdate.anondns.net$document ||docman.orientalservices.in$document ||docs.google.com/uc?export=download&id=1ktcghnmcwws43wzscphukbfnwtuaxidx&revid=0b8z0b7_i5sirk2xrtehmstg0vxvit3b4n3lmbdrdrjrodndrpq$document +||docs.google.com/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq$document ||dodsonimaging.com$document ||doitunlimited.com$document ||dokan.blueberrytec.com$document -||dom-chel74.ru$document ||dom.daf.free.fr$document ||doncedyhall.com$document ||donghobinhminh.com$document @@ -2339,6 +2350,7 @@ ||dosman.pl$document ||dovberger.com$document ||down.pcclear.com$document +||down.udashi.com$document ||down.webbora.com$document ||down1.arpun.com$document ||download.caihong.com$document @@ -2355,63 +2367,54 @@ ||drgroup.co.za$document ||drive.google.com.it-barcelona.com/frm0reseen/prntscrnofamzorderid.jpg.exe$document ||drive.google.com/uc?export=download&id=0byfg0_4xbjgnwvuyev9ltuh4rmm$document +||drive.google.com/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g$document ||drive.google.com/uc?export=download&id=12khl-unz2np4q54b2jgpwlsh6cuz0pss$document ||drive.google.com/uc?export=download&id=13vodfxml9fg8kcnexuafh64dzmnqv8ch$document ||drive.google.com/uc?export=download&id=1447omxvaovzfr9harkg438t109udpo6g$document -||drive.google.com/uc?export=download&id=152yoztzpbx_bbpxepfackfklg8c1eao6$document -||drive.google.com/uc?export=download&id=15hcgek7odccdafzf-9gvibnlgkirj4uo$document ||drive.google.com/uc?export=download&id=167imxqgc8ehepa1gisxa6q6ifcjxceox$document +||drive.google.com/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo$document ||drive.google.com/uc?export=download&id=17fzcx0cdsopga0hteu_wqskcnzxjgt-w$document -||drive.google.com/uc?export=download&id=194lqzukzvt-jtdxmihcvhd0yk1sxoybk$document ||drive.google.com/uc?export=download&id=1a-herfdxr6xamxeabcdao0mqw9bimrig$document ||drive.google.com/uc?export=download&id=1aiqoavdbe5pw8sfmvel6iu7qptkqfwld$document ||drive.google.com/uc?export=download&id=1aphk_vq7gtn368zxpd5bg5rv8nk0bnhn$document ||drive.google.com/uc?export=download&id=1bnntyfzaofvlzikaaaabr8_vz-nx9zmw$document ||drive.google.com/uc?export=download&id=1br5iufkkmmfeipqo3ecviqykbcdgcnio$document ||drive.google.com/uc?export=download&id=1byj1kld84im01lyhb239rds4kvoyaxkv$document -||drive.google.com/uc?export=download&id=1cos43rmscrescxk3u40qjuqbwr-pydsn$document ||drive.google.com/uc?export=download&id=1cvicrmlbj2ak666h6wsaaqegjpflnben$document +||drive.google.com/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a$document ||drive.google.com/uc?export=download&id=1dhoxtwbb2ycn8q06gi3p-ao_llldff0e$document ||drive.google.com/uc?export=download&id=1fensc6gc0fww0gbevsrnwwnlajypzdvv$document ||drive.google.com/uc?export=download&id=1gprlk2mcrl6law-zk5r0pjogaqrxwepd$document ||drive.google.com/uc?export=download&id=1htinwtfrw1wc3_ma8odztnq0qpnic2q6$document ||drive.google.com/uc?export=download&id=1ieolbiw9ao8m8umyi7owwqlt-_-7byei$document ||drive.google.com/uc?export=download&id=1ix4yfvtfik605yavvm7wyo0bk4ch93fr$document -||drive.google.com/uc?export=download&id=1jkov2g5s1xkcq4bfb3uvmd6inhadatrg$document ||drive.google.com/uc?export=download&id=1kbibk7ke3eouiu5jmoi_hewgnofvlugd$document -||drive.google.com/uc?export=download&id=1kjcylye1dbmhystyyotz-3pagktkhlhq$document +||drive.google.com/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx$document ||drive.google.com/uc?export=download&id=1lsv4sko083sywwjndgqnsh_6sgqodqtu$document ||drive.google.com/uc?export=download&id=1lxhsrayg98hr9n7vww_o9371ftpeqeer$document ||drive.google.com/uc?export=download&id=1m3scc_3y1bynmckd0prprlpegezspiyp$document -||drive.google.com/uc?export=download&id=1mwgdd3lxuuk-bnsrm1rpclom0cmx7wob$document ||drive.google.com/uc?export=download&id=1n8o4hbvi7o9ks9jqhofny7okposfaz4y$document ||drive.google.com/uc?export=download&id=1nio_cdsggt4zv1kdrpubrfpd0pzsyffd$document -||drive.google.com/uc?export=download&id=1nmf6kty3xsoygjxjhb-bsafvlfy-0lt2$document ||drive.google.com/uc?export=download&id=1oabvvnazifkxktvt-izbcdqpb7dm6nrw$document ||drive.google.com/uc?export=download&id=1oqcdx7nay3xomvkgaopkuqmqj5ibihol$document -||drive.google.com/uc?export=download&id=1p5fvqkxzwoiu_uauzbmrxpklsetculad$document ||drive.google.com/uc?export=download&id=1pcf0geiecvcakppxn5kqdxqz-hfmsymk$document ||drive.google.com/uc?export=download&id=1ph-lri07dohowhmuczrrvjwrtsvmnu9s$document ||drive.google.com/uc?export=download&id=1prxtn1juykhcr_9ilw-vtirv5anyeoej$document -||drive.google.com/uc?export=download&id=1q1dwckludrpqijtrpw14_60d5nu7n97t$document ||drive.google.com/uc?export=download&id=1qfblc5898vrcfnf4vfgbnwi6cqb7io7p$document ||drive.google.com/uc?export=download&id=1r1flwyfwtyziyr47y5sk3q821r6_tgsl$document ||drive.google.com/uc?export=download&id=1r9f9irwhutxozsbp2h9erd_a7fa2pwko$document ||drive.google.com/uc?export=download&id=1s221a6wpx6i7nfrztnhh9priojtybuxq$document -||drive.google.com/uc?export=download&id=1sjvkrinuscxqmbkdeusxaezazbiagnv3$document -||drive.google.com/uc?export=download&id=1so1trfuzt5-giahetghfhmd-_ot3rq35$document ||drive.google.com/uc?export=download&id=1t1bd_itjnhsmozdl9was0gouehujm1fn$document ||drive.google.com/uc?export=download&id=1udhv7d8lzwsiialv2k6jvv5v7gy4rf6w$document ||drive.google.com/uc?export=download&id=1ufiniimko4xikjg27vzvpxhdjlap2wno$document ||drive.google.com/uc?export=download&id=1vevblftithattyguwyjot1p0wptg7l5t$document ||drive.google.com/uc?export=download&id=1vjq92eqivh01yxmal20whl2es3ld6nxb$document +||drive.google.com/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy$document ||drive.google.com/uc?export=download&id=1vvzrw6wrxnyei8s0iwpf2v6ndrrz_mzh$document ||drive.google.com/uc?export=download&id=1xfwgl7xdqzqjccteivad-snxb_8yim1e$document ||drive.google.com/uc?export=download&id=1xqmjyd-syoy31suhjuqzlg4rblxq9ohi$document ||drive.google.com/uc?export=download&id=1xt-g7waixr7glvz_rdxglblidv6qgu58$document ||drive.google.com/uc?export=download&id=1yawygcfjs9inzoiwagqfcn3utaywxmwi$document -||drive.google.com/uc?export=download&id=1yhflwpk3yeyrdhlhanctlind-5j24iwv$document -||drive.google.com/uc?export=download&id=1yqpuxjbnjokc5fjgt-8xzuybr97rtvg2$document ||drive.google.com/uc?export=download&id=1ywkgalidldb32pio6ywmbyvdk7oar3yy$document ||drive.google.com/uc?export=download&id=1zbclvhabervgfryoyqklo4_oe6icd8sr$document ||drive.google.com/uc?id=148pt6v0nlg8yoim7w6in7dpixkzaacbg&export=download&authuser=0$document @@ -2434,6 +2437,7 @@ ||eandgdesign.com.ng$document ||eastsheen-glaziers.co.uk$document ||ebruyatkin.com$document +||edu.saicraftsman.com$document ||eedo.ee$document ||efficientegroup.com$document ||elbauldenora.com$document @@ -2448,8 +2452,8 @@ ||erp.zilymax.com$document ||escola.probommar.org.br$document ||esnconsultants.com$document -||esrhf04.top$document ||essentia.org.br$document +||estjh05.top$document ||ethereality.info$document ||eubanks7.com$document ||europeanzonexxi.com$document @@ -2531,9 +2535,11 @@ ||goldcoastoffice365.com.au$document ||golden-memories-funerals.yourpageserver.com$document ||goldenasiacapital.com$document +||goldmen.in$document ||gpotecnosystems.com$document ||gracejukes.com$document ||grupoinmare.com$document +||gruposelt.000webhostapp.com$document ||gs.monerorx.com$document ||guide-to-cell-phones.com$document ||gulfac-house.com$document @@ -2561,6 +2567,7 @@ ||hmpmall.co.kr$document ||hoagietesting10.com$document ||hoayeuthuong-my.sharepoint.com$document +||holmesservices.mobiledevsite.co$document ||homefindersolutions.com$document ||hongluosi.com$document ||hookedupboatclub.com$document @@ -2575,6 +2582,7 @@ ||htownbars.com$document ||hubtech.co.za$document ||huellacero.cl$document +||hunchomusichub.com$document ||hunggiang.vn$document ||husamiyahschool.com$document ||ia801802.us.archive.org/19/items/startup_20210219/startup.txt$document @@ -2632,7 +2640,6 @@ ||jcedu.org/ebook/cs17.exe$document ||jebs.net.au$document ||jeffdahlke.com$document -||jhayesconsulting.com$document ||jiaoyuzixun.cn$document ||jing-da.com.tw$document ||jmtc.91756.cn$document @@ -2649,7 +2656,6 @@ ||jupiter.toxsl.in$document ||justinscott.com.au$document ||kadigital.co.uk$document -||kaizenjanitorial.com$document ||kalawatihomes.com$document ||kalogirosfinance.com$document ||kaptaanchapal.com$document @@ -2661,11 +2667,9 @@ ||ketofitnessexpert.com$document ||kevinjewelry.com.co$document ||keywatch.yourpageserver.com$document -||khmerosja.net$document ||kingssa.co.za$document ||kizitox.ga$document ||kjcpromo.com$document -||kldatabase.com$document ||kleinendeli.co.za$document ||korrectconceptservices.com$document ||kotakwarna.co.id/dg/etrac/nf4emwz/$document @@ -2674,7 +2678,7 @@ ||ktb.sch.id$document ||kuaizip.com/down/affiliate/kuaizip_setup_10029.exe$document ||kubatoglubaklava.com.tr$document -||kullumanalitours.com$document +||kumaralok.in$document ||kwanfromhongkong.com$document ||kz.sldov.ru$document ||lacasadelosalebrijes.com$document @@ -2683,7 +2687,6 @@ ||laodongnhat.vn$document ||laravel.pointersoftwares.com.br$document ||lasermobilesounds.co.uk$document -||laura9630fr.com$document ||lauratomismith.com$document ||lautarosanmiguel.com$document ||lawforall.edu.lk$document @@ -2792,14 +2795,12 @@ ||misterson.com$document ||mkontakt.az$document ||mktf.mx$document -||mmdx.com$document ||mmogollon.com.mx$document ||mncarteam.com$document ||modelhouseturkey.com$document ||modernmanna.org$document ||monetization.business$document ||moninediy.com$document -||mopai.sg$document ||morrobaydrugandgift.com/wp-contentbak/t9m/$document ||motorcomunicacion.com$document ||moumitas.com$document @@ -2822,7 +2823,7 @@ ||nch.com.au/components/aacenc.exe$document ||nch.com.au/components/doxillionsetup.exe$document ||nec-i.com$document -||nellaimasthanbiryani.com$document +||nelitrianggraeni.000webhostapp.com$document ||nerve.untergrund.net$document ||nettube.com.br$document ||networkwheels.co.za$document @@ -2843,6 +2844,7 @@ ||nilinkeji.com$document ||nimboohomes.com$document ||njtiledesigncenter.com$document +||nmxwllwsdyminoragenw.dns.army$document ||nobius.org$document ||nocalnoodle.elin.co.za$document ||nomadicbees.com$document @@ -2857,6 +2859,7 @@ ||nyeh2o.com.au$document ||obseques-conseils.com$document ||oecteam.com$document +||ohe.ie$document ||ohsewgorgeous.co.uk$document ||oknoplastik.sk$document ||oldschoolvalue.s3.amazonaws.com/spreadsheets/osv_stock_valuation-sample-dummy.exe$document @@ -2868,6 +2871,8 @@ ||omscoc.pappai.com$document ||onedigitalcard.granvizionnecorp.com$document ||onedrive.listifyapp.co$document +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm$document +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$document ||onedrive.live.com/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa$document ||onedrive.live.com/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq$document ||onedrive.live.com/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe$document @@ -2914,6 +2919,7 @@ ||onedrive.live.com/download?cid=15d9646f4dbf9553&resid=15d9646f4dbf9553%21110&authkey=ag0eg1lha_lwgi0$document ||onedrive.live.com/download?cid=165468846f076ee7&resid=165468846f076ee7!118&authkey=antash3ig98aqte$document ||onedrive.live.com/download?cid=165468846f076ee7&resid=165468846f076ee7%21118&authkey=antash3ig98aqte$document +||onedrive.live.com/download?cid=16b1c02dce9ea41f&resid=16b1c02dce9ea41f!286&authkey=almwisomhv3c0zc$document ||onedrive.live.com/download?cid=174a158b69387a7e&resid=174a158b69387a7e!348&authkey=ahnjoxa4ufoxa54$document ||onedrive.live.com/download?cid=174a158b69387a7e&resid=174a158b69387a7e%21348&authkey=ahnjoxa4ufoxa54$document ||onedrive.live.com/download?cid=18418adacefed6e2&resid=18418adacefed6e2!126&authkey=ad4yflrisq6d82g$document @@ -2933,6 +2939,14 @@ ||onedrive.live.com/download?cid=1f48501ee4e8735a&resid=1f48501ee4e8735a%215268&authkey=advgihzjzelvkdg$document ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4$document ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc$document +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom$document +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom$document ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21154&authkey=alkjikpdfxvm8po$document ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21155&authkey=afu-yax_gxxddoe$document ||onedrive.live.com/download?cid=24ef9e675b079af9&resid=24ef9e675b079af9%21156&authkey=alqvv8nixrvsqrk$document @@ -2944,6 +2958,10 @@ ||onedrive.live.com/download?cid=2894380eb084b79e&resid=2894380eb084b79e%21253&authkey=aimqerwvuylzjga$document ||onedrive.live.com/download?cid=2968c371f5450503&resid=2968c371f5450503!122&authkey=aaqhhxbnwfwrz28$document ||onedrive.live.com/download?cid=2968c371f5450503&resid=2968c371f5450503%21122&authkey=aaqhhxbnwfwrz28$document +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi$document +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk$document +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi$document +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk$document ||onedrive.live.com/download?cid=2c1abc526306a6e1&resid=2c1abc526306a6e1%21106&authkey=adjthwhvjkbioc0$document ||onedrive.live.com/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21109&authkey=aopcxq3owfiv620$document ||onedrive.live.com/download?cid=2c38c37ed8430789&resid=2c38c37ed8430789%21114&authkey=ajzoj0ujggsnxlo$document @@ -2990,8 +3008,10 @@ ||onedrive.live.com/download?cid=4266fcac716657a2&resid=4266fcac716657a2!106&authkey=aoigmqhuw6vqijm$document ||onedrive.live.com/download?cid=4266fcac716657a2&resid=4266fcac716657a2%21106&authkey=aoigmqhuw6vqijm$document ||onedrive.live.com/download?cid=44d422e98133708b&resid=44d422e98133708b%21108&authkey=akr9cesktucbqik$document +||onedrive.live.com/download?cid=44d422e98133708b&resid=44d422e98133708b%21109&authkey=adzxmpjk-etbkjq$document ||onedrive.live.com/download?cid=45f0213456d899c0&resid=45f0213456d899c0%211133&authkey=alwgkm79xod8hpy$document ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0$document +||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0$document ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw$document ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw$document ||onedrive.live.com/download?cid=48ada4e22fff3e13&resid=48ada4e22fff3e13%21421&authkey=acd1sidm8c5fk0y$document @@ -3007,6 +3027,7 @@ ||onedrive.live.com/download?cid=4e45a2988ed9335b&resid=4e45a2988ed9335b%21108&authkey=anbjpqxg-iwr4g8$document ||onedrive.live.com/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21337&authkey=ahhqrhiv2ei4xjc$document ||onedrive.live.com/download?cid=4e57dde6c5c6b372&resid=4e57dde6c5c6b372%21344&authkey=aatlbjfo3tjnx2y$document +||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4$document ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8$document ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0$document ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21116&authkey=anbj_rrcgyturjc$document @@ -3097,10 +3118,15 @@ ||onedrive.live.com/download?cid=604aa6c584db9137&resid=604aa6c584db9137%21126&authkey=an6sswp8an1kfoe$document ||onedrive.live.com/download?cid=607978009e823f21&resid=607978009e823f21!446&authkey=aofddjtovqbb_3i$document ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8$document +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq$document +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s$document ||onedrive.live.com/download?cid=618391b69828cf46&resid=618391b69828cf46%21212&authkey=akmdmweqgestysa$document ||onedrive.live.com/download?cid=6196314c52185efc&resid=6196314c52185efc%21106&authkey=ape4rx1hrtmrxxe$document ||onedrive.live.com/download?cid=65d5e5f1b48c0d94&resid=65d5e5f1b48c0d94!852&authkey=adzvvmms349gxmi$document ||onedrive.live.com/download?cid=65f2f37122477ee7&resid=65f2f37122477ee7%211001&authkey=ap3umqxngmtk-6e$document +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e!1094&authkey=anqjzd7pr18fu90$document +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211094&authkey=anqjzd7pr18fu90$document +||onedrive.live.com/download?cid=6601b18b9069ce5e&resid=6601b18b9069ce5e%211099&authkey=alxq-bvz7nqbv4c$document ||onedrive.live.com/download?cid=6605275726c6094a&resid=6605275726c6094a%21129&authkey=ak5szbnikeklmzk$document ||onedrive.live.com/download?cid=6605275726c6094a&resid=6605275726c6094a%21132&authkey=ad3ia_1wkq0lyd4$document ||onedrive.live.com/download?cid=6608a4dea9ff5918&resid=6608a4dea9ff5918%21399&authkey=aoya7flv_s9toxo$document @@ -3171,6 +3197,8 @@ ||onedrive.live.com/download?cid=890837b4e4ca07c6&resid=890837b4e4ca07c6%21289&authkey=abujc0akmtbsxf4$document ||onedrive.live.com/download?cid=8a1574ed0cecd68a&resid=8a1574ed0cecd68a%21395&authkey=ane01evt0sz-1wk$document ||onedrive.live.com/download?cid=8c77cee60e33a6b1&resid=8c77cee60e33a6b1%21106&authkey=af8h8jn801bjnbk$document +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y$document +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y$document ||onedrive.live.com/download?cid=8ffd8cbd6540c065&resid=8ffd8cbd6540c065!822&authkey=acfj7bbrmktj1i0$document ||onedrive.live.com/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21276&authkey=afig5wsljtdc33s$document ||onedrive.live.com/download?cid=911a03165832a3d6&resid=911a03165832a3d6%21278&authkey=abdo23i3bvy0_my$document @@ -3190,11 +3218,6 @@ ||onedrive.live.com/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21410&authkey=acwug6bewxk0pli$document ||onedrive.live.com/download?cid=96e7ccc5d61517fc&resid=96e7ccc5d61517fc%21411&authkey=aj8o1fcvfhibmlm$document ||onedrive.live.com/download?cid=96fd249b957988a2&resid=96fd249b957988a2%211303&authkey=ah_etf1fqofknue$document -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935!778&authkey=aaezyk4ypt-elma$document -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21772&authkey=akeozmv0aafqlbg$document -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21774&authkey=aly_m3fnrvh6dfq$document -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21775&authkey=abblpjxi4mwomgs$document -||onedrive.live.com/download?cid=97b465ea1ddc3935&resid=97b465ea1ddc3935%21777&authkey=ahmuwqi4jg8rvho$document ||onedrive.live.com/download?cid=98103c88c2d68867&resid=98103c88c2d68867!773&authkey=akptbml43mi4ufc$document ||onedrive.live.com/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211925&authkey=amhhfhcsigeue9w$document ||onedrive.live.com/download?cid=982b2c4bb2a23649&resid=982b2c4bb2a23649%211927&authkey=an_3paqpemptbvm$document @@ -3264,6 +3287,7 @@ ||onedrive.live.com/download?cid=b8ba73db68da7c0b&resid=b8ba73db68da7c0b%217521&authkey=ablt9zdyq2d4rb0$document ||onedrive.live.com/download?cid=b90c1aa3b6cd0326&resid=b90c1aa3b6cd0326%21471&authkey=aoil8ra4oc4s_2m$document ||onedrive.live.com/download?cid=b9690a1860a591d0&resid=b9690a1860a591d0%21161&authkey=aehawjpwf6tqtm8$document +||onedrive.live.com/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$document ||onedrive.live.com/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540!1047&authkey=aod6jbxyicq2v4g$document ||onedrive.live.com/download?cid=bd6fbb121626b540&resid=bd6fbb121626b540%211047&authkey=aod6jbxyicq2v4g$document ||onedrive.live.com/download?cid=beaf30da1f621c9b&resid=beaf30da1f621c9b!246&authkey=afyrchdutalpu90$document @@ -3272,6 +3296,7 @@ ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214199&authkey=adgqe8qiyu92bqm$document ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai$document ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk$document +||onedrive.live.com/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta$document ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa$document ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019%211251&authkey=act34eizpzjugfa$document ||onedrive.live.com/download?cid=c3d8ad85ba2add4e&resid=c3d8ad85ba2add4e!1337&authkey=afnvu1fsuczht5e$document @@ -3331,11 +3356,6 @@ ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21191&authkey=ajl2uegqunsgc3q$document ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21192&authkey=acd_hx4bka3z0nw$document ||onedrive.live.com/download?cid=d718e3c8e3bc53c0&resid=d718e3c8e3bc53c0%21193&authkey=ah68m6pamjvyscy$document -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!141&authkey=alya4infudqs53o$document -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5!142&authkey=aiemnxi-s-5vrz0$document -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21141&authkey=alya4infudqs53o$document -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0$document -||onedrive.live.com/download?cid=d8baa6d17fe7ceb5&resid=d8baa6d17fe7ceb5%21142&authkey=aiemnxi-s-5vrz0&c=3ii9gcd&r=5onulz3wldybwlmup37su3&k=7s1&s=kzymn52eroemh1tamvmlsfsn9jtvwguukky5hlxcfgw$document ||onedrive.live.com/download?cid=db0fc77df51690e1&resid=db0fc77df51690e1%21802&authkey=apefr8w_rdk--pe$document ||onedrive.live.com/download?cid=db5548cd728f142b&resid=db5548cd728f142b%21187&authkey=aansxudby0o7uwq$document ||onedrive.live.com/download?cid=db62f747c6d887d0&resid=db62f747c6d887d0%21111&authkey=ai2guftczvfehs4$document @@ -3369,6 +3389,7 @@ ||onedrive.live.com/download?cid=e627fc797baa3032&resid=e627fc797baa3032!2324&authkey=aa8i-r7ixmcraha$document ||onedrive.live.com/download?cid=e627fc797baa3032&resid=e627fc797baa3032%212324&authkey=aa8i-r7ixmcraha$document ||onedrive.live.com/download?cid=e74fdc1373fe6eb7&resid=e74fdc1373fe6eb7!142&authkey=apwl64nhnjaj8ke$document +||onedrive.live.com/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21349&authkey=ae9ea8jdsa7vmom$document ||onedrive.live.com/download?cid=e790c3d4dd4fa5db&resid=e790c3d4dd4fa5db%21350&authkey=ao-vuexoihzj7da$document ||onedrive.live.com/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2!142&authkey=ais88uad5aom6qu$document ||onedrive.live.com/download?cid=e859da0f2c81d5f2&resid=e859da0f2c81d5f2%21142&authkey=ais88uad5aom6qu$document @@ -3445,9 +3466,11 @@ ||pagos.krayem.com.mx$document ||palbas.cl$document ||palochusvet.szm.com$document +||panslimiterd.com$document ||parallel.rockvideos.at$document ||parejasfelices.mi-fs.com$document ||parkhussion.com$document +||paste.ee/r/a39ev$document ||pastebin.com/raw/77jhk0iw$document ||pastebin.com/raw/89hkc7wb$document ||pastebin.com/raw/yqvsvlvq$document @@ -3479,6 +3502,7 @@ ||plasfan.ind.br$document ||playground2.grupoaliadasca.com$document ||pmglance.startwriteup.com$document +||pmrimewsdylimtewsogh.dns.army$document ||pokojewewladyslawowie.pl$document ||pole.com.vc$document ||pool.phxdir.com$document @@ -3494,7 +3518,6 @@ ||procrossover.ru/wp-content/uploads/2020/10/skodaqq.jpg$document ||production.sparshims.com$document ||programaoperadoronline.com.br$document -||project.exquitec.com$document ||promotoradescomplica.com.br$document ||promoversdubai.com$document ||propertiq.elin.co.za$document @@ -3504,7 +3527,6 @@ ||prosyarmakassar.com$document ||provence.elin.co.za$document ||prox.realunix.cc$document -||prueba.danielluza.com$document ||pujashoppe.in$document ||punchdialogues.com$document ||punjabdevelopersassociation.com.pk$document @@ -3523,7 +3545,6 @@ ||rainbowisp.info$document ||rajeshtailang.com$document ||rakeshkhatri.in$document -||raodigitalmedia.com$document ||raquelhelena.com.br$document ||rarlabarchiver.ac$document ||rasadbar.ir$document @@ -3548,7 +3569,6 @@ ||readymmade.com$document ||recyclethesurplus.com$document ||redbats.co.in$document -||redboxmultimedia.com$document ||redchillicrackers.com$document ||reifenquick.de$document ||relaxindulge.co.nz$document @@ -3635,7 +3655,6 @@ ||sibernetix.fr$document ||sigapresschennai.com$document ||sige.brisainformatica.com.br$document -||signatureads.co.in$document ||siili.net$document ||simoneporzi.it$document ||simorsint.com$document @@ -3672,7 +3691,6 @@ ||spetsesyachtcharter.gr$document ||spititourism.com$document ||spittinfire.com$document -||springbedspetroleum.com$document ||src1.minibai.com$document ||sreenivasapaintingworks.com$document ||sriglobalit.com$document @@ -3724,12 +3742,12 @@ ||tajushariya.com$document ||tallyinvoicecustomization.com$document ||taltus.co.uk$document -||tapalkoedacoffee.com$document ||tarravalleyfoods.com.au$document ||tavo.cl$document ||tc.snpsresidential.com$document ||tcy.198424.com$document ||tdsp.yngw518.com$document +||tech332.synology.me$document ||techgms.com$document ||technologydistilled.com/a-nurse-ss8d9/z/$document ||teduae.com$document @@ -3769,6 +3787,7 @@ ||theprofinn.com$document ||thesummitpc.net$document ||theurbantutors.com$document +||theviewsdyjupcazfeqv.dns.army$document ||thosewebbs.com$document ||thriveink.com$document ||tianangdep.com$document @@ -3786,6 +3805,7 @@ ||toplevel.com.br$document ||topmask.co.za$document ||torresquinterocorp.com$document +||towme.services$document ||toyotacollege.ac.th$document ||tpke.hu$document ||translaterjemah.com$document @@ -3810,8 +3830,7 @@ ||umwelt-kirchhof.de$document ||unicorpbrunei.com$document ||uniengrisb.com$document -||unisoftcc.com$document -||unityindiversity.in$document +||unitedwsdykesokowskg.dns.army$document ||unyazitelecom.com$document ||upcbpta.com$document ||urbantrapfest.cl$document @@ -3820,6 +3839,7 @@ ||users.skynet.be/crisanar/defis/jek_crackme1.7.zip$document ||uss.ac.th$document ||uzzepay.com.br$document +||v2consultores.com$document ||vanzare.cabanabrazi2.ro$document ||vbcargo.hu$document ||vcah.co.uk$document @@ -3889,11 +3909,14 @@ ||woodsytech.com$document ||wordpress.saleensuporte.com.br$document ||workingsolutionsrome.org$document -||wozata.000webhostapp.com$document ||wp.readhere.in$document ||wpdemo.101clients.com.au$document ||writtendeer.com$document ||ws5588.f3322.net$document +||wsdyalgreenkelveskxz.dns.army$document +||wsdykungsb2talenwsjf.dns.army$document +||wsdyrkkrgorgiousejhd.dns.army$document +||wsdysara1investvwsfs.dns.army$document ||wsdysuresbonescagegp.dns.army$document ||wyklej.pl$document ||x2vn.com$document diff --git a/urlhaus-filter-vivaldi.txt b/urlhaus-filter-vivaldi.txt index eaf3066d..ea0cbb55 100644 --- a/urlhaus-filter-vivaldi.txt +++ b/urlhaus-filter-vivaldi.txt @@ -1,5 +1,5 @@ ! Title: Malicious URL Blocklist (Vivaldi) -! Updated: Thu, 08 Apr 2021 00:12:42 UTC +! Updated: Thu, 08 Apr 2021 12:12:46 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/urlhaus-filter ! License: https://gitlab.com/curben/urlhaus-filter#license @@ -7235,6 +7235,7 @@ ||104.248.45.10$document ||104.248.46.116$document ||104.248.47.15$document +||104.248.48.18$document ||104.248.49.76$document ||104.248.5.108$document ||104.248.5.19$document @@ -8844,6 +8845,7 @@ ||107.173.222.122$document ||107.173.222.123$document ||107.173.222.153$document +||107.173.23.240$document ||107.173.24.139$document ||107.173.24.14$document ||107.173.24.145$document @@ -44052,6 +44054,7 @@ ||115.53.254.154$document ||115.53.254.163$document ||115.53.254.17$document +||115.53.254.187$document ||115.53.254.192$document ||115.53.254.217$document ||115.53.254.218$document @@ -131885,6 +131888,7 @@ ||119.123.216.171$document ||119.123.216.178$document ||119.123.216.184$document +||119.123.216.19$document ||119.123.216.206$document ||119.123.216.208$document ||119.123.216.218$document @@ -155794,6 +155798,7 @@ ||123.4.251.84$document ||123.4.252.12$document ||123.4.252.120$document +||123.4.252.144$document ||123.4.252.159$document ||123.4.252.170$document ||123.4.252.19$document @@ -161130,6 +161135,7 @@ ||123.9.193.144$document ||123.9.193.152$document ||123.9.193.154$document +||123.9.193.157$document ||123.9.193.164$document ||123.9.193.168$document ||123.9.193.179$document @@ -162516,7 +162522,7 @@ ||123moviesfx.com$document ||123sellfast.com$document ||123sex.co$document -||123tadi.com/invoice-status/invoice-0321355444-jun-20$document +||123tadi.com$document ||123xyz.xyz$document ||124.100.74.153$document ||124.105.105.222$document @@ -164896,6 +164902,7 @@ ||124.40.246.95$document ||124.43.216.1$document ||124.45.136.224$document +||124.5.112.43$document ||124.5.203.86$document ||124.5.24.59$document ||124.5.28.41$document @@ -184026,6 +184033,7 @@ ||125.99.220.27$document ||125.99.221.206$document ||125.99.222.152$document +||125.99.222.170$document ||125.99.222.2$document ||125.99.222.245$document ||125.99.222.76$document @@ -187651,6 +187659,7 @@ ||14.42.155.140$document ||14.42.206.204$document ||14.42.229.214$document +||14.42.237.237$document ||14.42.48.241$document ||14.42.53.134$document ||14.42.80.24$document @@ -195364,6 +195373,7 @@ ||172.105.247.88$document ||172.105.36.168$document ||172.105.61.165$document +||172.105.68.51$document ||172.105.69.5$document ||172.105.70.225$document ||172.105.79.99$document @@ -198096,6 +198106,7 @@ ||172.93.162.253$document ||172.93.165.221$document ||172.93.176.137$document +||172.93.176.142$document ||172.93.184.161$document ||172.93.184.71$document ||172.93.187.131$document @@ -202469,6 +202480,7 @@ ||178.169.165.90$document ||178.169.68.162$document ||178.17.170.28$document +||178.17.171.144$document ||178.17.174.43$document ||178.170.117.50$document ||178.170.117.8$document @@ -202490,6 +202502,7 @@ ||178.175.0.125$document ||178.175.0.129$document ||178.175.0.140$document +||178.175.0.143$document ||178.175.0.144$document ||178.175.0.146$document ||178.175.0.149$document @@ -202733,6 +202746,7 @@ ||178.175.10.6$document ||178.175.10.66$document ||178.175.10.71$document +||178.175.10.76$document ||178.175.10.78$document ||178.175.10.8$document ||178.175.10.85$document @@ -203129,6 +203143,7 @@ ||178.175.103.45$document ||178.175.103.48$document ||178.175.103.50$document +||178.175.103.52$document ||178.175.103.54$document ||178.175.103.58$document ||178.175.103.61$document @@ -203252,6 +203267,7 @@ ||178.175.104.62$document ||178.175.104.64$document ||178.175.104.66$document +||178.175.104.67$document ||178.175.104.69$document ||178.175.104.80$document ||178.175.104.85$document @@ -203592,6 +203608,7 @@ ||178.175.107.68$document ||178.175.107.7$document ||178.175.107.70$document +||178.175.107.71$document ||178.175.107.75$document ||178.175.107.76$document ||178.175.107.78$document @@ -204386,6 +204403,7 @@ ||178.175.114.138$document ||178.175.114.142$document ||178.175.114.145$document +||178.175.114.146$document ||178.175.114.15$document ||178.175.114.151$document ||178.175.114.152$document @@ -204642,6 +204660,7 @@ ||178.175.116.195$document ||178.175.116.196$document ||178.175.116.197$document +||178.175.116.20$document ||178.175.116.200$document ||178.175.116.201$document ||178.175.116.207$document @@ -205992,6 +206011,7 @@ ||178.175.127.216$document ||178.175.127.217$document ||178.175.127.219$document +||178.175.127.223$document ||178.175.127.224$document ||178.175.127.225$document ||178.175.127.228$document @@ -206150,6 +206170,7 @@ ||178.175.14.152$document ||178.175.14.153$document ||178.175.14.154$document +||178.175.14.155$document ||178.175.14.156$document ||178.175.14.157$document ||178.175.14.16$document @@ -206544,6 +206565,7 @@ ||178.175.18.202$document ||178.175.18.203$document ||178.175.18.205$document +||178.175.18.214$document ||178.175.18.215$document ||178.175.18.219$document ||178.175.18.22$document @@ -206600,6 +206622,7 @@ ||178.175.19.150$document ||178.175.19.157$document ||178.175.19.158$document +||178.175.19.160$document ||178.175.19.162$document ||178.175.19.163$document ||178.175.19.165$document @@ -206953,6 +206976,7 @@ ||178.175.21.38$document ||178.175.21.39$document ||178.175.21.40$document +||178.175.21.41$document ||178.175.21.42$document ||178.175.21.44$document ||178.175.21.53$document @@ -206979,6 +207003,7 @@ ||178.175.22.116$document ||178.175.22.117$document ||178.175.22.118$document +||178.175.22.120$document ||178.175.22.125$document ||178.175.22.129$document ||178.175.22.13$document @@ -207852,6 +207877,7 @@ ||178.175.3.80$document ||178.175.3.81$document ||178.175.3.85$document +||178.175.3.86$document ||178.175.3.87$document ||178.175.3.94$document ||178.175.3.98$document @@ -208095,6 +208121,7 @@ ||178.175.32.183$document ||178.175.32.184$document ||178.175.32.185$document +||178.175.32.186$document ||178.175.32.190$document ||178.175.32.196$document ||178.175.32.197$document @@ -208232,6 +208259,7 @@ ||178.175.33.26$document ||178.175.33.28$document ||178.175.33.30$document +||178.175.33.32$document ||178.175.33.38$document ||178.175.33.40$document ||178.175.33.50$document @@ -209043,6 +209071,7 @@ ||178.175.40.203$document ||178.175.40.204$document ||178.175.40.205$document +||178.175.40.209$document ||178.175.40.211$document ||178.175.40.218$document ||178.175.40.221$document @@ -209253,6 +209282,7 @@ ||178.175.42.42$document ||178.175.42.44$document ||178.175.42.45$document +||178.175.42.46$document ||178.175.42.48$document ||178.175.42.53$document ||178.175.42.55$document @@ -209771,6 +209801,7 @@ ||178.175.47.217$document ||178.175.47.218$document ||178.175.47.22$document +||178.175.47.220$document ||178.175.47.222$document ||178.175.47.224$document ||178.175.47.226$document @@ -209908,6 +209939,7 @@ ||178.175.48.6$document ||178.175.48.65$document ||178.175.48.66$document +||178.175.48.67$document ||178.175.48.71$document ||178.175.48.76$document ||178.175.48.80$document @@ -210186,6 +210218,7 @@ ||178.175.50.47$document ||178.175.50.48$document ||178.175.50.50$document +||178.175.50.54$document ||178.175.50.55$document ||178.175.50.57$document ||178.175.50.58$document @@ -210797,6 +210830,7 @@ ||178.175.56.57$document ||178.175.56.6$document ||178.175.56.61$document +||178.175.56.64$document ||178.175.56.66$document ||178.175.56.67$document ||178.175.56.69$document @@ -210864,6 +210898,7 @@ ||178.175.57.192$document ||178.175.57.20$document ||178.175.57.203$document +||178.175.57.204$document ||178.175.57.206$document ||178.175.57.209$document ||178.175.57.210$document @@ -211747,6 +211782,7 @@ ||178.175.65.181$document ||178.175.65.184$document ||178.175.65.186$document +||178.175.65.189$document ||178.175.65.19$document ||178.175.65.192$document ||178.175.65.193$document @@ -212233,6 +212269,7 @@ ||178.175.69.73$document ||178.175.69.74$document ||178.175.69.77$document +||178.175.69.79$document ||178.175.69.8$document ||178.175.69.82$document ||178.175.69.83$document @@ -213318,6 +213355,7 @@ ||178.175.79.188$document ||178.175.79.189$document ||178.175.79.196$document +||178.175.79.198$document ||178.175.79.199$document ||178.175.79.200$document ||178.175.79.204$document @@ -213628,6 +213666,7 @@ ||178.175.81.232$document ||178.175.81.235$document ||178.175.81.236$document +||178.175.81.240$document ||178.175.81.241$document ||178.175.81.244$document ||178.175.81.246$document @@ -214128,6 +214167,7 @@ ||178.175.86.106$document ||178.175.86.108$document ||178.175.86.11$document +||178.175.86.117$document ||178.175.86.119$document ||178.175.86.12$document ||178.175.86.122$document @@ -214153,6 +214193,7 @@ ||178.175.86.181$document ||178.175.86.182$document ||178.175.86.183$document +||178.175.86.184$document ||178.175.86.187$document ||178.175.86.188$document ||178.175.86.191$document @@ -214429,6 +214470,7 @@ ||178.175.88.8$document ||178.175.88.83$document ||178.175.88.84$document +||178.175.88.85$document ||178.175.88.95$document ||178.175.89.0$document ||178.175.89.10$document @@ -214829,6 +214871,7 @@ ||178.175.92.1$document ||178.175.92.100$document ||178.175.92.102$document +||178.175.92.105$document ||178.175.92.106$document ||178.175.92.108$document ||178.175.92.109$document @@ -215174,6 +215217,7 @@ ||178.175.95.102$document ||178.175.95.103$document ||178.175.95.104$document +||178.175.95.105$document ||178.175.95.111$document ||178.175.95.112$document ||178.175.95.114$document @@ -215367,6 +215411,7 @@ ||178.175.96.82$document ||178.175.96.87$document ||178.175.96.88$document +||178.175.96.93$document ||178.175.96.95$document ||178.175.96.96$document ||178.175.96.97$document @@ -215621,6 +215666,7 @@ ||178.175.99.207$document ||178.175.99.208$document ||178.175.99.209$document +||178.175.99.21$document ||178.175.99.214$document ||178.175.99.216$document ||178.175.99.22$document @@ -218640,6 +218686,7 @@ ||182.112.173.245$document ||182.112.173.8$document ||182.112.176.47$document +||182.112.177.134$document ||182.112.177.215$document ||182.112.177.93$document ||182.112.178.167$document @@ -261164,6 +261211,7 @@ ||183.83.0.112$document ||183.83.0.192$document ||183.83.0.230$document +||183.83.1.1$document ||183.83.1.221$document ||183.83.1.234$document ||183.83.1.239$document @@ -261276,6 +261324,7 @@ ||183.83.13.17$document ||183.83.13.69$document ||183.83.13.95$document +||183.83.14.20$document ||183.83.14.3$document ||183.83.14.35$document ||183.83.14.70$document @@ -263192,6 +263241,7 @@ ||185.8.202.254$document ||185.8.232.145$document ||185.80.92.4$document +||185.81.154.208$document ||185.81.157.124$document ||185.81.157.186$document ||185.81.98.78$document @@ -272554,6 +272604,7 @@ ||201.171.185.92$document ||201.171.204.13$document ||201.171.227.59$document +||201.171.40.215$document ||201.171.84.139$document ||201.175.63.186$document ||201.182.144.193$document @@ -279497,6 +279548,7 @@ ||213.183.63.124$document ||213.183.63.242$document ||213.186.35.153$document +||213.186.69.101$document ||213.189.178.163$document ||213.195.111.72$document ||213.200.133.18$document @@ -279784,6 +279836,7 @@ ||216.180.117.96$document ||216.180.117.98$document ||216.183.54.169$document +||216.183.54.196$document ||216.189.145.11$document ||216.189.177.221$document ||216.189.184.23$document @@ -279983,6 +280036,7 @@ ||217.12.199.179$document ||217.12.208.14$document ||217.12.209.74$document +||217.12.209.82$document ||217.12.210.156$document ||217.12.210.209$document ||217.12.221.244$document @@ -284477,6 +284531,7 @@ ||219.155.234.12$document ||219.155.234.155$document ||219.155.234.218$document +||219.155.234.33$document ||219.155.235.100$document ||219.155.235.145$document ||219.155.235.154$document @@ -292004,6 +292059,7 @@ ||220.81.201.7$document ||220.81.229.175$document ||220.81.30.193$document +||220.81.44.181$document ||220.81.44.92$document ||220.82.140.17$document ||220.82.182.150$document @@ -299949,6 +300005,7 @@ ||222.137.132.49$document ||222.137.133.110$document ||222.137.133.120$document +||222.137.133.125$document ||222.137.133.195$document ||222.137.133.212$document ||222.137.133.244$document @@ -310175,6 +310232,7 @@ ||222.142.210.122$document ||222.142.210.136$document ||222.142.210.138$document +||222.142.210.144$document ||222.142.210.146$document ||222.142.210.155$document ||222.142.210.163$document @@ -312101,6 +312159,7 @@ ||23.95.11.48$document ||23.95.116.135$document ||23.95.116.144$document +||23.95.122.24$document ||23.95.122.47$document ||23.95.13.131$document ||23.95.13.158$document @@ -326201,6 +326260,7 @@ ||27.5.39.115$document ||27.5.39.121$document ||27.5.39.122$document +||27.5.39.124$document ||27.5.39.127$document ||27.5.39.128$document ||27.5.39.140$document @@ -335139,6 +335199,7 @@ ||27.6.254.187$document ||27.6.254.232$document ||27.6.254.89$document +||27.6.255.101$document ||27.6.255.107$document ||27.6.255.121$document ||27.6.255.160$document @@ -356214,6 +356275,7 @@ ||42.2.137.29$document ||42.202.100.135$document ||42.202.100.233$document +||42.202.101.118$document ||42.202.101.133$document ||42.202.101.136$document ||42.202.101.138$document @@ -357620,6 +357682,7 @@ ||42.224.158.181$document ||42.224.158.206$document ||42.224.158.208$document +||42.224.158.22$document ||42.224.158.227$document ||42.224.158.231$document ||42.224.158.234$document @@ -360572,6 +360635,7 @@ ||42.224.51.213$document ||42.224.51.222$document ||42.224.51.223$document +||42.224.51.229$document ||42.224.51.23$document ||42.224.51.239$document ||42.224.51.75$document @@ -379711,6 +379775,7 @@ ||42.236.212.147$document ||42.236.212.154$document ||42.236.212.155$document +||42.236.212.157$document ||42.236.212.158$document ||42.236.212.159$document ||42.236.212.167$document @@ -389243,6 +389308,7 @@ ||4ele.pl$document ||4ertybhdfrt.gq$document ||4esports.de$document +||4et3ja.am.files.1drv.com$document ||4evakleen.com.au$document ||4eventfacilities.nl$document ||4evernails.nl$document @@ -397793,6 +397859,7 @@ ||59.25.9.121$document ||59.25.9.126$document ||59.26.12.115$document +||59.26.181.228$document ||59.26.20.177$document ||59.26.209.230$document ||59.26.214.148$document @@ -433568,6 +433635,7 @@ ||6481254.ru$document ||649924.nchsoftwarecom.com$document ||64x9bg.ch.files.1drv.com$document +||65.0.168.152$document ||65.0.173.107$document ||65.0.179.146$document ||65.0.55.192$document @@ -433613,6 +433681,8 @@ ||65k2.com$document ||66-gifts.com$document ||66.103.9.249$document +||66.108.199.144$document +||66.109.135.129$document ||66.11.110.27$document ||66.11.125.94$document ||66.110.228.60$document @@ -438425,6 +438495,7 @@ ||88.218.16.87$document ||88.218.16.9$document ||88.218.17.109$document +||88.218.17.110$document ||88.218.17.119$document ||88.218.17.149$document ||88.218.17.179$document @@ -438991,6 +439062,7 @@ ||89.239.96.164$document ||89.244.238.226$document ||89.245.110.35$document +||89.248.112.202$document ||89.248.166.171$document ||89.248.166.183$document ||89.248.167.133$document @@ -441804,7 +441876,7 @@ ||999.buzz$document ||999.co.id$document ||999.rajaojek.com$document -||999080321newfolder1002002131-service1002.space/2.exe$document +||999080321newfolder1002002131-service1002.space$document ||999102com.cn$document ||99bkx.com$document ||99centsdigitals.com$document @@ -444091,6 +444163,7 @@ ||ahiskatv.net$document ||ahitekniktarti.com$document ||ahiyangrup.com.tr$document +||ahjianlong.cf$document ||ahjuric.si$document ||ahk.smu8street.ru$document ||ahkha.com$document @@ -444534,6 +444607,7 @@ ||akivj07.top$document ||akktis.com$document ||akkurtmadencilik.com$document +||aklatdelmundo.com$document ||akleigh.com$document ||aklin.ir$document ||aklocalshop.com$document @@ -445256,7 +445330,8 @@ ||allainesconsultancyinc.com$document ||allamanolibrary.com$document ||allan-it.com$document -||allanabolicsteam.net$document +||allanabolicsteam.net/1301s.bin$document +||allanabolicsteam.net/nedfr_.exe$document ||allanelect.co.uk$document ||allangillphotography.com$document ||allanhollowell.com$document @@ -445539,8 +445614,7 @@ ||aloneintheweb.com$document ||aloneskisehir.com$document ||alongthelines.com$document -||alongwalker.com/flysystem/root/jw3lnl6/$document -||alongwalker.com/flysystem/root/vice4z/$document +||alongwalker.com$document ||alonhadat24h.vn$document ||alooshop.ir$document ||aloravan.com$document @@ -446329,7 +446403,7 @@ ||ana.plecko.eu$document ||anaaj.pk$document ||anabim.com$document -||anabolicsteroidsbuy.info$document +||anabolicsteroidsbuy.info/nedfr.exe$document ||anaceb.com$document ||anadearmas.net$document ||anadelgbt.org$document @@ -450448,7 +450522,7 @@ ||b97pm6.com$document ||ba3capital.com$document ||baacsetu.org$document -||baadababada.ru$document +||baadababada.ru/6jhfa478.exe$document ||baaders-namibia.com$document ||baakcafe.com$document ||baamiraan.ir$document @@ -450575,7 +450649,9 @@ ||backup.xn----8sba7bmrlhv0a.xn--p1ai$document ||backup2.robinandelaine.com$document ||backupcom.e-twow.uk$document -||backupez.com$document +||backupez.com/0902.bin$document +||backupez.com/0902s.bin$document +||backupez.com/6yudfgh.exe$document ||backupfashions.com$document ||backupsitedev.flywheelsites.com$document ||backupsql.datasiswebcontable.com$document @@ -451574,6 +451650,9 @@ ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/6f563873-15ee-468a-963c-db55a58d3c9c/betabotkas.exe?signature=gdqnralwhveftqtdsri62lt6n4a%3d&expires=1547724678&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=htnbcwgf1x8g66tof0fdmfcvqntq8j6s&response-content-disposition=attachment%3b%20filename%3d%22betabotkas.exe%22$document ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/a82aea2f-d076-4e1d-8fcb-8b79898a85be/kas919.exe?signature=8gqnlnixtn40dyz9kpkxenncni0%3d&expires=1547725024&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ft24jaolcop3da_7_ev5xcguooyhq0mq&response-content-disposition=attachment%3b%20filename%3d%22kas919.exe%22$document ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/a88d5da4-e34f-49d9-9c8f-f1576e65844b/bin.exe?signature=ilbhrxqfodu36rc7xziy5s9vtto%3d&expires=1547724674&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ygednlr3gkvc9bkfrgrsowc8pfk.awza&response-content-disposition=attachment%3b%20filename%3d%22bin.exe%22$document +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/62ab596d-a885-41d2-8876-b14668b5131e/test.exe?signature=o3aakhmr7kd9oxnuac8wb06is0a%3d&expires=1617867062&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=4_mbfbxzdu5kgeztrex1qrsberpz4m_z&response-content-disposition=attachment%3b%20filename%3d%22test.exe%22/$document +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/79aaba2e-49c6-496e-abf1-f26c32eb56e5/updatedata.exe?signature=4n9w1uqk%2b1lp%2ff3lekorwfww8ba%3d&expires=1617867048&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=ntaaekydhfciseav0ejmu_rdwfsfnpky&response-content-disposition=attachment%3b%20filename%3d%22updatedata.exe%22/$document +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/98b527aa-e517-43ca-bf97-61bc2c51d865/3.exe?signature=qizcxni%2bqskgnanrwlk6babc7gs%3d&expires=1617867059&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=hdqursidmznzrtifyejabx_aaqxteyx7&response-content-disposition=attachment%3b%20filename%3d%223.exe%22/$document ||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/ace278db-4135-41d0-9914-3840b10de6de/omar.exe?signature=zh8efir48pny30f9uatznyf7puy%3d&expires=1617787873&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=nmiv.lpuhma2umwgepxsqa6bjvoohvwj&response-content-disposition=attachment%3b%20filename%3d%22omar.exe%22/$document ||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/f5937654-faa6-44a4-939b-6632f91d8299/1.exe?signature=taz6uveuqvjuzvn2aucvklvyixg%3d&expires=1617787746&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=rbdipgvc.xku0.3vh3rdr2jjaah4y9ei&response-content-disposition=attachment%3b%20filename%3d%221.exe%22/$document ||bbuseruploads.s3.amazonaws.com/1ca1b493-e3b6-4b15-85b8-6446db1ece85/downloads/7ebfb5bd-7d4a-4f02-8ecf-5eec0bdca52c/encrypthei111.exe?signature=h0xssthbungwekotfbufgav%2fn4m%3d&expires=1540254951&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ug_edq2nmoosommijyajne8h9oqvpdyj&response-content-disposition=attachment%3b%20filename%3d%22encrypthei111.exe%22$document @@ -452072,7 +452151,7 @@ ||belaythakayni.com$document ||belboks.com$document ||belboy.in$document -||belcineloweek.ru$document +||belcineloweek.ru/6sufiuerfdvc.exe$document ||belconger.com$document ||belcorpisl.com$document ||belcvet.com$document @@ -453718,7 +453797,9 @@ ||bitbucket.org/mixmix2312/test1/downloads/2_5221939375847244827.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/1.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/12345.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/2.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/24.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/3.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/33333.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/5kmaraafterupdate.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/asyncclient.exe$document @@ -453726,14 +453807,21 @@ ||bitbucket.org/mminminminmin05/testtest/downloads/clr3.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/coohom.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/darting.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/dianthus.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/flesh.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/income.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/instaler.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/installer.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/jayson.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/looseboxes.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/n.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/newred.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/omar.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/petite.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/serv.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/test.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/updachrome.exe$document +||bitbucket.org/mminminminmin05/testtest/downloads/updatedata.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/updatej.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/updatev.exe$document ||bitbucket.org/mminminminmin05/testtest/downloads/work.exe$document @@ -455184,7 +455272,7 @@ ||bobbyworld.top$document ||bobcar.com.my$document ||bobcatofchico.com$document -||bobcatofredding.com$document +||bobcatofredding.com/6lavfdk.exe$document ||bobcook.ca$document ||bobdolph.com$document ||bobenstetter.net$document @@ -456460,7 +456548,9 @@ ||bucketstrong.s3-us-west-1.amazonaws.com$document ||buckeyechartershiltonhead.com$document ||buckeyeoptical.com$document -||buckeyesecurity.net$document +||buckeyesecurity.net/55.exe$document +||buckeyesecurity.net/6lajhbjyuk.exe$document +||buckeyesecurity.net/99.exe$document ||buckinghamandlloyds.com$document ||buckleman.co.id$document ||bucklindata.net$document @@ -456549,6 +456639,7 @@ ||buildcraftindia.com$document ||buildentconstructions.com$document ||builder.acasia.mx$document +||builder.makemoneywith.website$document ||buildersmerchantsfederation-my.sharepoint.com$document ||buildgreenindustries.com$document ||building-company.lt$document @@ -457100,7 +457191,19 @@ ||c.oooooooooo.ga$document ||c.pieshua.com$document ||c.teamworx.ph$document -||c.top4top.io$document +||c.top4top.io/p_147087hzx1.jpg$document +||c.top4top.io/p_1532pr67j1.jpg$document +||c.top4top.io/p_1540ryl6d1.jpg$document +||c.top4top.io/p_1546x5lcf1.jpg$document +||c.top4top.io/p_1549kf97p1.jpg$document +||c.top4top.io/p_1552ns6vj1.jpg$document +||c.top4top.io/p_1557q815n1.jpg$document +||c.top4top.io/p_1568qxo7y1.jpg$document +||c.top4top.io/p_1568qxo7y1.jpg%25temp%25/exploit.exe$document +||c.top4top.io/p_1568qxo7y1.jpg/,/%25temp%25/exploit.exe$document +||c.top4top.io/p_1568qxo7y1.jpg/,/demp8exploit.exe$document +||c.top4top.io/p_399718uh1.jpg$document +||c.top4top.io/p_769a2vuu1.jpg$document ||c.top4top.net$document ||c.vivi.casa$document ||c.vollar.ga$document @@ -457797,6 +457900,7 @@ ||capitalonefinanceltd.in$document ||capitalpellets.com$document ||capitalpremiumfinancinginc.com$document +||capitalprint.co.za$document ||capitalprivateasset.com$document ||capitalrealestate.us$document ||capitalrh.com.br$document @@ -463663,6 +463767,7 @@ ||covid19map.digital$document ||covid19quarantin.com$document ||covid19safety.myftp.org$document +||covid19vaccinations.hopto.org$document ||covid19vaccine.hopto.org$document ||covid2023.info$document ||covidbase.info$document @@ -465057,8 +465162,7 @@ ||daclim.ro$document ||daco-precision.thomaswebs.net$document ||daco.nyccomputerconsulting.com$document -||dacsancaonguyen.vn/zahlung/ihre-rechnung-vom-19.06.2018$document -||dacsancaonguyen.vn/zahlung/ihre-rechnung-vom-19.06.2018/$document +||dacsancaonguyen.vn$document ||dactridaudaday.com$document ||dactyltech.co.za$document ||dacviadokese.com$document @@ -470075,6 +470179,7 @@ ||docs.google.com/uc?export=download&id=1pznr49e9zygatrbyaapcstyynzufnemb$document ||docs.google.com/uc?export=download&id=1qct-px0g0tbmlh1an8zj5mvuerlpgbmc$document ||docs.google.com/uc?export=download&id=1qjmp0rortmdcx6iw6bwg2lgmarp7tm6p$document +||docs.google.com/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq$document ||docs.google.com/uc?export=download&id=1skyxw1azoujpviuqwekdcswpetys0r0x$document ||docs.google.com/uc?export=download&id=1svw14oszom6u2idng91npzvelpdedg9f$document ||docs.google.com/uc?export=download&id=1tm4rkvjulxvp7vd74irl9ffxc9crf9-t$document @@ -473649,6 +473754,7 @@ ||drive.google.com/uc?export=download&id=11gsxnbxefe18c1fayv9kpdessdsxuox3$document ||drive.google.com/uc?export=download&id=11hlymahuojfpno7tmmbv45n8f9vxrlo2$document ||drive.google.com/uc?export=download&id=11hywwyjrqpp_ikeacqo9vp_uwl1lacfv$document +||drive.google.com/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g$document ||drive.google.com/uc?export=download&id=11jvqxpsgamyxn2bs-mimud000fiblzol$document ||drive.google.com/uc?export=download&id=11m7m9sk_a6jz-zynoebg3_vllij8t9gl$document ||drive.google.com/uc?export=download&id=11mai5fg0ndvbucaqg1fmyjyzdbz45wos$document @@ -473969,6 +474075,7 @@ ||drive.google.com/uc?export=download&id=16wefm-laijdif5buz5gn5yzg2kqymuym$document ||drive.google.com/uc?export=download&id=16xqdz6demm6-fjhrkbvgicq7j3icwmqm$document ||drive.google.com/uc?export=download&id=16y49-qajyjh-yksifcv1whrhb3gh4mkx$document +||drive.google.com/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo$document ||drive.google.com/uc?export=download&id=16zaoyqq3hh_m8sovikos2t_1j31l8q-f$document ||drive.google.com/uc?export=download&id=16zoens9l0ihufsnqxrckemwyfryad8am$document ||drive.google.com/uc?export=download&id=171wawwgvyvp56ovqsiffcgiplgapv7du$document @@ -474526,6 +474633,7 @@ ||drive.google.com/uc?export=download&id=1czxia7zmban2iwm9g4eqal6baypcvjwp$document ||drive.google.com/uc?export=download&id=1czzcmluc-6sn5li9hscxypui517paxqk$document ||drive.google.com/uc?export=download&id=1d-imno2z1s3iutwb9trmwacjsxqc7hn4$document +||drive.google.com/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a$document ||drive.google.com/uc?export=download&id=1d0m4cqjbvfhzfitoubaunivmuwrcgyut$document ||drive.google.com/uc?export=download&id=1d0u_leb4wavx9sbumbjwf-fiatvzuyht$document ||drive.google.com/uc?export=download&id=1d1gdo27aqr62g77-u4jgszuiyky-3omp$document @@ -475473,6 +475581,7 @@ ||drive.google.com/uc?export=download&id=1lcwyjkohcqf8z_tzw5yppfdshn9qcgvp$document ||drive.google.com/uc?export=download&id=1ldin3nuq2pmmds2nu1m7yjguqvkjbn7b$document ||drive.google.com/uc?export=download&id=1ldre4vit7jc9ciscyyoy--ue8m6b3wet$document +||drive.google.com/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx$document ||drive.google.com/uc?export=download&id=1le0k4iifbtutn31lollip2ndnjjzwu3t$document ||drive.google.com/uc?export=download&id=1lenovtgyahbqrmdh4gvidedxsqsxcqng$document ||drive.google.com/uc?export=download&id=1lfbieysyp7ecko2wk6a_dxosuhah5gko$document @@ -476539,6 +476648,7 @@ ||drive.google.com/uc?export=download&id=1uiek1-hkcz_kuautcbha5obu2wyaicjj$document ||drive.google.com/uc?export=download&id=1uij6fctuvcj5sqfiw_6k6tvzuyyr0qvz$document ||drive.google.com/uc?export=download&id=1uiqfiaaur7lq7kghcs3ek0rmgaqcqipi$document +||drive.google.com/uc?export=download&id=1uiymxywv0cam8b_bx3ifheiccdwrpsgl$document ||drive.google.com/uc?export=download&id=1uiypry6ez_orivyk4tvmdwyu4_tjjrkz$document ||drive.google.com/uc?export=download&id=1ujel8erdfkvprr1raazydwk6zt7oz17c$document ||drive.google.com/uc?export=download&id=1ujh009daen23wkjfrimopajys9egkz_q$document @@ -476711,6 +476821,7 @@ ||drive.google.com/uc?export=download&id=1vnrnjgf4nyvltipw_ami0pwriq385owf$document ||drive.google.com/uc?export=download&id=1vofmbumt47vaguwg3pofrgr-fcnncwqz$document ||drive.google.com/uc?export=download&id=1vol90krth76axaj0aec6buewa_gltmnl$document +||drive.google.com/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy$document ||drive.google.com/uc?export=download&id=1vp4zqvjtszxigadqtb-8xcgg41xwtq1o$document ||drive.google.com/uc?export=download&id=1vp7dvftbhbukky4gboj74otqegmterpy$document ||drive.google.com/uc?export=download&id=1vpbvepuxtchttkdn778iui6z0f3qb17j$document @@ -484109,6 +484220,7 @@ ||dropbox.com/s/3eouwywbww75819/firefox_67.3.49.js?dl=1$document ||dropbox.com/s/3gs4b28h0fwnu8n/document%23092372.zip?dl=1$document ||dropbox.com/s/3h6rm65zh1fxpma/view_presentation%23812016.zip?dl=1$document +||dropbox.com/s/3h8r4ocqh538jqb/gnl_309383_98484984_fil.ace?dl=1$document ||dropbox.com/s/3hcdcs4ry1onngu/job_presentation3-o4o%23739818.zip?dl=1$document ||dropbox.com/s/3j3s5bx0l92k26u/presentation%23028315.zip?dl=1$document ||dropbox.com/s/3jkdlvraflp3n4j/revised%20purchase%20order-1271.pdf.z?dl=1$document @@ -484141,6 +484253,7 @@ ||dropbox.com/s/3we3su2myn86btk/tesla%20test%20drive%20form_069.xlsm?dl=1$document ||dropbox.com/s/3xawa42sndz31d9/payment.exe?dl=1$document ||dropbox.com/s/3y14090hgs5m0sq/job_presentation-v8b%23499627.zip?dl=1$document +||dropbox.com/s/3yznspctui3k8zl/ma_i303987365367_39873663.dwg.z?dl=1$document ||dropbox.com/s/3z82nworc51b233/w.exe?dl=1$document ||dropbox.com/s/3zevj1sodcingo1/job_attach-a0y%23608602.zip?dl=1$document ||dropbox.com/s/3zjaltv8uar3icz/job_attach-o6o%23113013.zip?dl=1$document @@ -484529,6 +484642,7 @@ ||dropbox.com/s/8ucyd7r1qdi36dt/sale%20info_7696.doc?dl=1/$document ||dropbox.com/s/8ukquaz8h4xdx7n/presentation2-y3w%23946922.zip?dl=1$document ||dropbox.com/s/8uwp9x8u1rwysr9/presentation1-g6v%23145582.zip?dl=1$document +||dropbox.com/s/8v69kjai7vmvb40/acg_08376335_98tv.zdx.z?dl=1$document ||dropbox.com/s/8vcilbzyndbn5yi/job_presentation3-f5l%23783807.zip?dl=1$document ||dropbox.com/s/8vf1x8wwevbt6ys/job_presentation2-j8f%23856887.zip?dl=1$document ||dropbox.com/s/8vkcwcctx60hmo5/view_attach1-l1s%23332381.zip?dl=1$document @@ -484879,6 +484993,7 @@ ||dropbox.com/s/ch14in78gw2rhvu/document%23065239.zip?dl=1$document ||dropbox.com/s/ch7b5csbjb9pc7d/as_984498_04984498.xls.z?dl=1$document ||dropbox.com/s/chcld4b17zi0syr/view_presentation2-d4g%23742135.zip?dl=1$document +||dropbox.com/s/chpdzsp7nxbzh7n/ga_39848_3098559858tg.ace?dl=1$document ||dropbox.com/s/chqs02hqmmxw5gg/view_attach-t8k%23476796.zip?dl=1$document ||dropbox.com/s/chvagrgoasst0o6/job_attach1-b1q%23061922.zip?dl=1$document ||dropbox.com/s/cizaigubmr6oyoe/job_presentation%23985151.zip?dl=1$document @@ -484939,6 +485054,7 @@ ||dropbox.com/s/d42kueksf898va0/job_presentation2-j8f%23181888.zip?dl=1$document ||dropbox.com/s/d4bxv7inwn32lz2/swift_a09af.pdf.z?dl=1$document ||dropbox.com/s/d4iqffd15212s06/view_attach%23990300.zip?dl=1$document +||dropbox.com/s/d5efh42pwwz6j0g/tkas_9387635_93876353pmnb.ace?dl=1$document ||dropbox.com/s/d5gmgo0y48zfffu/presentation2-c6m%23417932.zip?dl=1$document ||dropbox.com/s/d5hx06nobawy5oo/job_attach%23751825.zip?dl=1$document ||dropbox.com/s/d67zrpka5ahro1e/my_presentation1-y5p%23783447.zip?dl=1$document @@ -484965,6 +485081,7 @@ ||dropbox.com/s/ddiu5wa7pu9pbbs/my_attach1-w3n%23509754.zip?dl=1$document ||dropbox.com/s/de7cvnotolldsry/my_presentation2-s5o%23937289.zip?dl=1$document ||dropbox.com/s/df3azbvw9jjp7st/job_attach2-q6k%23845555.zip?dl=1$document +||dropbox.com/s/dfcp3j7tx3jod54/nvc_039387367_03987783_remi.ace?dl=1$document ||dropbox.com/s/dfgnzlyx9tyqy73/psd_0398763pf_0398763.jpg.z?dl=1$document ||dropbox.com/s/dfku3gn9k792xcj/job_attach-m4j%23948073.zip?dl=1$document ||dropbox.com/s/dfytqktkuux7x8z/shipment_inv14012020_8349462174917197.zip?dl=1$document @@ -485569,6 +485686,7 @@ ||dropbox.com/s/iuhsc0w4lcrlxu1/job_attach3-j3a%23912834.zip?dl=1$document ||dropbox.com/s/iv3ntusd5ramxmm/view_presentation2-e5l%23020200.zip?dl=1$document ||dropbox.com/s/iw827thar5ojsmx/shipment_inv14012020_2117170331383099.zip?dl=1$document +||dropbox.com/s/iwijqd0727v498t/brd_039837635tr.xqd.z?dl=1$document ||dropbox.com/s/iwvd2hj1natp6x9/shipment_inv14012020_0622285188305203.zip?dl=1$document ||dropbox.com/s/ixzb0pn24kk8tkf/my_presentation1-d4r%23765170.zip?dl=1$document ||dropbox.com/s/iywgs1vgbluhwd7/view_attach2-m5m%23071565.zip?dl=1$document @@ -485577,6 +485695,7 @@ ||dropbox.com/s/j0hkz3yl0trmgo4/scan00121payment%20advice.pdf.z?dl=1$document ||dropbox.com/s/j0whqr8w70hyl81/my_attach-y2q%23418191.zip?dl=1$document ||dropbox.com/s/j0zlq5s3r0anso1/view_presentation-o8w%23103520.zip?dl=1$document +||dropbox.com/s/j1f32ta7ne2afpt/m0987655678_0098765456789.pdf.z?dl=1$document ||dropbox.com/s/j26bp911xqr9f49/presentation1-i8d%23940410.zip?dl=1$document ||dropbox.com/s/j2xpr3dy5thu2wr/quotation.zip?dl=1$document ||dropbox.com/s/j36iy9wmxvpkyhi/please%20quote.pdf.z?dl=1$document @@ -485958,6 +486077,7 @@ ||dropbox.com/s/o40cbmvywx9dvoh/shipment_inv14012020_42720565334420.zip?dl=1$document ||dropbox.com/s/o4ertlnxsqga5e1/my_presentation2%23076148.zip?dl=1$document ||dropbox.com/s/o4i7eo876zf2m2h/my_presentation1-y9c%23495955.zip?dl=1$document +||dropbox.com/s/o52jtgaurbr0psg/ga_39848_3098559858tg.xyz.z?dl=1$document ||dropbox.com/s/o5d4h3o8ny7mizb/job_attach-o2i%23251881.zip?dl=1$document ||dropbox.com/s/o5qrg7hha11t37f/invoice.zip?dl=1$document ||dropbox.com/s/o6e58l1m3xsxrby/scan_0023.pdf.z?dl=1$document @@ -486217,6 +486337,7 @@ ||dropbox.com/s/rlt9yeyuds5k957/my_attach-z3r%23383174.zip?dl=1$document ||dropbox.com/s/rmabkd6y1l83u25/view_attach1-q4t%23572679.zip?dl=1$document ||dropbox.com/s/rmo8rji173i1cat/q~20939876467_039876373.xls.z?dl=1$document +||dropbox.com/s/rmum3v29ojs3jjl/frg_039873653_0398736gb.xl.z?dl=1$document ||dropbox.com/s/rmw5gw1frkxegnd/document%23134519.zip?dl=1$document ||dropbox.com/s/rnhqz4sklt052q9/my_presentation-e5i%23917388.zip?dl=1$document ||dropbox.com/s/ro9loec8bdadiu6/outstandingpayment1.pdf.z?dl=1$document @@ -486234,6 +486355,7 @@ ||dropbox.com/s/rzqibz0q7ef37q4/job_presentation-u1o%23972507.zip?dl=1$document ||dropbox.com/s/s03fa34t6uob3h8/view_attach3-j7n%23364470.zip?dl=1$document ||dropbox.com/s/s07zqja5t5qb8kq/presentation1-p3c%23753652.zip?dl=1$document +||dropbox.com/s/s0irg599646bovm/dg~00856876789-99023467890.pdf.z?dl=1$document ||dropbox.com/s/s19lgurhguz8b01/shipment_inv14012020_641001405594.zip?dl=1$document ||dropbox.com/s/s23n0jjsjzy4wa8/po-280717888.zip?dl=1$document ||dropbox.com/s/s2yfo0ez7lq1ev7/shipment_inv14012020_8059855817809796.zip?dl=1$document @@ -490589,6 +490711,7 @@ ||estimating.training$document ||estimatorfind.com$document ||estimetercume.com$document +||estjh05.top$document ||estomedic.com/dlt_ge5pemsy_qdvlz3/$document ||estore.qurvex.com$document ||estoyadieta.com$document @@ -490772,7 +490895,8 @@ ||etysu02scnabr03wzaxue.com$document ||eu-central-1.protection.sophos.com/?d=shenovacengineers.com&u=ahr0cdovl3nozw5vdmfjzw5naw5lzxjzlmnvbs9jz2ktymlul3bhew1lbnqvotfuenjhl3eyaxjqd281mdazmta3mdc3mzi0nzk2otq2ehnrdtdndzb5zxnklw==&e=aw5mb0bpbmdlbmlldxjidwvyby13zw56zwwuzgu=&t=rfrkuwv2s2lmz2u5a21qdgfvt1fjv3lwowddexe0bjnruxu2ry9jqwp4nd0=&h=87530880db9148fc91a5d1ba1d0c8718/$document ||eu-easy.com$document -||eu.wildfire.paloaltonetworks.com$document +||eu.wildfire.paloaltonetworks.com/panos/sample/cloud/wi9nuhhlykdoowr2yteyqkh4ulhluzrcqjhuudvqwxnhynbgrelsr2prsjjlk3zpq3bhoe1yqnbubnjsnvmxqlm0wmevevhttgpdr29fv0e1du9dv0w1vtzzwtzzl01srm1fugtwuwjjmwwrtusyzjfdmhpwbuthm0h5ectkekmvsexwvwprznnhbkq1wnddrepwv0fvrjvaznnicfdzszh0dflszw5samxnb0kybuvdykrstnf3dc9hwxl5l3l6/$document +||eu.wildfire.paloaltonetworks.com/report/box/bfc63aa44052b156fa742965595beb250276fbb18c6011d9f06f5b6059f336b7/19668968921/$document ||eu1.salesforce.com$document ||eu283iwoqodjspqisjdf.com$document ||eu5-cdn.devid.info$document @@ -493084,7 +493208,9 @@ ||files.gamebanana.com/tools/enchanced_server_picker.exe$document ||files.gamebanana.com/tools/tagconverter.exe$document ||files.gathercdn.com$document -||files.hrloo.com$document +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc$document +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc?n=w+eyvuwtgv3lkzjlt6xln7norq3nrqhnkiblilbluqyuzg9j$document +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc?n=weyvuwtgv3lkzjlt6xln7norq3nrqhnkiblilbluqyuzg9j$document ||files.jivosite.com/file-transfer/1621967/2021-03-16/55ec600e4e6500e080c5.doc$document ||files.l-d.tech$document ||files.lashawnbarber.com/$document @@ -494871,6 +494997,7 @@ ||friendzonecafe.com$document ||frietfun.be$document ||frigolutasima.net$document +||frigoprehrana.com$document ||frigoriferivignola.it$document ||frigosistem.com.tr/olj7rnst1.jpg$document ||frigotechniek.be$document @@ -495447,7 +495574,8 @@ ||fv13.failiem.lv$document ||fv15.failiem.lv$document ||fv2-1.failiem.lv/down.php?cf&i=hyg2rxaa&n=new_payment.doc&download_checksum=afa67b9a5998eca281cda22f5585e9dcf764128a&download_timestamp=1547330846$document -||fv2-2.failiem.lv$document +||fv2-2.failiem.lv/down.php?cf&i=my59dhhv&n=2562.xls$document +||fv2-2.failiem.lv/down.php?cf&i=redm59qf&n=dfg-016.xls$document ||fv2-7.failiem.lv$document ||fv3.failiem.lv$document ||fv6.failiem.lv$document @@ -495528,7 +495656,7 @@ ||g0zh8lb3.com$document ||g15aocbenedict.com$document ||g1ba4tt4ngq5nl7w.xyz$document -||g1smurt.ru$document +||g1smurt.ru/6jiuu8934u.exe$document ||g20digital.com.br$document ||g237.cn$document ||g2creditsolutions.com$document @@ -495619,9 +495747,10 @@ ||gadaniya-magiya.site$document ||gadcoafrica.com$document ||gaddco.com$document -||gade4senate.com$document -||gadebrigade.com$document -||gadeforussenate.com$document +||gade4senate.com/dfgg45g.exe$document +||gade4senate.com/m.dll$document +||gadebrigade.com/783s.exe$document +||gadeforussenate.com/163.exe$document ||gadem.ug$document ||gadesoluciones.pe$document ||gadget-plaza.ru$document @@ -497953,7 +498082,7 @@ ||gomitra.com$document ||gomovies.cl$document ||gomsubattrangxuatkhau.com$document -||gomsuminhlongthainguyen.vn/wp-includes/statement/trb4t-2766-65677976-vlvfxh32a-yg8z93/$document +||gomsuminhlongthainguyen.vn$document ||gomus.com.br$document ||gomyfiles.info$document ||gomypass.com$document @@ -499518,7 +499647,8 @@ ||h.epelcdn.com$document ||h.eurotrading.com.pl$document ||h.j990981.ru$document -||h.top4top.io$document +||h.top4top.io/p_14754cwzr1.jpg$document +||h.top4top.io/p_1593skpl71.jpg$document ||h.valerana44.ru$document ||h002295863.nichost.ru$document ||h0h.org$document @@ -501824,7 +501954,160 @@ ||home.99eurowebsite.ie$document ||home.barley-plus.com$document ||home.dawang.ink$document -||home.earthlink.net$document +||home.earthlink.net/~4winds1/dec3th.exe$document +||home.earthlink.net/~4winds1/imortantdocument.exe$document +||home.earthlink.net/~adminawg/usps/shipping-label/shipping-label(e-copy).jar$document +||home.earthlink.net/~archbarrett/adobe/0.37646700%201523567821.jar$document +||home.earthlink.net/~archbarrett/amazon-order-copy.jar$document +||home.earthlink.net/~archbarrett/donation/donation.jar$document +||home.earthlink.net/~archbarrett/dropbox/reference~ecopy.jar$document +||home.earthlink.net/~archbarrett/file2018.jar$document +||home.earthlink.net/~banderso1066/e~label.jar$document +||home.earthlink.net/~baysidejetdrive/shipment-label.jar$document +||home.earthlink.net/~bigrose26/12-21-2017.jar$document +||home.earthlink.net/~bigrose26/shipment/shipment-label.jar$document +||home.earthlink.net/~captaindiego/amazon/amazon.jar$document +||home.earthlink.net/~captaindiego/ecopy/ecopy.jar$document +||home.earthlink.net/~captaindiego/fedex/ecopy.jar$document +||home.earthlink.net/~captaindiego/fedex/fedex-shipping-label.jar$document +||home.earthlink.net/~captaindiego/software/ecopy.jar$document +||home.earthlink.net/~carwashregional/ship/ups~label.jar$document +||home.earthlink.net/~cathygrellet/data/saved/order.jar$document +||home.earthlink.net/~cathygrellet/dropbox/saved/artwork.jar$document +||home.earthlink.net/~cathygrellet/filemanager/order.jar$document +||home.earthlink.net/~cathygrellet/javto/print.jar$document +||home.earthlink.net/~cathygrellet/ship/info/usps%20order.jar$document +||home.earthlink.net/~craigbayhi/1-9-2018.jar$document +||home.earthlink.net/~craigslane/fedex-shipment~label.jar$document +||home.earthlink.net/~cvaleallen/delivery-report.jar$document +||home.earthlink.net/~cvaleallen/ups-shipping-details.jar$document +||home.earthlink.net/~cvaleallen/your-shipping-details.jar$document +||home.earthlink.net/~dalegibson/shipping-label.jar$document +||home.earthlink.net/~dalegibson/shipping_details.jar$document +||home.earthlink.net/~damturney/invoice/invoice_05122017_outputcca6aaf.scr$document +||home.earthlink.net/~damturney/invoice27112017/invoice_output68cf6b0.scr$document +||home.earthlink.net/~damturney/invoice27112017/newinvoice/invoice_04122017_output7bca030.scr$document +||home.earthlink.net/~damturney/specification/invoice04122017_output13026b0.scr$document +||home.earthlink.net/~davidtrojan/ups/ecopy.jar$document +||home.earthlink.net/~dcamjr/invoice20180205.exe$document +||home.earthlink.net/~dcmusicbox/usp/tracking~details.jar$document +||home.earthlink.net/~decalgene/ups_tracking.jar$document +||home.earthlink.net/~dvidmar1/shipment-label.jar$document +||home.earthlink.net/~ebony319/shippinglabel(e-copy).jar$document +||home.earthlink.net/~edclarkortho/label/e~label.jar$document +||home.earthlink.net/~edclarkortho/shipmentlabel.jar$document +||home.earthlink.net/~ellenweiss/new_message.jar$document +||home.earthlink.net/~ersinc/0.06213400%201521213842.jar$document +||home.earthlink.net/~ersinc/directory/ecopy.jar$document +||home.earthlink.net/~ersinc/ebay/ecopy00017717.jar$document +||home.earthlink.net/~ersinc/ecopy/ups.jar$document +||home.earthlink.net/~ersinc/order/order.jar$document +||home.earthlink.net/~ersinc/usps/order.jar$document +||home.earthlink.net/~fahertydoc/data/qrypted.janvy.jar$document +||home.earthlink.net/~fahertydoc/return-label.jar$document +||home.earthlink.net/~fahertydoc/usps~label.jar$document +||home.earthlink.net/~flajobs/e~label.jar$document +||home.earthlink.net/~flajobs/fedex/ecopy.jar$document +||home.earthlink.net/~flajobs/fedex~e~label.jar$document +||home.earthlink.net/~flajobs/shipment~label.jar$document +||home.earthlink.net/~freshourglen/5-2-2018.jar$document +||home.earthlink.net/~g.rhoads/dhl(view_shipping_label).jar$document +||home.earthlink.net/~g.rhoads/fedex/fedex.jar$document +||home.earthlink.net/~g.rhoads/ups(view-delivery-copy).jar$document +||home.earthlink.net/~georgejagels/usps-shipment-label.jar$document +||home.earthlink.net/~gouette/%20corel%20digital/%20license.jar$document +||home.earthlink.net/~gouette/data/license.jar$document +||home.earthlink.net/~gouette/docusign/documentfile.jar$document +||home.earthlink.net/~gouette/fedex/fedexcopy.jar$document +||home.earthlink.net/~gouette/invoice/document.jar$document +||home.earthlink.net/~gouette/trade/tradecopy.jar$document +||home.earthlink.net/~gouette/trade/tradecopy.zip$document +||home.earthlink.net/~grabanski/cve2017jar.zip$document +||home.earthlink.net/~itshq/usps_tracking.jar$document +||home.earthlink.net/~james.pender/shipping-label.jar$document +||home.earthlink.net/~jmzegan/your-order.jar$document +||home.earthlink.net/~joserealty/ecopy/ecopy.jar$document +||home.earthlink.net/~joserealty/webdocs/01/11-28-2017.jar$document +||home.earthlink.net/~joserealty/webdocs/02/11-30-2017.jar$document +||home.earthlink.net/~joserealty/webdocs/03/12-8-2017.jar$document +||home.earthlink.net/~kentscott4643/trk_fedex_46866461644881255.jar$document +||home.earthlink.net/~kmc2read/paypal/ecopy.jar$document +||home.earthlink.net/~kmc2read/ups/ups.jar$document +||home.earthlink.net/~ksak/fedex/shipping-label(e-copy).jar$document +||home.earthlink.net/~ksak/fedex/tobeused300.jar_javacrypt2.jar$document +||home.earthlink.net/~lorrainebubar/usps-shipping-label.jar$document +||home.earthlink.net/~loubill/ups.jar$document +||home.earthlink.net/~macjanutol/01-29-2019.jar$document +||home.earthlink.net/~macjanutol/01-29-20199.jar$document +||home.earthlink.net/~macjanutol/02-2-2019.jar$document +||home.earthlink.net/~macjanutol/cdv%20book%20k-2%20pag47.zip$document +||home.earthlink.net/~margolisme/12.16.17.jar$document +||home.earthlink.net/~margolisme/eopy/e-copy.jar$document +||home.earthlink.net/~michlee/trk_fedex_46866461644881255.jar$document +||home.earthlink.net/~mkramer65/dropbox_upgrade.jar$document +||home.earthlink.net/~mkramer65/fedex_shippinglabel.jar$document +||home.earthlink.net/~mkramer65/scan-copy.exe$document +||home.earthlink.net/~mnludvik/01-21-2019.jar$document +||home.earthlink.net/~mnludvik/1-21-2019.jar$document +||home.earthlink.net/~morrisonb/date/fedex.jar$document +||home.earthlink.net/~morrisonb/ecopy/fedex.jar$document +||home.earthlink.net/~morrisonb/softcopy/e-copy.jar$document +||home.earthlink.net/~narcisocortez/shipping_verification.1.0.1.1.1.1.0.jar$document +||home.earthlink.net/~ncfire/usps-shipping-label.jar$document +||home.earthlink.net/~ncgreen2/e-log.jar$document +||home.earthlink.net/~ngardels/112220188.exe$document +||home.earthlink.net/~ngardels/26112018.exe$document +||home.earthlink.net/~p3nd3r/shipment~label.jar$document +||home.earthlink.net/~p3nd3r/shipping-label.jar$document +||home.earthlink.net/~palmermusic/1-04-2018.jar$document +||home.earthlink.net/~peggylegault/june-25-2018.jar$document +||home.earthlink.net/~pepper12/shipping-label.jar$document +||home.earthlink.net/~pepper12/ups_invoice.jar$document +||home.earthlink.net/~pgregory2/ups/upstracker.jar$document +||home.earthlink.net/~phwilson/case_details.jar$document +||home.earthlink.net/~phwilson/e~label.jar$document +||home.earthlink.net/~phwilson/paypal_credit_info.jar$document +||home.earthlink.net/~prislen/ups_z10023838484.exe$document +||home.earthlink.net/~rclaws35/245646572983677974505708.jar$document +||home.earthlink.net/~rclaws35/61234567.jar$document +||home.earthlink.net/~rclaws35/package~label.jar$document +||home.earthlink.net/~rclaws35/re/shipment~label.jar$document +||home.earthlink.net/~rclaws35/shipment~label.jar$document +||home.earthlink.net/~roib/usps/usps~order~copy.jar$document +||home.earthlink.net/~roib/usps/usps~tracking~receipt.jar$document +||home.earthlink.net/~rsellsema/fedex/fedex.jar$document +||home.earthlink.net/~rsellsema/ups/ups.jar$document +||home.earthlink.net/~ruthtraa/shipment-label.jar$document +||home.earthlink.net/~rwhall38/01/3-28-2018.jar$document +||home.earthlink.net/~sallyhansen1/usps-shipment~label.jar$document +||home.earthlink.net/~sallyhansen1/usps_delivery.jar$document +||home.earthlink.net/~sherylhagen/usps-shipment-label.jar$document +||home.earthlink.net/~sherylhagen/usps~label.jar$document +||home.earthlink.net/~sidewinder4/comfirm(delivery-details).jar$document +||home.earthlink.net/~sidewinder4/ecopy/ups.jar$document +||home.earthlink.net/~sltdmd/ebay01.jar$document +||home.earthlink.net/~sltdmd/ups-shipping-label.jar$document +||home.earthlink.net/~suzystar/brief/invoice/order/ratata.qrypted.jar$document +||home.earthlink.net/~suzystar/cgggihfdyjojok/ecopy.jar$document +||home.earthlink.net/~suzystar/ecopy/e-copy.jar$document +||home.earthlink.net/~suzystar/pp/luv.qrypted.jar$document +||home.earthlink.net/~suzystar/ups~costomer~service.jar$document +||home.earthlink.net/~suzystar/usps-shipment-label.jar$document +||home.earthlink.net/~thfenner/shipping-label-ecopy.jar$document +||home.earthlink.net/~timstaacke/ecopy/ecopy.jar$document +||home.earthlink.net/~timstaacke/fedex(efile).jar$document +||home.earthlink.net/~tom12345678/return-label.jar$document +||home.earthlink.net/~tom12345678/shipment~label.jar$document +||home.earthlink.net/~tom12345678/shipping-label.jar$document +||home.earthlink.net/~twwjr/usps_delivery.jar$document +||home.earthlink.net/~vehanes/12-20-17.jar$document +||home.earthlink.net/~veteransmemorial/usps/trackingorder.jar$document +||home.earthlink.net/~wisebob/shipment~e~label.jar$document +||home.earthlink.net/~wisebob/shipping-label.jar$document +||home.earthlink.net/~youngcl/shipping-label101.jar$document +||home.earthlink.net/~zrippeto/invoice.jar$document +||home.earthlink.net/~zrippeto/order-comfirmation.jar$document +||home.earthlink.net/~zrippeto/pal/payment~details.jar$document ||home.evrstudio.com$document ||home.healthiestu.com$document ||home.isdes.com$document @@ -502199,7 +502482,7 @@ ||hostfleek.com$document ||hostgo.com.br$document ||hostile-gaming.fr$document -||hostimpel.com/js/q/$document +||hostimpel.com$document ||hosting-c.iuro.nl$document ||hosting.drupwayinfotech.in$document ||hosting.mrsofttech.com$document @@ -508916,6 +509199,7 @@ ||kabelinieseti.ru$document ||kabiguru.org$document ||kabiledans.com$document +||kabimmo.com$document ||kabinarf.ru$document ||kabiru.ru$document ||kabiryogashramlimbdi.com$document @@ -510361,7 +510645,9 @@ ||kilnrefractory.com$document ||kilolo.site$document ||kilop.goodvibeskickin.com$document -||kilopaskal.ru$document +||kilopaskal.ru/0203.bin$document +||kilopaskal.ru/0203s.bin$document +||kilopaskal.ru/6jhfa478.exe$document ||kimaco.com$document ||kimberly.digital$document ||kimberly5esthetique.com$document @@ -510707,7 +510993,7 @@ ||klaus-moersch.de$document ||klausnerlaw.com$document ||klaussen.net$document -||klaustrofebia.ru$document +||klaustrofebia.ru/6jhfa478.exe$document ||klavze28.com$document ||klbay.net$document ||kldatabase.com$document @@ -513772,10 +514058,7 @@ ||library.cifor.org$document ||library.dhl-xom.com$document ||library.iainbengkulu.ac.id$document -||library.mju.ac.th/2018/cfjdes/$document -||library.mju.ac.th/2018/mnnw0cr-ptv5a-370268/$document -||library.mju.ac.th/2018/rn-72c-0657/$document -||library.mju.ac.th/2018/zoipdun1a0/$document +||library.mju.ac.th$document ||library.phibi.my.id$document ||library.piet.co.in$document ||library.strophicmusic.com$document @@ -515590,7 +515873,8 @@ ||luminouspla.net$document ||luminouspneuma.com$document ||lumnus.com.br$document -||lumoura.com$document +||lumoura.com/0496giif/payroll/commercial$document +||lumoura.com/0496giif/payroll/commercial/$document ||lumperpush.com$document ||lumsdancorp.com$document ||lun.otrweb.ru$document @@ -515757,7 +516041,7 @@ ||lykangblog.com$document ||lykusglobal.com$document ||lylevr.com$document -||lyllacarter.com/3578001584444_ycu75_resource/personal-box/interior-warehouse/arfilpvie-v6v1ws6tt/$document +||lyllacarter.com$document ||lylydressforless.com$document ||lymcomercial.cl$document ||lymfodrenaze.eu$document @@ -519163,6 +519447,7 @@ ||medicinadellavoromb.it$document ||medicinaesteticaorlandini.it$document ||medicinageriatrica.com.br$document +||medicinainterna-critica.com$document ||medicinaonline.rjsrwaco.watchdogdns.duckdns.org$document ||medicine.softberg.ro$document ||mediclaim.odhavnidhi.org$document @@ -522426,8 +522711,7 @@ ||mtcinteriordesign.co.uk$document ||mtcr.co.za$document ||mtcuadrado.com$document -||mtdc.com.my/csm/mtdc_tenant/uploadedimages/file/o3xzk5h347jxshu8k73a66d4j0k087_aid8t27-174416710418/$document -||mtdc.com.my/csm/mtdc_tenant/uploadedimages/inc/erfrjwbgc5k/$document +||mtdc.com.my$document ||mte1.cn$document ||mtechagency.com$document ||mteestore.com$document @@ -523146,7 +523430,7 @@ ||myimmigrationlawmarketingpartner.com$document ||myimmogroup.be$document ||myinfoart.online$document -||myinstabuzzz.co$document +||myinstabuzzz.co/6hyuyj.exe$document ||myinstantguru.com$document ||myinternetjobs.com$document ||myintromationsz.win$document @@ -523172,6 +523456,7 @@ ||mylinkguard.com$document ||mylistbuildingtraffic.com$document ||mylisting.martinface.com$document +||myliverpoolnews.cf$document ||myloanbaazar.com$document ||myloanexpert.in$document ||mylocal.dk$document @@ -524822,6 +525107,7 @@ ||news.intertours.org.rs$document ||news.leta.com.vn$document ||news.lwinmoenaing.me$document +||news.makemoneywith.website$document ||news.medicaid.ir$document ||news.omumusic.net$document ||news.palette69.com$document @@ -525638,6 +525924,7 @@ ||nmsk.online$document ||nmsr.info$document ||nmvconstructions.com$document +||nmxwllwsdyminoragenw.dns.army$document ||nn-webdesign.be$document ||nn.5ctelematics.com$document ||nnasout.com$document @@ -526444,7 +526731,9 @@ ||nvdweb.azurewebsites.net$document ||nveeusa.com$document ||nvelj12qyyfi03kqxy.xyz$document -||nvgeeforsegt.ru$document +||nvgeeforsegt.ru/0303.bin$document +||nvgeeforsegt.ru/0303s.bin$document +||nvgeeforsegt.ru/6jhfa478.exe$document ||nvgp.com.au$document ||nvi.edu.vn$document ||nvl.netsmartz.net$document @@ -527600,6 +527889,8 @@ ||onedrive.live.com/download?%20cid=6bf4bc82222119f1&resid=6bf4bc82222119f1%21146&authkey=adpxoamsqubznpo$document ||onedrive.live.com/download?%20cid=86515363ec4e1d86&resid=86515363ec4e1d86!230&authkey=acct5emtpwqk2pk$document ||onedrive.live.com/download?%20cid=86515363ec4e1d86&resid=86515363ec4e1d86%21230&authkey=acct5emtpwqk2pk$document +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm$document +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$document ||onedrive.live.com/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa$document ||onedrive.live.com/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq$document ||onedrive.live.com/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe$document @@ -527857,9 +528148,17 @@ ||onedrive.live.com/download?cid=208d58450f73ce00&resid=208d58450f73ce00%21121&authkey=ac_pc9_txxg1knu$document ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4$document ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i$document +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc$document ||onedrive.live.com/download?cid=20dee8b81c08a987&resid=20dee8b81c08a987%21298&authkey=aj9kqwsgcfz-_hs$document ||onedrive.live.com/download?cid=2156ca1e52db3c63&resid=2156ca1e52db3c63!133&authkey=aoandx4a2on7qms$document ||onedrive.live.com/download?cid=2156ca1e52db3c63&resid=2156ca1e52db3c63%21133&authkey=aoandx4a2on7qms$document +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom$document +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom$document ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!105&authkey=!absbumceicuzi2o$document ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!108&authkey=!ajhg3v4jcff7_ja$document ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!109&authkey=!anhbzybkg3mekig$document @@ -527960,6 +528259,10 @@ ||onedrive.live.com/download?cid=2a486306c325f908&resid=2a486306c325f908%21111&authkey=affiexy2cqzci_et1$document ||onedrive.live.com/download?cid=2a486306c325f908&resid=2a486306c325f908%21113&authkey=ahqsrzlqf0ufb-w$document ||onedrive.live.com/download?cid=2a4a2d5d947e1370&resid=2a4a2d5d947e1370%21108&authkey=amv_prbtm21h9cw$document +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi$document +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk$document +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi$document +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk$document ||onedrive.live.com/download?cid=2ad47a1c2578bc9d&resid=2ad47a1c2578bc9d!109&authkey=!aimagsabj48hkvc$document ||onedrive.live.com/download?cid=2ad9152585a10979&resid=2ad9152585a10979%21263&authkey=ajckc28yc3ipv20$document ||onedrive.live.com/download?cid=2b099f9549ffb495&resid=2b099f9549ffb495%21120&authkey=abiwvt9gevnrdko$document @@ -528217,6 +528520,7 @@ ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21137&authkey=ai0mrummy_5dvngl$document ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21139&authkey=aizxtnwpadmihus$document ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0$document +||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0$document ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw$document ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw$document ||onedrive.live.com/download?cid=47366308b4485d1f&resid=47366308b4485d1f!122&authkey=acz6efuryflte_u$document @@ -528370,6 +528674,7 @@ ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21270&authkey=anrpgfgppanni2m$document ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21282&authkey=ahmiyfvsdq29oyct$document ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21306&authkey=aax3ppfvza6zr2y!w$document +||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4$document ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21104&authkey=ah1rwakpsbjkvg8$document ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8$document ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0$document @@ -528603,6 +528908,8 @@ ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21130&authkey=anw-ddr7601fex8$document ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21133&authkey=ajujzgibyp0njn4$document ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8$document +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq$document +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s$document ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b!330&authkey=akerwhui2attmd0$document ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b!332&authkey=alf8w-tcidmmiaw$document ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b%21330&authkey=akerwhui2attmd0$document @@ -529040,9 +529347,11 @@ ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21106&authkey=akfcfq3zq5oof2i$document ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21108&authkey=amfbkmapqbvzpvk$document ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21110&authkey=aov1iwhtxtdchie$document +||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21114&authkey=aootzdl0ufej408!w$document ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21115&authkey=aigiblfwx-m-sf0$document ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21117&authkey=akq2ufr3rag9vrw$document ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21118&authkey=agbhxyxdkrvcvo0$document +||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21119&authkey=ai2fryyoppe4_hm$document ||onedrive.live.com/download?cid=896080f2b56fcb9c&resid=896080f2b56fcb9c%21105&authkey=aathdxz2aww0jkm$document ||onedrive.live.com/download?cid=8983011c6ecfb1d8&resid=8983011c6ecfb1d8%21132&authkey=ah0vja7wpyfjj84$document ||onedrive.live.com/download?cid=89c2283e219d084b&resid=89c2283e219d084b%21715&authkey=al6csxgxuywk1bs$document @@ -529070,6 +529379,8 @@ ||onedrive.live.com/download?cid=8ca507baa15fdb5c&resid=8ca507baa15fdb5c%21184&authkey=aeek7ofguvsjqwe$document ||onedrive.live.com/download?cid=8d14d74eb13b02d0&resid=8d14d74eb13b02d0%21158&authkey=angcyyr-keximec$document ||onedrive.live.com/download?cid=8d14d74eb13b02d0&resid=8d14d74eb13b02d0%21165&authkey=ak9xkr3bswk3pso$document +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y$document +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y$document ||onedrive.live.com/download?cid=8db649572ecd3a9a&resid=8db649572ecd3a9a%21235&authkey=akc-pr82u6uhq3o$document ||onedrive.live.com/download?cid=8db649572ecd3a9a&resid=8db649572ecd3a9a%21255&authkey=ameysz-ajuakv_i$document ||onedrive.live.com/download?cid=8e778d4a23c91a07&resid=8e778d4a23c91a07%21109&authkey=amsqkmfaht5lg9s$document @@ -529349,6 +529660,7 @@ ||onedrive.live.com/download?cid=aca36329f96145e7&resid=aca36329f96145e7%21108&authkey=aig30xmo50hun6s$document ||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21111&authkey=aczey5fkpwajy-a$document ||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21114&authkey=afetsliuakyqj5a$document +||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21115&authkey=ap7w_ryx7dsh--4$document ||onedrive.live.com/download?cid=ad9ac90c6da9c574&resid=ad9ac90c6da9c574!202&authkey=ajnelcik0ivjcvm$document ||onedrive.live.com/download?cid=ae1f8ba4b67f2e7b&resid=ae1f8ba4b67f2e7b%21111&authkey=aoudc31yiw3xahw$document ||onedrive.live.com/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw$document @@ -529454,6 +529766,7 @@ ||onedrive.live.com/download?cid=b9e0bf86d3bee8e7&resid=b9e0bf86d3bee8e7%21182&authkey=abo_l9b2wjewd5w$document ||onedrive.live.com/download?cid=b9e0bf86d3bee8e7&resid=b9e0bf86d3bee8e7%21189&authkey=agaoq4of9yuqxqe$document ||onedrive.live.com/download?cid=b9f97974937af42d&resid=b9f97974937af42d%21183&authkey=apzbr8b3xgtai1y$document +||onedrive.live.com/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$document ||onedrive.live.com/download?cid=bada6e9b193308e5&resid=bada6e9b193308e5!107&authkey=ajyxxwmnlvllxc8$document ||onedrive.live.com/download?cid=bada6e9b193308e5&resid=bada6e9b193308e5%21115&authkey=aohc9j6cj1s-dp4$document ||onedrive.live.com/download?cid=badaf4192eeddcdc&resid=badaf4192eeddcdc!3724&authkey=agywwcss9tb9x5g$document @@ -529517,6 +529830,7 @@ ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai$document ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk$document ||onedrive.live.com/download?cid=c1bc60e9d8507226&resid=c1bc60e9d8507226%21146&authkey=afqh6zg990rdk7w$document +||onedrive.live.com/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta$document ||onedrive.live.com/download?cid=c2f597e8f3af4bc2&resid=c2f597e8f3af4bc2%2164846&authkey=aocl-frlas3c6v4$document ||onedrive.live.com/download?cid=c333554726f00e84&resid=c333554726f00e84%21242&authkey=adizb0tcuo6pvxm$document ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa$document @@ -529914,7 +530228,9 @@ ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21139&authkey=an3wktzxopu6ktq$document ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21140&authkey=ag-kppl_uvownco$document ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21142&authkey=aad-nuysvlhc-i4$document +||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8!124&authkey=anbjbhqwzwajouc$document ||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8%21108&authkey=anmpeqm9gm_zv9m$document +||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8%21124&authkey=anbjbhqwzwajouc$document ||onedrive.live.com/download?cid=efa0769fcf42dbd8&resid=efa0769fcf42dbd8%21108&authkey=ab3oob0eydsxowg$document ||onedrive.live.com/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4$document ||onedrive.live.com/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8$document @@ -530330,7 +530646,10 @@ ||only4atalg.ml$document ||onlyapteka.ru$document ||onlyart.in$document -||onlybamboofabrics.com$document +||onlybamboofabrics.com/2601.bin$document +||onlybamboofabrics.com/2701.bin$document +||onlybamboofabrics.com/2701s.bin$document +||onlybamboofabrics.com/6gdwwv.exe$document ||onlycane.in$document ||onlychild.org$document ||onlycocktaildresses.com$document @@ -538439,6 +538758,7 @@ ||pazarcheto.com$document ||pazargezer.com$document ||pazcomau-my.sharepoint.com$document +||pazpus.com$document ||pb-xt.com$document ||pb.divaasolutions.com$document ||pb128o6c2favwk.com$document @@ -540234,6 +540554,7 @@ ||pmrimestdylimtdvenst.dns.army$document ||pmrimestdylimtdvests.dns.army$document ||pmrimestdylimtstwork.dns.army$document +||pmrimewsdylimtewsogh.dns.army$document ||pmrimewsdylimtwswods.dns.army$document ||pms.stercomagento.com$document ||pmsports.de$document @@ -541988,6 +542309,7 @@ ||prosupport.cl$document ||prosvyaz.kz$document ||prosyarmakassar.com$document +||prosystemsug.com$document ||prosysvinorosso.com$document ||prot.drupal8.softikom.lv$document ||protaciohospital.com$document @@ -542005,7 +542327,9 @@ ||protect-us.mimecast.com/s/7ihcc82oqycqx96qh15qw5$document ||protect-us.mimecast.com/s/c27ac0rx9ru80p3fw0bgj$document ||protect-us.mimecast.com/s/qki9c73wxjupxq5ps8qcm_$document -||protect.mimecast-offshore.com$document +||protect.mimecast-offshore.com/s/ip17cn9blzfnq4n4h4tudd?domain=meraqsa.com/$document +||protect.mimecast-offshore.com/s/loqwcg5rvpcjndxqc76apn?domain=ronakfence.ir/$document +||protect.mimecast-offshore.com/s/rd0zcjqxyvf8w6o3igppxq?domain=ronakfence.ir/$document ||protect2.fireeye.com/v1/url?k=59eacb3c-0560e9d5-59ed97de-0cc47ad93e2e-0f5e34e79adab692&q=1&e=e7991bbc-cc93-4814-a8f2-fd6d6950b0d5&u=https%3a%2f%2fwww.mediafire.com%2ffile%2fs2uyxs8t8kbuyye%2fdocumentos_de_env%25cdo.7z%2ffile$document ||protect2.fireeye.com/v1/url?k=6d0c09d2-33bdd2b2-6d0f7943-86e2237f51fb-ab55eb53c2dfee1f&q=1&e=358c9b57-d351-4b0f-80cf-d0755ec21127&u=https://pottershousedurban.co.za/cgi-bin/file/xzbx0cb5wywuw5/179vj6b9dpsp7advozp/$document ||protectiadatelor.biz$document @@ -543240,7 +543564,7 @@ ||quatanghoanglong.com$document ||quatangluuniemhue.com$document ||quatangtaynguyen.com$document -||quatangtaynguyen.vn/egw5/inc/ixgcfpguvzhumrl/$document +||quatangtaynguyen.vn$document ||quatest.sixstarsent.com$document ||quatet365.com$document ||quatram.de$document @@ -543314,6 +543638,7 @@ ||quickbookstechnicalsupportphonenumber.com$document ||quickboooks.host$document ||quickboooks.space$document +||quickcompanyreg.co.za$document ||quickfingers.net$document ||quickinsolutions.com$document ||quicklifecare.com$document @@ -546120,7 +546445,7 @@ ||roadscompass.com$document ||roadtravelcars.com$document ||roanokecellphonerepair.com$document -||roanokemortgages.com$document +||roanokemortgages.com/6lhjgfdghj.exe$document ||roastedguarmeal.com$document ||roba.nu$document ||robaitec.com$document @@ -548758,6 +549083,7 @@ ||savasaachi.systems$document ||savaspark.com.tr$document ||save-room.info$document +||save.makemoneywith.website$document ||save24x7.com$document ||saveanimal.org$document ||savecannabis.org$document @@ -552595,7 +552921,7 @@ ||slrpros.com$document ||sls-eg.com$document ||sls-security.ru$document -||slsbearings.com.sg/en/corporation/cdiih-tcjn3_vdroc-dsx/$document +||slsbearings.com.sg$document ||slservicebd.com$document ||slubnefury.pl$document ||slugard.5gbfree.com$document @@ -554594,7 +554920,7 @@ ||srnirob.com$document ||srno.hu$document ||sromano.it$document -||sromecorlduce.ru$document +||sromecorlduce.ru/6sfsgfsgqwert.exe$document ||sroomf70nasiru.duckdns.org$document ||srooooiva.ru$document ||srpresse.fr$document @@ -558101,7 +558427,7 @@ ||sunflowerschoolandcollege.com$document ||sunfruit.com.tn$document ||sunganak.in$document -||sungardspo.com$document +||sungardspo.com/6lhjgfdghj.exe$document ||sungazer.com.au$document ||sunglasses2020.com$document ||sungvalopkhongsam.com$document @@ -561604,7 +561930,7 @@ ||thefragrancefreeshop.com$document ||thefranssons.com$document ||thefreelancerschool.com$document -||thefrees.com/.docs/jtvrvznswjba/nbar_6606_29052020.zip$document +||thefrees.com$document ||thefreewaterfoundation.org.za$document ||thefront.in$document ||thefuel.be$document @@ -562219,6 +562545,7 @@ ||theviestdyjupcafgmcn.dns.army$document ||theviestdyjupcafgsvb.dns.army$document ||theviestdyjupcazfest.dns.navy$document +||theviewsdyjupcazfeqv.dns.army$document ||theviewsdyjupcazwsgv.dns.army$document ||thevilla46.com$document ||thevine-organizasyon.com$document @@ -562735,7 +563062,7 @@ ||timelyrain.top$document ||timenard.top$document ||timenotbesea.xyz$document -||timenow.pw/api/files/stub.exe$document +||timenow.pw$document ||timenowis1.top$document ||timeoffer.site$document ||timeofvape.tk$document @@ -564577,7 +564904,9 @@ ||trustinspect.com$document ||trustlancers.com$document ||trustorbit.com$document -||trustpilot-scam.com$document +||trustpilot-scam.com/1612.bin$document +||trustpilot-scam.com/1612s.bin$document +||trustpilot-scam.com/32453.exe$document ||trustpropertyholdings.com$document ||trustrambusinesssolutions.com$document ||trustrobins.info$document @@ -564643,7 +564972,7 @@ ||ts.7rb.xyz$document ||ts0ev73.com$document ||tsal.com$document -||tsapparel.com.my/fd66e6.php$document +||tsapparel.com.my$document ||tsareva-garden.ru$document ||tsatsi.co.za$document ||tsauctions.com$document @@ -565396,7 +565725,19 @@ ||u0707115.cp.regruhosting.ru$document ||u0746219.cp.regruhosting.ru$document ||u0774849.cp.regruhosting.ru$document -||u1.huatu.com$document +||u1.huatu.com/fuzhou/2012/6yue/20120626009_hlq.rar$document +||u1.huatu.com/guizhou/fujian/wendang/2012071006.rar$document +||u1.huatu.com/guizhou/fujian/wendang/2012082801.rar$document +||u1.huatu.com/guizhou/fujian/wendang/2012102205.rar$document +||u1.huatu.com/henan/2012-08/2012bishi.rar$document +||u1.huatu.com/henan/201211/121127054744.rar$document +||u1.huatu.com/jinan/fujian/%e4%b8%b4%e6%9c%90%e6%9a%91%e6%9c%9f%e6%95%99%e5%b8%88%e7%ac%94%e8%af%95%e6%88%90%e7%bb%a9.rar$document +||u1.huatu.com/jinan/fujian/20130710153845754ba1c09b3695e0.rar$document +||u1.huatu.com/nmg/20120716001.rar$document +||u1.huatu.com/tianjin/201212/20131218zwb_tjxds.rar$document +||u1.huatu.com/wuhu/fujian/201205/20120522104242271.rar$document +||u1.huatu.com/wuhu/fujian/20120507110444635.rar$document +||u1.huatu.com/wuhu/fujian/20120814113927927.rar$document ||u1.innerpeer.com$document ||u11123p7833.web0104.zxcs.nl$document ||u1141p8807.web0103.zxcs.nl$document @@ -566612,6 +566953,7 @@ ||unitedwsdy5defenceforgorvermentsocialeme.duckdns.org$document ||unitedwsdykesokowsbv.dns.army$document ||unitedwsdykesokowsgs.dns.army$document +||unitedwsdykesokowskg.dns.army$document ||unitedwsdykesokowsku.dns.army$document ||unitedwsdykesokowsri.dns.navy$document ||unitedyfl.com$document @@ -567089,7 +567431,7 @@ ||urldefense.proofpoint.com/v2/url?u=http-3a__www.noelportelles.com_acuerdos-2d07_&d=dwmfaq&c=-nidxp95v38whwnfcom0huicxh-zv-kamxwytub8tka&r=f0qlnmvt4h0nwhscbkmzens5pw6nb16ectkdmouq3rg&m=h6onp5vzujslfrkq8uluja-svkxy727zj0hv6bgi7kg&s=_giuui9mytwjmdqu0aojwj59ycacwqnzlfvb1g055lm&e=/$document ||urldefense.proofpoint.com/v2/url?u=http-3a__www.sindquimsuzano.com.br_payment_zzn34252g_aug-2d07-2d2018-2d4493466_hul-2dgsmu&d=dwmgaq&c=zwy66qcyutyucoev9c2gldeckuykzowdvnr_l93z9mq&r=niwg9z1drtcbkwjfypvhoyqckwxpvcuznakuz4s8tqi&m=dvgau9m2j67nnjvwqltpdwr1secpedjmnf6k8tdvhce&s=bcniagjeltt_ln_3efp3jjggw-kxw0a1v5wthm1wysi&e=$document ||urldefense.proofpoint.com/v2/url?u=http-3a__www.sx-2dzj.net_default_us-5fus_doc_hri-2dmonthly-2dinvoice_&d=dwifaq&c=eugzstcatdllvimen8b7jxrwqof-v5a_cdpgnvfiimm&r=ftodw-zjb1u6omhnvdnv5xpe4nk-1jws78c28vgfogapkvxv5mlulnefw3g60a0o&m=qs8izqf3b77bbbv4ce5xetvb_lj3d6tp8yc7h7b_j_4&s=hgfffu7ph5qurvwxahcnjcn8_j3-kc-vy2u6javehtq&e/$document -||urldefense.us$document +||urldefense.us/v2/url?u=http-3a__facanha.com.br_temp_parts-5fservice_s9baz8isbijg0xhd7z0n_&d=dwmfaq&c=qtsr2lo3xh19jsonxq96-b_j2zkvnyyojwvjnv4r9is&r=iouefzkkvlfqwzcan5qausnvmpi9hiz9pebs6ko1o94&m=gyxbuywhcwmdgd9tipsfye4sd4mhyexdiwsgp_6fkhg&s=qoq4llc83hmmkungnrsxiof9m8vzk0asnj8uej2oiaq&e=/$document ||urleddrug.at$document ||urlfrance.fr$document ||urlm.ir$document @@ -567238,7 +567580,8 @@ ||usrubber.com/wp-admin/0in/$document ||uss.ac.th$document ||uss21.com$document -||ussbd.net$document +||ussbd.net/content/scan/271459/ojyq8by38-28/$document +||ussbd.net/wp-admin/scan/xlhuy5brujs4c4sbq/$document ||usselfstoragenetwork.com$document ||ussrback.com$document ||ussrgun.000webhostapp.com$document @@ -567355,18 +567698,7 @@ ||uyaiblog.com$document ||uycqawua.applekid.cn$document ||uydu.antalyaelektrikariza.net$document -||uyen.vn/rxmln/06521/servicecontractagreement_06521_04292020.zip$document -||uyen.vn/rxmln/0944160/servicecontractagreement_0944160_04292020.zip$document -||uyen.vn/rxmln/719658340/servicecontractagreement_719658340_04292020.zip$document -||uyen.vn/rxmln/92790700/servicecontractagreement_92790700_04292020.zip$document -||uyen.vn/rxmln/servicecontractagreement_23932918_04292020.zip$document -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/192074507/servicecontractagreement_192074507_04292020.zip$document -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/26862161/servicecontractagreement_26862161_04292020.zip$document -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/30940317/servicecontractagreement_30940317_04292020.zip$document -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/80951402/servicecontractagreement_80951402_04292020.zip$document -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/899028826/servicecontractagreement_899028826_04292020.zip$document -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/servicecontractagreement_127640399_04292020.zip$document -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/servicecontractagreement_22521330_04292020.zip$document +||uyen.vn$document ||uyencometics.bmt.city$document ||uyencuentra.com$document ||uyf.com.ua$document @@ -571978,7 +572310,7 @@ ||wotehb.com$document ||wotsuper.pw$document ||wotsuper3.exe$document -||wouatiareves.ru$document +||wouatiareves.ru/6hy67438ue.exe$document ||wourionlion.ru$document ||woutaalexp.com$document ||wouterwolf.com$document @@ -572204,6 +572536,7 @@ ||wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org$document ||wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org$document ||wsdyalgreenkeghewsmq.dns.army$document +||wsdyalgreenkelveskxz.dns.army$document ||wsdyalhjchfonlinedws.dns.navy$document ||wsdyalhjchfonlinwsdf.dns.army$document ||wsdyalhjchfonlinwsed.dns.army$document @@ -572227,10 +572560,12 @@ ||wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org$document ||wsdyibgreenkegheedws.dns.navy$document ||wsdyibgreenkeghewsyt.dns.army$document +||wsdyibgreenventureqx.dns.army$document ||wsdykalamikonlinedeliverystoreservwspmq.ydns.eu$document ||wsdykung38communicationtarisupliermgapc.duckdns.org$document ||wsdykungsb2gotchtsub.dns.army$document ||wsdykungsb2gotchtwsp.dns.army$document +||wsdykungsb2talenwsjf.dns.army$document ||wsdykungsb2talenwsmz.dns.army$document ||wsdymsloginvestmwsqd.dns.army$document ||wsdymsloginvestmwsrw.dns.army$document @@ -572243,9 +572578,11 @@ ||wsdynitengymndynatin.dns.army$document ||wsdypmrimelimtdvenws.dns.army$document ||wsdypmrimelimtdvewsd.dns.army$document +||wsdyrkkrgorgiousejhd.dns.army$document ||wsdyrkkrsuccessmorev.dns.army$document ||wsdyrkkrsuccessmoven.dns.army$document ||wsdyrmtcntlfarmtwsvb.dns.army$document +||wsdysara1investvwsfs.dns.army$document ||wsdyshgshg2induswsjg.dns.army$document ||wsdyshgshgnationalindustrialandgoogledns.duckdns.org$document ||wsdyshgshgnationalobjindustrialat23fty.duckdns.org$document @@ -573329,7 +573666,7 @@ ||xnk.jbzie.com$document ||xnkwintech.com$document ||xnxxchannel.com$document -||xnxxfullhd.com$document +||xnxxfullhd.com/wp-admin/nak/$document ||xo4z0sl.com$document ||xo57.com$document ||xoangyduong.com.vn$document @@ -573912,7 +574249,16 @@ ||yeu81.com$document ||yeu82.com$document ||yeuhang.tk$document -||yeumoitruong.vn$document +||yeumoitruong.vn/install/cqblnc/$document +||yeumoitruong.vn/install/document/$document +||yeumoitruong.vn/install/esp/gkh96px4g19/$document +||yeumoitruong.vn/install/esp/gkh96px4g19//$document +||yeumoitruong.vn/install/esp/gkh96px4g19///$document +||yeumoitruong.vn/install/lm/k9238129131598300n5b5sb4mhqb/$document +||yeumoitruong.vn/install/tbn/$document +||yeumoitruong.vn/src/09j/$document +||yeumoitruong.vn/src/attachments/kryx1iotp3u/$document +||yeumoitruong.vn/src/invoice/2m1r3dh36j/$document ||yeuromndy.cf$document ||yeutocviet.com$document ||yewonder.com$document diff --git a/urlhaus-filter.tpl b/urlhaus-filter.tpl index 7d7868fa..907952e8 100644 --- a/urlhaus-filter.tpl +++ b/urlhaus-filter.tpl @@ -1,6 +1,6 @@ msFilterList # Title: Malicious Hosts Blocklist (IE) -# Updated: Thu, 08 Apr 2021 00:12:42 UTC +# Updated: Thu, 08 Apr 2021 12:12:46 UTC # Expires: 1 day (update frequency) # Homepage: https://gitlab.com/curben/urlhaus-filter # License: https://gitlab.com/curben/urlhaus-filter#license @@ -241,6 +241,7 @@ msFilterList -d 123moviesfx.com -d 123sellfast.com -d 123sex.co +-d 123tadi.com -d 123xyz.xyz -d 124.com.ua -d 124.cpanel.realwebsitesite.com @@ -1193,6 +1194,7 @@ msFilterList -d 4ele.pl -d 4ertybhdfrt.gq -d 4esports.de +-d 4et3ja.am.files.1drv.com -d 4evakleen.com.au -d 4eventfacilities.nl -d 4evernails.nl @@ -1779,6 +1781,7 @@ msFilterList -d 999.buzz -d 999.co.id -d 999.rajaojek.com +-d 999080321newfolder1002002131-service1002.space -d 999102com.cn -d 99bkx.com -d 99centsdigitals.com @@ -3966,6 +3969,7 @@ msFilterList -d ahiskatv.net -d ahitekniktarti.com -d ahiyangrup.com.tr +-d ahjianlong.cf -d ahjuric.si -d ahk.smu8street.ru -d ahkha.com @@ -4390,6 +4394,7 @@ msFilterList -d akivj07.top -d akktis.com -d akkurtmadencilik.com +-d aklatdelmundo.com -d akleigh.com -d aklin.ir -d aklocalshop.com @@ -5102,7 +5107,6 @@ msFilterList -d allainesconsultancyinc.com -d allamanolibrary.com -d allan-it.com --d allanabolicsteam.net -d allanelect.co.uk -d allangillphotography.com -d allanhollowell.com @@ -5376,6 +5380,7 @@ msFilterList -d aloneintheweb.com -d aloneskisehir.com -d alongthelines.com +-d alongwalker.com -d alonhadat24h.vn -d alooshop.ir -d aloravan.com @@ -6133,7 +6138,6 @@ msFilterList -d ana.plecko.eu -d anaaj.pk -d anabim.com --d anabolicsteroidsbuy.info -d anaceb.com -d anadearmas.net -d anadelgbt.org @@ -10106,7 +10110,6 @@ msFilterList -d b97pm6.com -d ba3capital.com -d baacsetu.org --d baadababada.ru -d baaders-namibia.com -d baakcafe.com -d baamiraan.ir @@ -10228,7 +10231,6 @@ msFilterList -d backup.xn----8sba7bmrlhv0a.xn--p1ai -d backup2.robinandelaine.com -d backupcom.e-twow.uk --d backupez.com -d backupfashions.com -d backupsitedev.flywheelsites.com -d backupsql.datasiswebcontable.com @@ -11611,7 +11613,6 @@ msFilterList -d belaythakayni.com -d belboks.com -d belboy.in --d belcineloweek.ru -d belconger.com -d belcorpisl.com -d belcvet.com @@ -14170,7 +14171,6 @@ msFilterList -d bobbyworld.top -d bobcar.com.my -d bobcatofchico.com --d bobcatofredding.com -d bobcook.ca -d bobdolph.com -d bobenstetter.net @@ -15422,7 +15422,6 @@ msFilterList -d bucketstrong.s3-us-west-1.amazonaws.com -d buckeyechartershiltonhead.com -d buckeyeoptical.com --d buckeyesecurity.net -d buckinghamandlloyds.com -d buckleman.co.id -d bucklindata.net @@ -15511,6 +15510,7 @@ msFilterList -d buildcraftindia.com -d buildentconstructions.com -d builder.acasia.mx +-d builder.makemoneywith.website -d buildersmerchantsfederation-my.sharepoint.com -d buildgreenindustries.com -d building-company.lt @@ -16054,7 +16054,6 @@ msFilterList -d c.oooooooooo.ga -d c.pieshua.com -d c.teamworx.ph --d c.top4top.io -d c.top4top.net -d c.vivi.casa -d c.vollar.ga @@ -16726,6 +16725,7 @@ msFilterList -d capitalonefinanceltd.in -d capitalpellets.com -d capitalpremiumfinancinginc.com +-d capitalprint.co.za -d capitalprivateasset.com -d capitalrealestate.us -d capitalrh.com.br @@ -21566,6 +21566,7 @@ msFilterList -d covid19map.digital -d covid19quarantin.com -d covid19safety.myftp.org +-d covid19vaccinations.hopto.org -d covid19vaccine.hopto.org -d covid2023.info -d covidbase.info @@ -22924,6 +22925,7 @@ msFilterList -d daclim.ro -d daco-precision.thomaswebs.net -d daco.nyccomputerconsulting.com +-d dacsancaonguyen.vn -d dactridaudaday.com -d dactyltech.co.za -d dacviadokese.com @@ -31568,6 +31570,7 @@ msFilterList -d estimating.training -d estimatorfind.com -d estimetercume.com +-d estjh05.top -d estore.qurvex.com -d estoyadieta.com -d estrategias-corporativas.com @@ -31743,7 +31746,6 @@ msFilterList -d etxse.xyz -d etysu02scnabr03wzaxue.com -d eu-easy.com --d eu.wildfire.paloaltonetworks.com -d eu1.salesforce.com -d eu283iwoqodjspqisjdf.com -d eu5-cdn.devid.info @@ -33887,7 +33889,6 @@ msFilterList -d files.dropmybin.me -d files.enjin.com -d files.gathercdn.com --d files.hrloo.com -d files.l-d.tech -d files.martellexpress.us -d files.mirai-2viv.vn @@ -35620,6 +35621,7 @@ msFilterList -d friendzonecafe.com -d frietfun.be -d frigolutasima.net +-d frigoprehrana.com -d frigoriferivignola.it -d frigotechniek.be -d frigsales.com @@ -36101,7 +36103,6 @@ msFilterList -d fv1-2.failiem.lv -d fv13.failiem.lv -d fv15.failiem.lv --d fv2-2.failiem.lv -d fv2-7.failiem.lv -d fv3.failiem.lv -d fv6.failiem.lv @@ -36179,7 +36180,6 @@ msFilterList -d g0zh8lb3.com -d g15aocbenedict.com -d g1ba4tt4ngq5nl7w.xyz --d g1smurt.ru -d g20digital.com.br -d g237.cn -d g2creditsolutions.com @@ -36267,9 +36267,6 @@ msFilterList -d gadaniya-magiya.site -d gadcoafrica.com -d gaddco.com --d gade4senate.com --d gadebrigade.com --d gadeforussenate.com -d gadem.ug -d gadesoluciones.pe -d gadget-plaza.ru @@ -38417,6 +38414,7 @@ msFilterList -d gomitra.com -d gomovies.cl -d gomsubattrangxuatkhau.com +-d gomsuminhlongthainguyen.vn -d gomus.com.br -d gomyfiles.info -d gomypass.com @@ -39915,7 +39913,6 @@ msFilterList -d h.epelcdn.com -d h.eurotrading.com.pl -d h.j990981.ru --d h.top4top.io -d h.valerana44.ru -d h002295863.nichost.ru -d h0h.org @@ -42145,7 +42142,6 @@ msFilterList -d home.99eurowebsite.ie -d home.barley-plus.com -d home.dawang.ink --d home.earthlink.net -d home.evrstudio.com -d home.healthiestu.com -d home.isdes.com @@ -42515,6 +42511,7 @@ msFilterList -d hostfleek.com -d hostgo.com.br -d hostile-gaming.fr +-d hostimpel.com -d hosting-c.iuro.nl -d hosting.drupwayinfotech.in -d hosting.mrsofttech.com @@ -48971,6 +48968,7 @@ msFilterList -d kabelinieseti.ru -d kabiguru.org -d kabiledans.com +-d kabimmo.com -d kabinarf.ru -d kabiru.ru -d kabiryogashramlimbdi.com @@ -50388,7 +50386,6 @@ msFilterList -d kilnrefractory.com -d kilolo.site -d kilop.goodvibeskickin.com --d kilopaskal.ru -d kimaco.com -d kimberly.digital -d kimberly5esthetique.com @@ -50720,7 +50717,6 @@ msFilterList -d klaus-moersch.de -d klausnerlaw.com -d klaussen.net --d klaustrofebia.ru -d klavze28.com -d klbay.net -d kldatabase.com @@ -53622,6 +53618,7 @@ msFilterList -d library.cifor.org -d library.dhl-xom.com -d library.iainbengkulu.ac.id +-d library.mju.ac.th -d library.phibi.my.id -d library.piet.co.in -d library.strophicmusic.com @@ -55394,7 +55391,6 @@ msFilterList -d luminouspla.net -d luminouspneuma.com -d lumnus.com.br --d lumoura.com -d lumperpush.com -d lumsdancorp.com -d lun.otrweb.ru @@ -55556,6 +55552,7 @@ msFilterList -d lykangblog.com -d lykusglobal.com -d lylevr.com +-d lyllacarter.com -d lylydressforless.com -d lymcomercial.cl -d lymfodrenaze.eu @@ -58712,6 +58709,7 @@ msFilterList -d medicinadellavoromb.it -d medicinaesteticaorlandini.it -d medicinageriatrica.com.br +-d medicinainterna-critica.com -d medicinaonline.rjsrwaco.watchdogdns.duckdns.org -d medicine.softberg.ro -d mediclaim.odhavnidhi.org @@ -61882,6 +61880,7 @@ msFilterList -d mtcinteriordesign.co.uk -d mtcr.co.za -d mtcuadrado.com +-d mtdc.com.my -d mte1.cn -d mtechagency.com -d mteestore.com @@ -62578,7 +62577,6 @@ msFilterList -d myimmigrationlawmarketingpartner.com -d myimmogroup.be -d myinfoart.online --d myinstabuzzz.co -d myinstantguru.com -d myinternetjobs.com -d myintromationsz.win @@ -62604,6 +62602,7 @@ msFilterList -d mylinkguard.com -d mylistbuildingtraffic.com -d mylisting.martinface.com +-d myliverpoolnews.cf -d myloanbaazar.com -d myloanexpert.in -d mylocal.dk @@ -64193,6 +64192,7 @@ msFilterList -d news.intertours.org.rs -d news.leta.com.vn -d news.lwinmoenaing.me +-d news.makemoneywith.website -d news.medicaid.ir -d news.omumusic.net -d news.palette69.com @@ -64976,6 +64976,7 @@ msFilterList -d nmsk.online -d nmsr.info -d nmvconstructions.com +-d nmxwllwsdyminoragenw.dns.army -d nn-webdesign.be -d nn.5ctelematics.com -d nnasout.com @@ -65756,7 +65757,6 @@ msFilterList -d nvdweb.azurewebsites.net -d nveeusa.com -d nvelj12qyyfi03kqxy.xyz --d nvgeeforsegt.ru -d nvgp.com.au -d nvi.edu.vn -d nvl.netsmartz.net @@ -66974,7 +66974,6 @@ msFilterList -d only4atalg.ml -d onlyapteka.ru -d onlyart.in --d onlybamboofabrics.com -d onlycane.in -d onlychild.org -d onlycocktaildresses.com @@ -68964,6 +68963,7 @@ msFilterList -d pazarcheto.com -d pazargezer.com -d pazcomau-my.sharepoint.com +-d pazpus.com -d pb-xt.com -d pb.divaasolutions.com -d pb128o6c2favwk.com @@ -70709,6 +70709,7 @@ msFilterList -d pmrimestdylimtdvenst.dns.army -d pmrimestdylimtdvests.dns.army -d pmrimestdylimtstwork.dns.army +-d pmrimewsdylimtewsogh.dns.army -d pmrimewsdylimtwswods.dns.army -d pms.stercomagento.com -d pmsports.de @@ -72427,6 +72428,7 @@ msFilterList -d prosupport.cl -d prosvyaz.kz -d prosyarmakassar.com +-d prosystemsug.com -d prosysvinorosso.com -d prot.drupal8.softikom.lv -d protaciohospital.com @@ -72437,7 +72439,6 @@ msFilterList -d protech.mn -d protechcarpetcare.com -d protechgroup1.com --d protect.mimecast-offshore.com -d protectiadatelor.biz -d protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org -d protection.pecol.eu @@ -73637,6 +73638,7 @@ msFilterList -d quatanghoanglong.com -d quatangluuniemhue.com -d quatangtaynguyen.com +-d quatangtaynguyen.vn -d quatest.sixstarsent.com -d quatet365.com -d quatram.de @@ -73702,6 +73704,7 @@ msFilterList -d quickbookstechnicalsupportphonenumber.com -d quickboooks.host -d quickboooks.space +-d quickcompanyreg.co.za -d quickfingers.net -d quickinsolutions.com -d quicklifecare.com @@ -76303,7 +76306,6 @@ msFilterList -d roadscompass.com -d roadtravelcars.com -d roanokecellphonerepair.com --d roanokemortgages.com -d roastedguarmeal.com -d roba.nu -d robaitec.com @@ -78675,6 +78677,7 @@ msFilterList -d savasaachi.systems -d savaspark.com.tr -d save-room.info +-d save.makemoneywith.website -d save24x7.com -d saveanimal.org -d savecannabis.org @@ -82335,6 +82338,7 @@ msFilterList -d slrpros.com -d sls-eg.com -d sls-security.ru +-d slsbearings.com.sg -d slservicebd.com -d slubnefury.pl -d slugard.5gbfree.com @@ -84267,7 +84271,6 @@ msFilterList -d srnirob.com -d srno.hu -d sromano.it --d sromecorlduce.ru -d sroomf70nasiru.duckdns.org -d srooooiva.ru -d srpresse.fr @@ -86096,7 +86099,6 @@ msFilterList -d sunflowerschoolandcollege.com -d sunfruit.com.tn -d sunganak.in --d sungardspo.com -d sungazer.com.au -d sunglasses2020.com -d sungvalopkhongsam.com @@ -89496,6 +89498,7 @@ msFilterList -d thefragrancefreeshop.com -d thefranssons.com -d thefreelancerschool.com +-d thefrees.com -d thefreewaterfoundation.org.za -d thefront.in -d thefuel.be @@ -90080,6 +90083,7 @@ msFilterList -d theviestdyjupcafgmcn.dns.army -d theviestdyjupcafgsvb.dns.army -d theviestdyjupcazfest.dns.navy +-d theviewsdyjupcazfeqv.dns.army -d theviewsdyjupcazwsgv.dns.army -d thevilla46.com -d thevine-organizasyon.com @@ -90583,6 +90587,7 @@ msFilterList -d timelyrain.top -d timenard.top -d timenotbesea.xyz +-d timenow.pw -d timenowis1.top -d timeoffer.site -d timeofvape.tk @@ -92348,7 +92353,6 @@ msFilterList -d trustinspect.com -d trustlancers.com -d trustorbit.com --d trustpilot-scam.com -d trustpropertyholdings.com -d trustrambusinesssolutions.com -d trustrobins.info @@ -92395,6 +92399,7 @@ msFilterList -d ts.7rb.xyz -d ts0ev73.com -d tsal.com +-d tsapparel.com.my -d tsareva-garden.ru -d tsatsi.co.za -d tsauctions.com @@ -92956,7 +92961,6 @@ msFilterList -d u0707115.cp.regruhosting.ru -d u0746219.cp.regruhosting.ru -d u0774849.cp.regruhosting.ru --d u1.huatu.com -d u1.innerpeer.com -d u11123p7833.web0104.zxcs.nl -d u1141p8807.web0103.zxcs.nl @@ -93699,6 +93703,7 @@ msFilterList -d unitedwsdy5defenceforgorvermentsocialeme.duckdns.org -d unitedwsdykesokowsbv.dns.army -d unitedwsdykesokowsgs.dns.army +-d unitedwsdykesokowskg.dns.army -d unitedwsdykesokowsku.dns.army -d unitedwsdykesokowsri.dns.navy -d unitedyfl.com @@ -94099,7 +94104,6 @@ msFilterList -d url675.textilmallorca.com -d url9823.ville.labrecque.qc.ca -d urlac.de --d urldefense.us -d urleddrug.at -d urlfrance.fr -d urlm.ir @@ -94226,7 +94230,6 @@ msFilterList -d uspslabel.itemdb.com -d uss.ac.th -d uss21.com --d ussbd.net -d usselfstoragenetwork.com -d ussrback.com -d ussrgun.000webhostapp.com @@ -94341,6 +94344,7 @@ msFilterList -d uyaiblog.com -d uycqawua.applekid.cn -d uydu.antalyaelektrikariza.net +-d uyen.vn -d uyencometics.bmt.city -d uyencuentra.com -d uyf.com.ua @@ -98813,7 +98817,6 @@ msFilterList -d wotehb.com -d wotsuper.pw -d wotsuper3.exe --d wouatiareves.ru -d wourionlion.ru -d woutaalexp.com -d wouterwolf.com @@ -99034,6 +99037,7 @@ msFilterList -d wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org -d wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org -d wsdyalgreenkeghewsmq.dns.army +-d wsdyalgreenkelveskxz.dns.army -d wsdyalhjchfonlinedws.dns.navy -d wsdyalhjchfonlinwsdf.dns.army -d wsdyalhjchfonlinwsed.dns.army @@ -99057,10 +99061,12 @@ msFilterList -d wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org -d wsdyibgreenkegheedws.dns.navy -d wsdyibgreenkeghewsyt.dns.army +-d wsdyibgreenventureqx.dns.army -d wsdykalamikonlinedeliverystoreservwspmq.ydns.eu -d wsdykung38communicationtarisupliermgapc.duckdns.org -d wsdykungsb2gotchtsub.dns.army -d wsdykungsb2gotchtwsp.dns.army +-d wsdykungsb2talenwsjf.dns.army -d wsdykungsb2talenwsmz.dns.army -d wsdymsloginvestmwsqd.dns.army -d wsdymsloginvestmwsrw.dns.army @@ -99073,9 +99079,11 @@ msFilterList -d wsdynitengymndynatin.dns.army -d wsdypmrimelimtdvenws.dns.army -d wsdypmrimelimtdvewsd.dns.army +-d wsdyrkkrgorgiousejhd.dns.army -d wsdyrkkrsuccessmorev.dns.army -d wsdyrkkrsuccessmoven.dns.army -d wsdyrmtcntlfarmtwsvb.dns.army +-d wsdysara1investvwsfs.dns.army -d wsdyshgshg2induswsjg.dns.army -d wsdyshgshgnationalindustrialandgoogledns.duckdns.org -d wsdyshgshgnationalobjindustrialat23fty.duckdns.org @@ -100122,7 +100130,6 @@ msFilterList -d xnk.jbzie.com -d xnkwintech.com -d xnxxchannel.com --d xnxxfullhd.com -d xo4z0sl.com -d xo57.com -d xoangyduong.com.vn @@ -100671,7 +100678,6 @@ msFilterList -d yeu81.com -d yeu82.com -d yeuhang.tk --d yeumoitruong.vn -d yeuromndy.cf -d yeutocviet.com -d yewonder.com diff --git a/urlhaus-filter.txt b/urlhaus-filter.txt index 2e63924e..9eaa47be 100644 --- a/urlhaus-filter.txt +++ b/urlhaus-filter.txt @@ -1,5 +1,5 @@ ! Title: Malicious URL Blocklist -! Updated: Thu, 08 Apr 2021 00:12:42 UTC +! Updated: Thu, 08 Apr 2021 12:12:46 UTC ! Expires: 1 day (update frequency) ! Homepage: https://gitlab.com/curben/urlhaus-filter ! License: https://gitlab.com/curben/urlhaus-filter#license @@ -7235,6 +7235,7 @@ 104.248.45.10 104.248.46.116 104.248.47.15 +104.248.48.18 104.248.49.76 104.248.5.108 104.248.5.19 @@ -8844,6 +8845,7 @@ 107.173.222.122 107.173.222.123 107.173.222.153 +107.173.23.240 107.173.24.139 107.173.24.14 107.173.24.145 @@ -44051,6 +44053,7 @@ 115.53.254.154 115.53.254.163 115.53.254.17 +115.53.254.187 115.53.254.192 115.53.254.217 115.53.254.218 @@ -131883,6 +131886,7 @@ 119.123.216.171 119.123.216.178 119.123.216.184 +119.123.216.19 119.123.216.206 119.123.216.208 119.123.216.218 @@ -155791,6 +155795,7 @@ 123.4.251.84 123.4.252.12 123.4.252.120 +123.4.252.144 123.4.252.159 123.4.252.170 123.4.252.19 @@ -161127,6 +161132,7 @@ 123.9.193.144 123.9.193.152 123.9.193.154 +123.9.193.157 123.9.193.164 123.9.193.168 123.9.193.179 @@ -162513,6 +162519,7 @@ 123moviesfx.com 123sellfast.com 123sex.co +123tadi.com 123xyz.xyz 124.100.74.153 124.105.105.222 @@ -164892,6 +164899,7 @@ 124.40.246.95 124.43.216.1 124.45.136.224 +124.5.112.43 124.5.203.86 124.5.24.59 124.5.28.41 @@ -184022,6 +184030,7 @@ 125.99.220.27 125.99.221.206 125.99.222.152 +125.99.222.170 125.99.222.2 125.99.222.245 125.99.222.76 @@ -187647,6 +187656,7 @@ 14.42.155.140 14.42.206.204 14.42.229.214 +14.42.237.237 14.42.48.241 14.42.53.134 14.42.80.24 @@ -195359,6 +195369,7 @@ 172.105.247.88 172.105.36.168 172.105.61.165 +172.105.68.51 172.105.69.5 172.105.70.225 172.105.79.99 @@ -198091,6 +198102,7 @@ 172.93.162.253 172.93.165.221 172.93.176.137 +172.93.176.142 172.93.184.161 172.93.184.71 172.93.187.131 @@ -202464,6 +202476,7 @@ 178.169.165.90 178.169.68.162 178.17.170.28 +178.17.171.144 178.17.174.43 178.170.117.50 178.170.117.8 @@ -202485,6 +202498,7 @@ 178.175.0.125 178.175.0.129 178.175.0.140 +178.175.0.143 178.175.0.144 178.175.0.146 178.175.0.149 @@ -202728,6 +202742,7 @@ 178.175.10.6 178.175.10.66 178.175.10.71 +178.175.10.76 178.175.10.78 178.175.10.8 178.175.10.85 @@ -203124,6 +203139,7 @@ 178.175.103.45 178.175.103.48 178.175.103.50 +178.175.103.52 178.175.103.54 178.175.103.58 178.175.103.61 @@ -203247,6 +203263,7 @@ 178.175.104.62 178.175.104.64 178.175.104.66 +178.175.104.67 178.175.104.69 178.175.104.80 178.175.104.85 @@ -203587,6 +203604,7 @@ 178.175.107.68 178.175.107.7 178.175.107.70 +178.175.107.71 178.175.107.75 178.175.107.76 178.175.107.78 @@ -204381,6 +204399,7 @@ 178.175.114.138 178.175.114.142 178.175.114.145 +178.175.114.146 178.175.114.15 178.175.114.151 178.175.114.152 @@ -204637,6 +204656,7 @@ 178.175.116.195 178.175.116.196 178.175.116.197 +178.175.116.20 178.175.116.200 178.175.116.201 178.175.116.207 @@ -205987,6 +206007,7 @@ 178.175.127.216 178.175.127.217 178.175.127.219 +178.175.127.223 178.175.127.224 178.175.127.225 178.175.127.228 @@ -206145,6 +206166,7 @@ 178.175.14.152 178.175.14.153 178.175.14.154 +178.175.14.155 178.175.14.156 178.175.14.157 178.175.14.16 @@ -206539,6 +206561,7 @@ 178.175.18.202 178.175.18.203 178.175.18.205 +178.175.18.214 178.175.18.215 178.175.18.219 178.175.18.22 @@ -206595,6 +206618,7 @@ 178.175.19.150 178.175.19.157 178.175.19.158 +178.175.19.160 178.175.19.162 178.175.19.163 178.175.19.165 @@ -206948,6 +206972,7 @@ 178.175.21.38 178.175.21.39 178.175.21.40 +178.175.21.41 178.175.21.42 178.175.21.44 178.175.21.53 @@ -206974,6 +206999,7 @@ 178.175.22.116 178.175.22.117 178.175.22.118 +178.175.22.120 178.175.22.125 178.175.22.129 178.175.22.13 @@ -207847,6 +207873,7 @@ 178.175.3.80 178.175.3.81 178.175.3.85 +178.175.3.86 178.175.3.87 178.175.3.94 178.175.3.98 @@ -208090,6 +208117,7 @@ 178.175.32.183 178.175.32.184 178.175.32.185 +178.175.32.186 178.175.32.190 178.175.32.196 178.175.32.197 @@ -208227,6 +208255,7 @@ 178.175.33.26 178.175.33.28 178.175.33.30 +178.175.33.32 178.175.33.38 178.175.33.40 178.175.33.50 @@ -209038,6 +209067,7 @@ 178.175.40.203 178.175.40.204 178.175.40.205 +178.175.40.209 178.175.40.211 178.175.40.218 178.175.40.221 @@ -209248,6 +209278,7 @@ 178.175.42.42 178.175.42.44 178.175.42.45 +178.175.42.46 178.175.42.48 178.175.42.53 178.175.42.55 @@ -209766,6 +209797,7 @@ 178.175.47.217 178.175.47.218 178.175.47.22 +178.175.47.220 178.175.47.222 178.175.47.224 178.175.47.226 @@ -209903,6 +209935,7 @@ 178.175.48.6 178.175.48.65 178.175.48.66 +178.175.48.67 178.175.48.71 178.175.48.76 178.175.48.80 @@ -210181,6 +210214,7 @@ 178.175.50.47 178.175.50.48 178.175.50.50 +178.175.50.54 178.175.50.55 178.175.50.57 178.175.50.58 @@ -210792,6 +210826,7 @@ 178.175.56.57 178.175.56.6 178.175.56.61 +178.175.56.64 178.175.56.66 178.175.56.67 178.175.56.69 @@ -210859,6 +210894,7 @@ 178.175.57.192 178.175.57.20 178.175.57.203 +178.175.57.204 178.175.57.206 178.175.57.209 178.175.57.210 @@ -211742,6 +211778,7 @@ 178.175.65.181 178.175.65.184 178.175.65.186 +178.175.65.189 178.175.65.19 178.175.65.192 178.175.65.193 @@ -212228,6 +212265,7 @@ 178.175.69.73 178.175.69.74 178.175.69.77 +178.175.69.79 178.175.69.8 178.175.69.82 178.175.69.83 @@ -213313,6 +213351,7 @@ 178.175.79.188 178.175.79.189 178.175.79.196 +178.175.79.198 178.175.79.199 178.175.79.200 178.175.79.204 @@ -213623,6 +213662,7 @@ 178.175.81.232 178.175.81.235 178.175.81.236 +178.175.81.240 178.175.81.241 178.175.81.244 178.175.81.246 @@ -214123,6 +214163,7 @@ 178.175.86.106 178.175.86.108 178.175.86.11 +178.175.86.117 178.175.86.119 178.175.86.12 178.175.86.122 @@ -214148,6 +214189,7 @@ 178.175.86.181 178.175.86.182 178.175.86.183 +178.175.86.184 178.175.86.187 178.175.86.188 178.175.86.191 @@ -214424,6 +214466,7 @@ 178.175.88.8 178.175.88.83 178.175.88.84 +178.175.88.85 178.175.88.95 178.175.89.0 178.175.89.10 @@ -214824,6 +214867,7 @@ 178.175.92.1 178.175.92.100 178.175.92.102 +178.175.92.105 178.175.92.106 178.175.92.108 178.175.92.109 @@ -215169,6 +215213,7 @@ 178.175.95.102 178.175.95.103 178.175.95.104 +178.175.95.105 178.175.95.111 178.175.95.112 178.175.95.114 @@ -215362,6 +215407,7 @@ 178.175.96.82 178.175.96.87 178.175.96.88 +178.175.96.93 178.175.96.95 178.175.96.96 178.175.96.97 @@ -215616,6 +215662,7 @@ 178.175.99.207 178.175.99.208 178.175.99.209 +178.175.99.21 178.175.99.214 178.175.99.216 178.175.99.22 @@ -218635,6 +218682,7 @@ 182.112.173.245 182.112.173.8 182.112.176.47 +182.112.177.134 182.112.177.215 182.112.177.93 182.112.178.167 @@ -261159,6 +261207,7 @@ 183.83.0.112 183.83.0.192 183.83.0.230 +183.83.1.1 183.83.1.221 183.83.1.234 183.83.1.239 @@ -261271,6 +261320,7 @@ 183.83.13.17 183.83.13.69 183.83.13.95 +183.83.14.20 183.83.14.3 183.83.14.35 183.83.14.70 @@ -263187,6 +263237,7 @@ 185.8.202.254 185.8.232.145 185.80.92.4 +185.81.154.208 185.81.157.124 185.81.157.186 185.81.98.78 @@ -272154,6 +272205,7 @@ 201.171.185.92 201.171.204.13 201.171.227.59 +201.171.40.215 201.171.84.139 201.175.63.186 201.182.144.193 @@ -279093,6 +279145,7 @@ 213.183.63.124 213.183.63.242 213.186.35.153 +213.186.69.101 213.189.178.163 213.195.111.72 213.200.133.18 @@ -279380,6 +279433,7 @@ 216.180.117.96 216.180.117.98 216.183.54.169 +216.183.54.196 216.189.145.11 216.189.177.221 216.189.184.23 @@ -279579,6 +279633,7 @@ 217.12.199.179 217.12.208.14 217.12.209.74 +217.12.209.82 217.12.210.156 217.12.210.209 217.12.221.244 @@ -284073,6 +284128,7 @@ 219.155.234.12 219.155.234.155 219.155.234.218 +219.155.234.33 219.155.235.100 219.155.235.145 219.155.235.154 @@ -291595,6 +291651,7 @@ 220.81.201.7 220.81.229.175 220.81.30.193 +220.81.44.181 220.81.44.92 220.82.140.17 220.82.182.150 @@ -299540,6 +299597,7 @@ 222.137.132.49 222.137.133.110 222.137.133.120 +222.137.133.125 222.137.133.195 222.137.133.212 222.137.133.244 @@ -309766,6 +309824,7 @@ 222.142.210.122 222.142.210.136 222.142.210.138 +222.142.210.144 222.142.210.146 222.142.210.155 222.142.210.163 @@ -311692,6 +311751,7 @@ 23.95.11.48 23.95.116.135 23.95.116.144 +23.95.122.24 23.95.122.47 23.95.13.131 23.95.13.158 @@ -325790,6 +325850,7 @@ 27.5.39.115 27.5.39.121 27.5.39.122 +27.5.39.124 27.5.39.127 27.5.39.128 27.5.39.140 @@ -334728,6 +334789,7 @@ 27.6.254.187 27.6.254.232 27.6.254.89 +27.6.255.101 27.6.255.107 27.6.255.121 27.6.255.160 @@ -355793,6 +355855,7 @@ 42.2.137.29 42.202.100.135 42.202.100.233 +42.202.101.118 42.202.101.133 42.202.101.136 42.202.101.138 @@ -357199,6 +357262,7 @@ 42.224.158.181 42.224.158.206 42.224.158.208 +42.224.158.22 42.224.158.227 42.224.158.231 42.224.158.234 @@ -360151,6 +360215,7 @@ 42.224.51.213 42.224.51.222 42.224.51.223 +42.224.51.229 42.224.51.23 42.224.51.239 42.224.51.75 @@ -379290,6 +379355,7 @@ 42.236.212.147 42.236.212.154 42.236.212.155 +42.236.212.157 42.236.212.158 42.236.212.159 42.236.212.167 @@ -388820,6 +388886,7 @@ 4ele.pl 4ertybhdfrt.gq 4esports.de +4et3ja.am.files.1drv.com 4evakleen.com.au 4eventfacilities.nl 4evernails.nl @@ -397354,6 +397421,7 @@ 59.25.9.121 59.25.9.126 59.26.12.115 +59.26.181.228 59.26.20.177 59.26.209.230 59.26.214.148 @@ -433128,6 +433196,7 @@ 6481254.ru 649924.nchsoftwarecom.com 64x9bg.ch.files.1drv.com +65.0.168.152 65.0.173.107 65.0.179.146 65.0.55.192 @@ -433173,6 +433242,8 @@ 65k2.com 66-gifts.com 66.103.9.249 +66.108.199.144 +66.109.135.129 66.11.110.27 66.11.125.94 66.110.228.60 @@ -437959,6 +438030,7 @@ 88.218.16.87 88.218.16.9 88.218.17.109 +88.218.17.110 88.218.17.119 88.218.17.149 88.218.17.179 @@ -438525,6 +438597,7 @@ 89.239.96.164 89.244.238.226 89.245.110.35 +89.248.112.202 89.248.166.171 89.248.166.183 89.248.167.133 @@ -441334,6 +441407,7 @@ 999.buzz 999.co.id 999.rajaojek.com +999080321newfolder1002002131-service1002.space 999102com.cn 99bkx.com 99centsdigitals.com @@ -443521,6 +443595,7 @@ ahiraatfashion.com ahiskatv.net ahitekniktarti.com ahiyangrup.com.tr +ahjianlong.cf ahjuric.si ahk.smu8street.ru ahkha.com @@ -443945,6 +444020,7 @@ akito.be akivj07.top akktis.com akkurtmadencilik.com +aklatdelmundo.com akleigh.com aklin.ir aklocalshop.com @@ -444657,7 +444733,6 @@ alladinonlinee.com allainesconsultancyinc.com allamanolibrary.com allan-it.com -allanabolicsteam.net allanelect.co.uk allangillphotography.com allanhollowell.com @@ -444931,6 +445006,7 @@ alona.org.cy aloneintheweb.com aloneskisehir.com alongthelines.com +alongwalker.com alonhadat24h.vn alooshop.ir aloravan.com @@ -445689,7 +445765,6 @@ an9news.com ana.plecko.eu anaaj.pk anabim.com -anabolicsteroidsbuy.info anaceb.com anadearmas.net anadelgbt.org @@ -449662,7 +449737,6 @@ b94yhzk.com b97pm6.com ba3capital.com baacsetu.org -baadababada.ru baaders-namibia.com baakcafe.com baamiraan.ir @@ -449784,7 +449858,6 @@ backup.utlitslaekning.is backup.xn----8sba7bmrlhv0a.xn--p1ai backup2.robinandelaine.com backupcom.e-twow.uk -backupez.com backupfashions.com backupsitedev.flywheelsites.com backupsql.datasiswebcontable.com @@ -451167,7 +451240,6 @@ belayadver.com belaythakayni.com belboks.com belboy.in -belcineloweek.ru belconger.com belcorpisl.com belcvet.com @@ -453726,7 +453798,6 @@ bobbyterry.top bobbyworld.top bobcar.com.my bobcatofchico.com -bobcatofredding.com bobcook.ca bobdolph.com bobenstetter.net @@ -454978,7 +455049,6 @@ bucketlistrecipes.com bucketstrong.s3-us-west-1.amazonaws.com buckeyechartershiltonhead.com buckeyeoptical.com -buckeyesecurity.net buckinghamandlloyds.com buckleman.co.id bucklindata.net @@ -455067,6 +455137,7 @@ buildchem.pk buildcraftindia.com buildentconstructions.com builder.acasia.mx +builder.makemoneywith.website buildersmerchantsfederation-my.sharepoint.com buildgreenindustries.com building-company.lt @@ -455610,7 +455681,6 @@ c.mymortgagegenius.ca c.oooooooooo.ga c.pieshua.com c.teamworx.ph -c.top4top.io c.top4top.net c.vivi.casa c.vollar.ga @@ -456282,6 +456352,7 @@ capitalnewsagency.com capitalonefinanceltd.in capitalpellets.com capitalpremiumfinancinginc.com +capitalprint.co.za capitalprivateasset.com capitalrealestate.us capitalrh.com.br @@ -461122,6 +461193,7 @@ covid19.peaceforchildren.net covid19map.digital covid19quarantin.com covid19safety.myftp.org +covid19vaccinations.hopto.org covid19vaccine.hopto.org covid2023.info covidbase.info @@ -462480,6 +462552,7 @@ dacle.eu daclim.ro daco-precision.thomaswebs.net daco.nyccomputerconsulting.com +dacsancaonguyen.vn dactridaudaday.com dactyltech.co.za dacviadokese.com @@ -471124,6 +471197,7 @@ estiloraropremium.com.br estimating.training estimatorfind.com estimetercume.com +estjh05.top estore.qurvex.com estoyadieta.com estrategias-corporativas.com @@ -471299,7 +471373,6 @@ etwqsx23.duckdns.org etxse.xyz etysu02scnabr03wzaxue.com eu-easy.com -eu.wildfire.paloaltonetworks.com eu1.salesforce.com eu283iwoqodjspqisjdf.com eu5-cdn.devid.info @@ -473443,7 +473516,6 @@ files.danwin1210.me files.dropmybin.me files.enjin.com files.gathercdn.com -files.hrloo.com files.l-d.tech files.martellexpress.us files.mirai-2viv.vn @@ -475176,6 +475248,7 @@ friendsstarintl.com friendzonecafe.com frietfun.be frigolutasima.net +frigoprehrana.com frigoriferivignola.it frigotechniek.be frigsales.com @@ -475657,7 +475730,6 @@ fuzzymiles.com fv1-2.failiem.lv fv13.failiem.lv fv15.failiem.lv -fv2-2.failiem.lv fv2-7.failiem.lv fv3.failiem.lv fv6.failiem.lv @@ -475735,7 +475807,6 @@ g0ogle.free.fr g0zh8lb3.com g15aocbenedict.com g1ba4tt4ngq5nl7w.xyz -g1smurt.ru g20digital.com.br g237.cn g2creditsolutions.com @@ -475823,9 +475894,6 @@ gadanie-lidia.ru gadaniya-magiya.site gadcoafrica.com gaddco.com -gade4senate.com -gadebrigade.com -gadeforussenate.com gadem.ug gadesoluciones.pe gadget-plaza.ru @@ -477973,6 +478041,7 @@ gomiles.vn gomitra.com gomovies.cl gomsubattrangxuatkhau.com +gomsuminhlongthainguyen.vn gomus.com.br gomyfiles.info gomypass.com @@ -479471,7 +479540,6 @@ h-w-c.net h.epelcdn.com h.eurotrading.com.pl h.j990981.ru -h.top4top.io h.valerana44.ru h002295863.nichost.ru h0h.org @@ -481701,7 +481769,6 @@ home-spy-shop.com home.99eurowebsite.ie home.barley-plus.com home.dawang.ink -home.earthlink.net home.evrstudio.com home.healthiestu.com home.isdes.com @@ -482071,6 +482138,7 @@ hosteriapuestadelsol.com hostfleek.com hostgo.com.br hostile-gaming.fr +hostimpel.com hosting-c.iuro.nl hosting.drupwayinfotech.in hosting.mrsofttech.com @@ -488527,6 +488595,7 @@ kabek.vn kabelinieseti.ru kabiguru.org kabiledans.com +kabimmo.com kabinarf.ru kabiru.ru kabiryogashramlimbdi.com @@ -489944,7 +490013,6 @@ killu.in kilnrefractory.com kilolo.site kilop.goodvibeskickin.com -kilopaskal.ru kimaco.com kimberly.digital kimberly5esthetique.com @@ -490276,7 +490344,6 @@ klasterpolskanatura.pl klaus-moersch.de klausnerlaw.com klaussen.net -klaustrofebia.ru klavze28.com klbay.net kldatabase.com @@ -493178,6 +493245,7 @@ library.arihantmbainstitute.ac.in library.cifor.org library.dhl-xom.com library.iainbengkulu.ac.id +library.mju.ac.th library.phibi.my.id library.piet.co.in library.strophicmusic.com @@ -494950,7 +495018,6 @@ luminousinvestment.com luminouspla.net luminouspneuma.com lumnus.com.br -lumoura.com lumperpush.com lumsdancorp.com lun.otrweb.ru @@ -495112,6 +495179,7 @@ lyhnb.club lykangblog.com lykusglobal.com lylevr.com +lyllacarter.com lylydressforless.com lymcomercial.cl lymfodrenaze.eu @@ -498268,6 +498336,7 @@ medicina.uanl.mx medicinadellavoromb.it medicinaesteticaorlandini.it medicinageriatrica.com.br +medicinainterna-critica.com medicinaonline.rjsrwaco.watchdogdns.duckdns.org medicine.softberg.ro mediclaim.odhavnidhi.org @@ -501438,6 +501507,7 @@ mtbplus.de mtcinteriordesign.co.uk mtcr.co.za mtcuadrado.com +mtdc.com.my mte1.cn mtechagency.com mteestore.com @@ -502134,7 +502204,6 @@ myhygienemart.com myimmigrationlawmarketingpartner.com myimmogroup.be myinfoart.online -myinstabuzzz.co myinstantguru.com myinternetjobs.com myintromationsz.win @@ -502160,6 +502229,7 @@ mylifestoryfilm.com mylinkguard.com mylistbuildingtraffic.com mylisting.martinface.com +myliverpoolnews.cf myloanbaazar.com myloanexpert.in mylocal.dk @@ -503749,6 +503819,7 @@ news.iid-mit.com.tw news.intertours.org.rs news.leta.com.vn news.lwinmoenaing.me +news.makemoneywith.website news.medicaid.ir news.omumusic.net news.palette69.com @@ -504532,6 +504603,7 @@ nms.evertechit.live nmsk.online nmsr.info nmvconstructions.com +nmxwllwsdyminoragenw.dns.army nn-webdesign.be nn.5ctelematics.com nnasout.com @@ -505312,7 +505384,6 @@ nvdvdgp.com nvdweb.azurewebsites.net nveeusa.com nvelj12qyyfi03kqxy.xyz -nvgeeforsegt.ru nvgp.com.au nvi.edu.vn nvl.netsmartz.net @@ -506530,7 +506601,6 @@ onlusarcadia.it only4atalg.ml onlyapteka.ru onlyart.in -onlybamboofabrics.com onlycane.in onlychild.org onlycocktaildresses.com @@ -508520,6 +508590,7 @@ payyosafoolayzp.com pazarcheto.com pazargezer.com pazcomau-my.sharepoint.com +pazpus.com pb-xt.com pb.divaasolutions.com pb128o6c2favwk.com @@ -510265,6 +510336,7 @@ pmrimesndylimtdvensn.dns.army pmrimestdylimtdvenst.dns.army pmrimestdylimtdvests.dns.army pmrimestdylimtstwork.dns.army +pmrimewsdylimtewsogh.dns.army pmrimewsdylimtwswods.dns.army pms.stercomagento.com pmsports.de @@ -511983,6 +512055,7 @@ prostranstvorosta.ru prosupport.cl prosvyaz.kz prosyarmakassar.com +prosystemsug.com prosysvinorosso.com prot.drupal8.softikom.lv protaciohospital.com @@ -511993,7 +512066,6 @@ protech.binarybizz.com protech.mn protechcarpetcare.com protechgroup1.com -protect.mimecast-offshore.com protectiadatelor.biz protection.ominenergo.gov.rsmart-testsolutions.watchdogdns.duckdns.org protection.pecol.eu @@ -513193,6 +513265,7 @@ quatanggmt.com quatanghoanglong.com quatangluuniemhue.com quatangtaynguyen.com +quatangtaynguyen.vn quatest.sixstarsent.com quatet365.com quatram.de @@ -513258,6 +513331,7 @@ quickbook.online quickbookstechnicalsupportphonenumber.com quickboooks.host quickboooks.space +quickcompanyreg.co.za quickfingers.net quickinsolutions.com quicklifecare.com @@ -515859,7 +515933,6 @@ roads.stamperinc.org roadscompass.com roadtravelcars.com roanokecellphonerepair.com -roanokemortgages.com roastedguarmeal.com roba.nu robaitec.com @@ -518232,6 +518305,7 @@ savannaopticalsgh.com savasaachi.systems savaspark.com.tr save-room.info +save.makemoneywith.website save24x7.com saveanimal.org savecannabis.org @@ -521892,6 +521966,7 @@ slrent.com slrpros.com sls-eg.com sls-security.ru +slsbearings.com.sg slservicebd.com slubnefury.pl slugard.5gbfree.com @@ -523824,7 +523899,6 @@ srmfiresafety.com srnirob.com srno.hu sromano.it -sromecorlduce.ru sroomf70nasiru.duckdns.org srooooiva.ru srpresse.fr @@ -525656,7 +525730,6 @@ sunfloro.com sunflowerschoolandcollege.com sunfruit.com.tn sunganak.in -sungardspo.com sungazer.com.au sunglasses2020.com sungvalopkhongsam.com @@ -529056,6 +529129,7 @@ thefoxfestival.com thefragrancefreeshop.com thefranssons.com thefreelancerschool.com +thefrees.com thefreewaterfoundation.org.za thefront.in thefuel.be @@ -529640,6 +529714,7 @@ theviestdyjupcafgcms.dns.army theviestdyjupcafgmcn.dns.army theviestdyjupcafgsvb.dns.army theviestdyjupcazfest.dns.navy +theviewsdyjupcazfeqv.dns.army theviewsdyjupcazwsgv.dns.army thevilla46.com thevine-organizasyon.com @@ -530143,6 +530218,7 @@ timelyent.com timelyrain.top timenard.top timenotbesea.xyz +timenow.pw timenowis1.top timeoffer.site timeofvape.tk @@ -531908,7 +531984,6 @@ trusticar.lt trustinspect.com trustlancers.com trustorbit.com -trustpilot-scam.com trustpropertyholdings.com trustrambusinesssolutions.com trustrobins.info @@ -531955,6 +532030,7 @@ ts-deals.me ts.7rb.xyz ts0ev73.com tsal.com +tsapparel.com.my tsareva-garden.ru tsatsi.co.za tsauctions.com @@ -532516,7 +532592,6 @@ u0649681.cp.regruhosting.ru u0707115.cp.regruhosting.ru u0746219.cp.regruhosting.ru u0774849.cp.regruhosting.ru -u1.huatu.com u1.innerpeer.com u11123p7833.web0104.zxcs.nl u1141p8807.web0103.zxcs.nl @@ -533259,6 +533334,7 @@ unitedworks.info unitedwsdy5defenceforgorvermentsocialeme.duckdns.org unitedwsdykesokowsbv.dns.army unitedwsdykesokowsgs.dns.army +unitedwsdykesokowskg.dns.army unitedwsdykesokowsku.dns.army unitedwsdykesokowsri.dns.navy unitedyfl.com @@ -533659,7 +533735,6 @@ url5459.41southbar.com url675.textilmallorca.com url9823.ville.labrecque.qc.ca urlac.de -urldefense.us urleddrug.at urlfrance.fr urlm.ir @@ -533786,7 +533861,6 @@ uspeshnybusiness.ru uspslabel.itemdb.com uss.ac.th uss21.com -ussbd.net usselfstoragenetwork.com ussrback.com ussrgun.000webhostapp.com @@ -533901,6 +533975,7 @@ uy-akwaibom.ru uyaiblog.com uycqawua.applekid.cn uydu.antalyaelektrikariza.net +uyen.vn uyencometics.bmt.city uyencuentra.com uyf.com.ua @@ -538373,7 +538448,6 @@ wotan.info wotehb.com wotsuper.pw wotsuper3.exe -wouatiareves.ru wourionlion.ru woutaalexp.com wouterwolf.com @@ -538594,6 +538668,7 @@ wsdshipping.com wsdy1scmtonhumanrightjusticeorganizatin.duckdns.org wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org wsdyalgreenkeghewsmq.dns.army +wsdyalgreenkelveskxz.dns.army wsdyalhjchfonlinedws.dns.navy wsdyalhjchfonlinwsdf.dns.army wsdyalhjchfonlinwsed.dns.army @@ -538617,10 +538692,12 @@ wsdyclntnjkcloudwsgh.dns.army wsdygreenkegheedahatakankeadeshnaa34twm.duckdns.org wsdyibgreenkegheedws.dns.navy wsdyibgreenkeghewsyt.dns.army +wsdyibgreenventureqx.dns.army wsdykalamikonlinedeliverystoreservwspmq.ydns.eu wsdykung38communicationtarisupliermgapc.duckdns.org wsdykungsb2gotchtsub.dns.army wsdykungsb2gotchtwsp.dns.army +wsdykungsb2talenwsjf.dns.army wsdykungsb2talenwsmz.dns.army wsdymsloginvestmwsqd.dns.army wsdymsloginvestmwsrw.dns.army @@ -538633,9 +538710,11 @@ wsdynitengymndynatem.dns.army wsdynitengymndynatin.dns.army wsdypmrimelimtdvenws.dns.army wsdypmrimelimtdvewsd.dns.army +wsdyrkkrgorgiousejhd.dns.army wsdyrkkrsuccessmorev.dns.army wsdyrkkrsuccessmoven.dns.army wsdyrmtcntlfarmtwsvb.dns.army +wsdysara1investvwsfs.dns.army wsdyshgshg2induswsjg.dns.army wsdyshgshgnationalindustrialandgoogledns.duckdns.org wsdyshgshgnationalobjindustrialat23fty.duckdns.org @@ -539682,7 +539761,6 @@ xnjwkaelsf.gq xnk.jbzie.com xnkwintech.com xnxxchannel.com -xnxxfullhd.com xo4z0sl.com xo57.com xoangyduong.com.vn @@ -540231,7 +540309,6 @@ yeu49.com yeu81.com yeu82.com yeuhang.tk -yeumoitruong.vn yeuromndy.cf yeutocviet.com yewonder.com @@ -541752,7 +541829,6 @@ zzznan.com ||10xspace.com/wp-includes/wucz92vcwvzmvwqubaa/$all ||118travel.net/ds/1512.gif$all ||11woodwork.com/wp-content/themes/betheme/functions/reporting/$all -||123tadi.com/invoice-status/invoice-0321355444-jun-20$all ||150.co.il/anydesk.exe$all ||1drv.ms/u/s!ag4kn4iexyehdrfvrvxtguoxngo$all ||1drv.ms/u/s!agcd_mpjhjpca7ysbeu0vuagxo8?e=hsbfwp$all @@ -542219,7 +542295,6 @@ zzznan.com ||8dx.pc6.com/xjq6/winrar_5.60_beta5_x64_sc.exe$all ||91damimi.com/wp-admin/v/$all ||91yudao.com/wp-admin/kkht1/$all -||999080321newfolder1002002131-service1002.space/2.exe$all ||99ee6261-b333-4998-8256-14e87061e63c.s3.amazonaws.com/download/setup.exe$all ||99ee6261-b333-4998-8256-14e87061e63c.s3.amazonaws.com/usa/alex.exe$all ||99ee6261-b333-4998-8256-14e87061e63c.s3.amazonaws.com/usa/crypto.exe$all @@ -542348,6 +542423,8 @@ zzznan.com ||alexlema.com/css/a1/mail_access_logs.doc$all ||alikhbariaattounsia.com/test/pages/vi1alsahsrv5s614jgfl8ewjy_iytyloj-5859557314/$all ||alkamefood.com/y/p/$all +||allanabolicsteam.net/1301s.bin$all +||allanabolicsteam.net/nedfr_.exe$all ||allexampdf.com/wp-content/uploads/2020/05/owgepuieh/employmentverification_105455577_05062020.zip$all ||allianceprofessionals.in/wp-admin/hcpgpgps29w747yrcgr9qfctep/$all ||alliedpanama.com/fqxygocodg/60508991/kteq_60508991_03062020.zip$all @@ -542357,8 +542434,6 @@ zzznan.com ||almalim.com/wp-admin/6wevayeqf85b7spp0i2/$all ||almalim.com/wp-admin/docs/upkiuyrx8q/$all ||almalim.com/wp-admin/qjzpqzevkwq7-000747/$all -||alongwalker.com/flysystem/root/jw3lnl6/$all -||alongwalker.com/flysystem/root/vice4z/$all ||alt-ltd.co.uk/docs/documentation/onz33qe1cjram1vkoz0/$all ||altcomconstruction.com/wp-includes/or7/$all ||alturl.com/fs53b$all @@ -542389,6 +542464,7 @@ zzznan.com ||amystuff.in/g/xnqwfdc1pdh2uj4snqu7ruz66nrv2dh///$all ||amzonfun.com/clricns/cvcuu8/$all ||amzonfun.com/clricns/npq12319/$all +||anabolicsteroidsbuy.info/nedfr.exe$all ||anakhita.com/wordpress/pt/$all ||analogx.com/files/proxyi.exe$all ||anchorhealth.ca/tmp/jzwi-uffy7-35246/$all @@ -542535,11 +542611,15 @@ zzznan.com ||azoresalive.com/wea92k.rar$all ||b.top4top.io/p_1487vww951.jpg$all ||b4ad7b79-534a-4e83-953e-c36da8cf27d9.s3.amazonaws.com/ww/setup.exe$all +||baadababada.ru/6jhfa478.exe$all ||babaikane.s3.amazonaws.com/elpaisadats.zip$all ||babalublog.com/anatasio/pzmdp-hdzcluvtvxsdcm_tkwgwiljc-qq/$all ||babalublog.com/image/h5jo1ao23800/$all ||babsitef.com/app/app.exe$all ||bac.edu.my/wp-admin/tijnv-w6gm2qa7hkcpfdo_udnpnvon-ti/$all +||backupez.com/0902.bin$all +||backupez.com/0902s.bin$all +||backupez.com/6yudfgh.exe$all ||baladacintarizieq.weebly.com/uploads/1/0/1/1/101126060/baladacintarizieq.exe$all ||balmoraldevelopment.ca/zulrah-inventory-njbqt/cjeehroals/44243988062.dat$all ||balmoraldevelopment.ca/zulrah-inventory-njbqt/cjeehroals/4818840.dat$all @@ -542569,6 +542649,9 @@ zzznan.com ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/6f563873-15ee-468a-963c-db55a58d3c9c/betabotkas.exe?signature=gdqnralwhveftqtdsri62lt6n4a%3d&expires=1547724678&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=htnbcwgf1x8g66tof0fdmfcvqntq8j6s&response-content-disposition=attachment%3b%20filename%3d%22betabotkas.exe%22$all ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/a82aea2f-d076-4e1d-8fcb-8b79898a85be/kas919.exe?signature=8gqnlnixtn40dyz9kpkxenncni0%3d&expires=1547725024&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ft24jaolcop3da_7_ev5xcguooyhq0mq&response-content-disposition=attachment%3b%20filename%3d%22kas919.exe%22$all ||bbuseruploads.s3.amazonaws.com/12f48b1a-a1ba-4ddc-9ace-310b1ec48f6b/downloads/a88d5da4-e34f-49d9-9c8f-f1576e65844b/bin.exe?signature=ilbhrxqfodu36rc7xziy5s9vtto%3d&expires=1547724674&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ygednlr3gkvc9bkfrgrsowc8pfk.awza&response-content-disposition=attachment%3b%20filename%3d%22bin.exe%22$all +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/62ab596d-a885-41d2-8876-b14668b5131e/test.exe?signature=o3aakhmr7kd9oxnuac8wb06is0a%3d&expires=1617867062&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=4_mbfbxzdu5kgeztrex1qrsberpz4m_z&response-content-disposition=attachment%3b%20filename%3d%22test.exe%22/$all +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/79aaba2e-49c6-496e-abf1-f26c32eb56e5/updatedata.exe?signature=4n9w1uqk%2b1lp%2ff3lekorwfww8ba%3d&expires=1617867048&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=ntaaekydhfciseav0ejmu_rdwfsfnpky&response-content-disposition=attachment%3b%20filename%3d%22updatedata.exe%22/$all +||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/98b527aa-e517-43ca-bf97-61bc2c51d865/3.exe?signature=qizcxni%2bqskgnanrwlk6babc7gs%3d&expires=1617867059&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=hdqursidmznzrtifyejabx_aaqxteyx7&response-content-disposition=attachment%3b%20filename%3d%223.exe%22/$all ||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/ace278db-4135-41d0-9914-3840b10de6de/omar.exe?signature=zh8efir48pny30f9uatznyf7puy%3d&expires=1617787873&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=nmiv.lpuhma2umwgepxsqa6bjvoohvwj&response-content-disposition=attachment%3b%20filename%3d%22omar.exe%22/$all ||bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/f5937654-faa6-44a4-939b-6632f91d8299/1.exe?signature=taz6uveuqvjuzvn2aucvklvyixg%3d&expires=1617787746&awsaccesskeyid=akia6kose3bnjrrfuux6&versionid=rbdipgvc.xku0.3vh3rdr2jjaah4y9ei&response-content-disposition=attachment%3b%20filename%3d%221.exe%22/$all ||bbuseruploads.s3.amazonaws.com/1ca1b493-e3b6-4b15-85b8-6446db1ece85/downloads/7ebfb5bd-7d4a-4f02-8ecf-5eec0bdca52c/encrypthei111.exe?signature=h0xssthbungwekotfbufgav%2fn4m%3d&expires=1540254951&awsaccesskeyid=akiaiqwxw6wlxmb5qzaq&versionid=ug_edq2nmoosommijyajne8h9oqvpdyj&response-content-disposition=attachment%3b%20filename%3d%22encrypthei111.exe%22$all @@ -542654,6 +542737,7 @@ zzznan.com ||behash.com/work.sh$all ||beidou.run/acoemeti/gaa/$all ||beidou.run/acoemeti/vgx/$all +||belcineloweek.ru/6sufiuerfdvc.exe$all ||bellevueairductcleaning.com/wp-admin/zk/$all ||bemcasadossoniacosta.com.br/wp-admin/overview/m6ezo1c-35569/$all ||benzatine.com/wp-admin/vafw4/$all @@ -542944,7 +543028,9 @@ zzznan.com ||bitbucket.org/mixmix2312/test1/downloads/2_5221939375847244827.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/1.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/12345.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/2.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/24.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/3.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/33333.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/5kmaraafterupdate.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/asyncclient.exe$all @@ -542952,14 +543038,21 @@ zzznan.com ||bitbucket.org/mminminminmin05/testtest/downloads/clr3.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/coohom.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/darting.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/dianthus.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/flesh.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/income.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/instaler.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/installer.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/jayson.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/looseboxes.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/n.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/newred.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/omar.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/petite.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/serv.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/test.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/updachrome.exe$all +||bitbucket.org/mminminminmin05/testtest/downloads/updatedata.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/updatej.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/updatev.exe$all ||bitbucket.org/mminminminmin05/testtest/downloads/work.exe$all @@ -543207,6 +543300,7 @@ zzznan.com ||blogformacionpchj.inces.gob.ve/inicio/sendincsec/legal/sec/en_en/2019-03/$all ||blogmiranda.inces.gob.ve/zzsm-qqz8fm-fhtu.view/$all ||bloomfire.com/wp-content/plugins/doc/foqojoiys/$all +||bobcatofredding.com/6lavfdk.exe$all ||bonex.it/de/hfapefifht3691281/rech/fakturierung/$all ||bonex.it/en_us/file/invoice/xmafx-l3q_xvqgg-fqa/$all ||bonex.it/trust.accs.send.biz/$all @@ -543231,6 +543325,9 @@ zzznan.com ||bubbawatsongolf.com/_archive/1kkkkgoz0fektndr9y221yqmaabj8i5ygefltawlu5oujtzyylumm9/$all ||bubble-setup-exe.s3.us-east-2.amazonaws.com/bubble/au/bubblebrowsermaintenance.exe$all ||bubble-setup-exe.s3.us-east-2.amazonaws.com/bubble/bubblebrowser.exe$all +||buckeyesecurity.net/55.exe$all +||buckeyesecurity.net/6lajhbjyuk.exe$all +||buckeyesecurity.net/99.exe$all ||bukeana.info/wp-admin/gg7xz04s2crcyjgbbe0mt/$all ||business-management-degree.net/wp-snapshots/w/$all ||buyitnowtoday.net/wp-admin/ki0k/$all @@ -543239,6 +543336,19 @@ zzznan.com ||c-d-t.weebly.com/uploads/1/2/3/3/123340390/cifrado.pdf$all ||c-d-t.weebly.com/uploads/1/2/3/3/123340390/microssd.hta$all ||c-d-t.weebly.com/uploads/1/2/3/3/123340390/screen.pdf$all +||c.top4top.io/p_147087hzx1.jpg$all +||c.top4top.io/p_1532pr67j1.jpg$all +||c.top4top.io/p_1540ryl6d1.jpg$all +||c.top4top.io/p_1546x5lcf1.jpg$all +||c.top4top.io/p_1549kf97p1.jpg$all +||c.top4top.io/p_1552ns6vj1.jpg$all +||c.top4top.io/p_1557q815n1.jpg$all +||c.top4top.io/p_1568qxo7y1.jpg$all +||c.top4top.io/p_1568qxo7y1.jpg%25temp%25/exploit.exe$all +||c.top4top.io/p_1568qxo7y1.jpg/,/%25temp%25/exploit.exe$all +||c.top4top.io/p_1568qxo7y1.jpg/,/demp8exploit.exe$all +||c.top4top.io/p_399718uh1.jpg$all +||c.top4top.io/p_769a2vuu1.jpg$all ||caballosshow.com/gta-v-kk6e9/s4roz9x5mfodim1ghyazd9ev/$all ||cafeponton.nl/bin/cib/$all ||cafeponton.nl/bin/multifunctional-sector/g3vmhszkgb-5frzpzwqia-portal/2ypasrqt3h-ut0816v20t97y9/$all @@ -544326,8 +544436,6 @@ zzznan.com ||d2comm.averydennison.com/runcorn/timbscanprint_1_0_0_4/vfscanprint.exe.deploy$all ||dabaibai.com/wp-includes/public/831526720787/b291kcjqathux-0055/$all ||dabesto.ir/digikala/document/8vt68obfzrcmi/$all -||dacsancaonguyen.vn/zahlung/ihre-rechnung-vom-19.06.2018$all -||dacsancaonguyen.vn/zahlung/ihre-rechnung-vom-19.06.2018/$all ||dadashuo.com/wp-content/ocpuw2sqj28961uhzuynojadjliilrp25tkopkvwtidm19ido/$all ||dagranitegiare.com/wp-admin/643641261253789/a9hv900c2nryl/$all ||dagranitegiare.com/wp-admin/911001424812/fmnjuu9fm32i/$all @@ -545494,6 +545602,7 @@ zzznan.com ||docs.google.com/uc?export=download&id=1pznr49e9zygatrbyaapcstyynzufnemb$all ||docs.google.com/uc?export=download&id=1qct-px0g0tbmlh1an8zj5mvuerlpgbmc$all ||docs.google.com/uc?export=download&id=1qjmp0rortmdcx6iw6bwg2lgmarp7tm6p$all +||docs.google.com/uc?export=download&id=1qze6qzzh1uf7iaj4rqixttznx6u1--gc&revid=0b45wwmcofx7fuvnmdhpkt1d0k3rhzldyoffnuc83auzkslvrpq$all ||docs.google.com/uc?export=download&id=1skyxw1azoujpviuqwekdcswpetys0r0x$all ||docs.google.com/uc?export=download&id=1svw14oszom6u2idng91npzvelpdedg9f$all ||docs.google.com/uc?export=download&id=1tm4rkvjulxvp7vd74irl9ffxc9crf9-t$all @@ -548027,6 +548136,7 @@ zzznan.com ||drive.google.com/uc?export=download&id=11gsxnbxefe18c1fayv9kpdessdsxuox3$all ||drive.google.com/uc?export=download&id=11hlymahuojfpno7tmmbv45n8f9vxrlo2$all ||drive.google.com/uc?export=download&id=11hywwyjrqpp_ikeacqo9vp_uwl1lacfv$all +||drive.google.com/uc?export=download&id=11idvvx22jx_1lw-hxnpmlwuvjgdyp63g$all ||drive.google.com/uc?export=download&id=11jvqxpsgamyxn2bs-mimud000fiblzol$all ||drive.google.com/uc?export=download&id=11m7m9sk_a6jz-zynoebg3_vllij8t9gl$all ||drive.google.com/uc?export=download&id=11mai5fg0ndvbucaqg1fmyjyzdbz45wos$all @@ -548347,6 +548457,7 @@ zzznan.com ||drive.google.com/uc?export=download&id=16wefm-laijdif5buz5gn5yzg2kqymuym$all ||drive.google.com/uc?export=download&id=16xqdz6demm6-fjhrkbvgicq7j3icwmqm$all ||drive.google.com/uc?export=download&id=16y49-qajyjh-yksifcv1whrhb3gh4mkx$all +||drive.google.com/uc?export=download&id=16yyvhney9_-nygeipjqgnlcmwfoyiaxo$all ||drive.google.com/uc?export=download&id=16zaoyqq3hh_m8sovikos2t_1j31l8q-f$all ||drive.google.com/uc?export=download&id=16zoens9l0ihufsnqxrckemwyfryad8am$all ||drive.google.com/uc?export=download&id=171wawwgvyvp56ovqsiffcgiplgapv7du$all @@ -548904,6 +549015,7 @@ zzznan.com ||drive.google.com/uc?export=download&id=1czxia7zmban2iwm9g4eqal6baypcvjwp$all ||drive.google.com/uc?export=download&id=1czzcmluc-6sn5li9hscxypui517paxqk$all ||drive.google.com/uc?export=download&id=1d-imno2z1s3iutwb9trmwacjsxqc7hn4$all +||drive.google.com/uc?export=download&id=1d0ij6qkgrf6irywv6ftk1m7p5l3weh3a$all ||drive.google.com/uc?export=download&id=1d0m4cqjbvfhzfitoubaunivmuwrcgyut$all ||drive.google.com/uc?export=download&id=1d0u_leb4wavx9sbumbjwf-fiatvzuyht$all ||drive.google.com/uc?export=download&id=1d1gdo27aqr62g77-u4jgszuiyky-3omp$all @@ -549851,6 +549963,7 @@ zzznan.com ||drive.google.com/uc?export=download&id=1lcwyjkohcqf8z_tzw5yppfdshn9qcgvp$all ||drive.google.com/uc?export=download&id=1ldin3nuq2pmmds2nu1m7yjguqvkjbn7b$all ||drive.google.com/uc?export=download&id=1ldre4vit7jc9ciscyyoy--ue8m6b3wet$all +||drive.google.com/uc?export=download&id=1ldxaekbcbzb-zfdix-ucj4rilobnbswx$all ||drive.google.com/uc?export=download&id=1le0k4iifbtutn31lollip2ndnjjzwu3t$all ||drive.google.com/uc?export=download&id=1lenovtgyahbqrmdh4gvidedxsqsxcqng$all ||drive.google.com/uc?export=download&id=1lfbieysyp7ecko2wk6a_dxosuhah5gko$all @@ -550917,6 +551030,7 @@ zzznan.com ||drive.google.com/uc?export=download&id=1uiek1-hkcz_kuautcbha5obu2wyaicjj$all ||drive.google.com/uc?export=download&id=1uij6fctuvcj5sqfiw_6k6tvzuyyr0qvz$all ||drive.google.com/uc?export=download&id=1uiqfiaaur7lq7kghcs3ek0rmgaqcqipi$all +||drive.google.com/uc?export=download&id=1uiymxywv0cam8b_bx3ifheiccdwrpsgl$all ||drive.google.com/uc?export=download&id=1uiypry6ez_orivyk4tvmdwyu4_tjjrkz$all ||drive.google.com/uc?export=download&id=1ujel8erdfkvprr1raazydwk6zt7oz17c$all ||drive.google.com/uc?export=download&id=1ujh009daen23wkjfrimopajys9egkz_q$all @@ -551089,6 +551203,7 @@ zzznan.com ||drive.google.com/uc?export=download&id=1vnrnjgf4nyvltipw_ami0pwriq385owf$all ||drive.google.com/uc?export=download&id=1vofmbumt47vaguwg3pofrgr-fcnncwqz$all ||drive.google.com/uc?export=download&id=1vol90krth76axaj0aec6buewa_gltmnl$all +||drive.google.com/uc?export=download&id=1voqnsh0cmxl5hty4zpc18pgnkud5rtvy$all ||drive.google.com/uc?export=download&id=1vp4zqvjtszxigadqtb-8xcgg41xwtq1o$all ||drive.google.com/uc?export=download&id=1vp7dvftbhbukky4gboj74otqegmterpy$all ||drive.google.com/uc?export=download&id=1vpbvepuxtchttkdn778iui6z0f3qb17j$all @@ -558362,6 +558477,7 @@ zzznan.com ||dropbox.com/s/3eouwywbww75819/firefox_67.3.49.js?dl=1$all ||dropbox.com/s/3gs4b28h0fwnu8n/document%23092372.zip?dl=1$all ||dropbox.com/s/3h6rm65zh1fxpma/view_presentation%23812016.zip?dl=1$all +||dropbox.com/s/3h8r4ocqh538jqb/gnl_309383_98484984_fil.ace?dl=1$all ||dropbox.com/s/3hcdcs4ry1onngu/job_presentation3-o4o%23739818.zip?dl=1$all ||dropbox.com/s/3j3s5bx0l92k26u/presentation%23028315.zip?dl=1$all ||dropbox.com/s/3jkdlvraflp3n4j/revised%20purchase%20order-1271.pdf.z?dl=1$all @@ -558394,6 +558510,7 @@ zzznan.com ||dropbox.com/s/3we3su2myn86btk/tesla%20test%20drive%20form_069.xlsm?dl=1$all ||dropbox.com/s/3xawa42sndz31d9/payment.exe?dl=1$all ||dropbox.com/s/3y14090hgs5m0sq/job_presentation-v8b%23499627.zip?dl=1$all +||dropbox.com/s/3yznspctui3k8zl/ma_i303987365367_39873663.dwg.z?dl=1$all ||dropbox.com/s/3z82nworc51b233/w.exe?dl=1$all ||dropbox.com/s/3zevj1sodcingo1/job_attach-a0y%23608602.zip?dl=1$all ||dropbox.com/s/3zjaltv8uar3icz/job_attach-o6o%23113013.zip?dl=1$all @@ -558782,6 +558899,7 @@ zzznan.com ||dropbox.com/s/8ucyd7r1qdi36dt/sale%20info_7696.doc?dl=1/$all ||dropbox.com/s/8ukquaz8h4xdx7n/presentation2-y3w%23946922.zip?dl=1$all ||dropbox.com/s/8uwp9x8u1rwysr9/presentation1-g6v%23145582.zip?dl=1$all +||dropbox.com/s/8v69kjai7vmvb40/acg_08376335_98tv.zdx.z?dl=1$all ||dropbox.com/s/8vcilbzyndbn5yi/job_presentation3-f5l%23783807.zip?dl=1$all ||dropbox.com/s/8vf1x8wwevbt6ys/job_presentation2-j8f%23856887.zip?dl=1$all ||dropbox.com/s/8vkcwcctx60hmo5/view_attach1-l1s%23332381.zip?dl=1$all @@ -559132,6 +559250,7 @@ zzznan.com ||dropbox.com/s/ch14in78gw2rhvu/document%23065239.zip?dl=1$all ||dropbox.com/s/ch7b5csbjb9pc7d/as_984498_04984498.xls.z?dl=1$all ||dropbox.com/s/chcld4b17zi0syr/view_presentation2-d4g%23742135.zip?dl=1$all +||dropbox.com/s/chpdzsp7nxbzh7n/ga_39848_3098559858tg.ace?dl=1$all ||dropbox.com/s/chqs02hqmmxw5gg/view_attach-t8k%23476796.zip?dl=1$all ||dropbox.com/s/chvagrgoasst0o6/job_attach1-b1q%23061922.zip?dl=1$all ||dropbox.com/s/cizaigubmr6oyoe/job_presentation%23985151.zip?dl=1$all @@ -559192,6 +559311,7 @@ zzznan.com ||dropbox.com/s/d42kueksf898va0/job_presentation2-j8f%23181888.zip?dl=1$all ||dropbox.com/s/d4bxv7inwn32lz2/swift_a09af.pdf.z?dl=1$all ||dropbox.com/s/d4iqffd15212s06/view_attach%23990300.zip?dl=1$all +||dropbox.com/s/d5efh42pwwz6j0g/tkas_9387635_93876353pmnb.ace?dl=1$all ||dropbox.com/s/d5gmgo0y48zfffu/presentation2-c6m%23417932.zip?dl=1$all ||dropbox.com/s/d5hx06nobawy5oo/job_attach%23751825.zip?dl=1$all ||dropbox.com/s/d67zrpka5ahro1e/my_presentation1-y5p%23783447.zip?dl=1$all @@ -559218,6 +559338,7 @@ zzznan.com ||dropbox.com/s/ddiu5wa7pu9pbbs/my_attach1-w3n%23509754.zip?dl=1$all ||dropbox.com/s/de7cvnotolldsry/my_presentation2-s5o%23937289.zip?dl=1$all ||dropbox.com/s/df3azbvw9jjp7st/job_attach2-q6k%23845555.zip?dl=1$all +||dropbox.com/s/dfcp3j7tx3jod54/nvc_039387367_03987783_remi.ace?dl=1$all ||dropbox.com/s/dfgnzlyx9tyqy73/psd_0398763pf_0398763.jpg.z?dl=1$all ||dropbox.com/s/dfku3gn9k792xcj/job_attach-m4j%23948073.zip?dl=1$all ||dropbox.com/s/dfytqktkuux7x8z/shipment_inv14012020_8349462174917197.zip?dl=1$all @@ -559822,6 +559943,7 @@ zzznan.com ||dropbox.com/s/iuhsc0w4lcrlxu1/job_attach3-j3a%23912834.zip?dl=1$all ||dropbox.com/s/iv3ntusd5ramxmm/view_presentation2-e5l%23020200.zip?dl=1$all ||dropbox.com/s/iw827thar5ojsmx/shipment_inv14012020_2117170331383099.zip?dl=1$all +||dropbox.com/s/iwijqd0727v498t/brd_039837635tr.xqd.z?dl=1$all ||dropbox.com/s/iwvd2hj1natp6x9/shipment_inv14012020_0622285188305203.zip?dl=1$all ||dropbox.com/s/ixzb0pn24kk8tkf/my_presentation1-d4r%23765170.zip?dl=1$all ||dropbox.com/s/iywgs1vgbluhwd7/view_attach2-m5m%23071565.zip?dl=1$all @@ -559830,6 +559952,7 @@ zzznan.com ||dropbox.com/s/j0hkz3yl0trmgo4/scan00121payment%20advice.pdf.z?dl=1$all ||dropbox.com/s/j0whqr8w70hyl81/my_attach-y2q%23418191.zip?dl=1$all ||dropbox.com/s/j0zlq5s3r0anso1/view_presentation-o8w%23103520.zip?dl=1$all +||dropbox.com/s/j1f32ta7ne2afpt/m0987655678_0098765456789.pdf.z?dl=1$all ||dropbox.com/s/j26bp911xqr9f49/presentation1-i8d%23940410.zip?dl=1$all ||dropbox.com/s/j2xpr3dy5thu2wr/quotation.zip?dl=1$all ||dropbox.com/s/j36iy9wmxvpkyhi/please%20quote.pdf.z?dl=1$all @@ -560211,6 +560334,7 @@ zzznan.com ||dropbox.com/s/o40cbmvywx9dvoh/shipment_inv14012020_42720565334420.zip?dl=1$all ||dropbox.com/s/o4ertlnxsqga5e1/my_presentation2%23076148.zip?dl=1$all ||dropbox.com/s/o4i7eo876zf2m2h/my_presentation1-y9c%23495955.zip?dl=1$all +||dropbox.com/s/o52jtgaurbr0psg/ga_39848_3098559858tg.xyz.z?dl=1$all ||dropbox.com/s/o5d4h3o8ny7mizb/job_attach-o2i%23251881.zip?dl=1$all ||dropbox.com/s/o5qrg7hha11t37f/invoice.zip?dl=1$all ||dropbox.com/s/o6e58l1m3xsxrby/scan_0023.pdf.z?dl=1$all @@ -560470,6 +560594,7 @@ zzznan.com ||dropbox.com/s/rlt9yeyuds5k957/my_attach-z3r%23383174.zip?dl=1$all ||dropbox.com/s/rmabkd6y1l83u25/view_attach1-q4t%23572679.zip?dl=1$all ||dropbox.com/s/rmo8rji173i1cat/q~20939876467_039876373.xls.z?dl=1$all +||dropbox.com/s/rmum3v29ojs3jjl/frg_039873653_0398736gb.xl.z?dl=1$all ||dropbox.com/s/rmw5gw1frkxegnd/document%23134519.zip?dl=1$all ||dropbox.com/s/rnhqz4sklt052q9/my_presentation-e5i%23917388.zip?dl=1$all ||dropbox.com/s/ro9loec8bdadiu6/outstandingpayment1.pdf.z?dl=1$all @@ -560487,6 +560612,7 @@ zzznan.com ||dropbox.com/s/rzqibz0q7ef37q4/job_presentation-u1o%23972507.zip?dl=1$all ||dropbox.com/s/s03fa34t6uob3h8/view_attach3-j7n%23364470.zip?dl=1$all ||dropbox.com/s/s07zqja5t5qb8kq/presentation1-p3c%23753652.zip?dl=1$all +||dropbox.com/s/s0irg599646bovm/dg~00856876789-99023467890.pdf.z?dl=1$all ||dropbox.com/s/s19lgurhguz8b01/shipment_inv14012020_641001405594.zip?dl=1$all ||dropbox.com/s/s23n0jjsjzy4wa8/po-280717888.zip?dl=1$all ||dropbox.com/s/s2yfo0ez7lq1ev7/shipment_inv14012020_8059855817809796.zip?dl=1$all @@ -561222,6 +561348,8 @@ zzznan.com ||ethecal.com/wp-admin/sites/pyl6j5aah_eottjcf-539345791934398/$all ||ethercredit.li/content/opcft63loqpowzjro7l8lnmrzeox2ujn49jnaqvdalwwcnn15453epdlfpeevtkkw/$all ||eu-central-1.protection.sophos.com/?d=shenovacengineers.com&u=ahr0cdovl3nozw5vdmfjzw5naw5lzxjzlmnvbs9jz2ktymlul3bhew1lbnqvotfuenjhl3eyaxjqd281mdazmta3mdc3mzi0nzk2otq2ehnrdtdndzb5zxnklw==&e=aw5mb0bpbmdlbmlldxjidwvyby13zw56zwwuzgu=&t=rfrkuwv2s2lmz2u5a21qdgfvt1fjv3lwowddexe0bjnruxu2ry9jqwp4nd0=&h=87530880db9148fc91a5d1ba1d0c8718/$all +||eu.wildfire.paloaltonetworks.com/panos/sample/cloud/wi9nuhhlykdoowr2yteyqkh4ulhluzrcqjhuudvqwxnhynbgrelsr2prsjjlk3zpq3bhoe1yqnbubnjsnvmxqlm0wmevevhttgpdr29fv0e1du9dv0w1vtzzwtzzl01srm1fugtwuwjjmwwrtusyzjfdmhpwbuthm0h5ectkekmvsexwvwprznnhbkq1wnddrepwv0fvrjvaznnicfdzszh0dflszw5samxnb0kybuvdykrstnf3dc9hwxl5l3l6/$all +||eu.wildfire.paloaltonetworks.com/report/box/bfc63aa44052b156fa742965595beb250276fbb18c6011d9f06f5b6059f336b7/19668968921/$all ||eurogemsis.com/wp-content/tudiwcascatbohuh8bxkre7ieqlw0jqqv7kt36spewqkasicvqqjfbe2tffh/$all ||ev-gach.ir/wp-content/hn6x1xp8meizqzsfoxdlpedzulypvq/$all ||evernote.com/shard/s392/sh/47936656-c057-4184-b7b7-0526c7f2b2c0/b6d09aeb71064244/res/be13f536-6f66-41c1-bb88-e605171d5644/$all @@ -561390,6 +561518,9 @@ zzznan.com ||files.fm/pa/good-doctor/rut-view.zip/rut-view.zip$all ||files.gamebanana.com/tools/enchanced_server_picker.exe$all ||files.gamebanana.com/tools/tagconverter.exe$all +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc$all +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc?n=w+eyvuwtgv3lkzjlt6xln7norq3nrqhnkiblilbluqyuzg9j$all +||files.hrloo.com/bbs/data/attachment/forum/201212/20/10301044ex3m3s62emr1r7.doc?n=weyvuwtgv3lkzjlt6xln7norq3nrqhnkiblilbluqyuzg9j$all ||files.jivosite.com/file-transfer/1621967/2021-03-16/55ec600e4e6500e080c5.doc$all ||files.lashawnbarber.com/$all ||files.lashawnbarber.com/elb.exe$all @@ -561539,12 +561670,19 @@ zzznan.com ||fullsizechevy.com/ups.com/webtracking/wnr-61311531662/$all ||futurereturn.in/wp-admin/personal-section/test-portal/ch0vusjb-ppi3w0ho38i/$all ||fv2-1.failiem.lv/down.php?cf&i=hyg2rxaa&n=new_payment.doc&download_checksum=afa67b9a5998eca281cda22f5585e9dcf764128a&download_timestamp=1547330846$all +||fv2-2.failiem.lv/down.php?cf&i=my59dhhv&n=2562.xls$all +||fv2-2.failiem.lv/down.php?cf&i=redm59qf&n=dfg-016.xls$all ||g.top4top.io/p_1466oo4nj1.jpg$all ||g.top4top.io/p_1697idvgm1.jpg/,/%25temp%25//svchost.exe$all ||g.top4top.io/p_1697idvgm1.jpg/,/%25temp%25/svchost.exe$all +||g1smurt.ru/6jiuu8934u.exe$all ||g2sportstech.com/wp-content/4relhjs1db3xwsiarvemf1onebwlcme9niapp4hhphg8lmvizzla6mglhacceosk9wz/$all ||gacetaeditorial.com/p/oknppmnzoakz5g4g8pqdfnhw3gcc1j7azzymresltw/$all ||gacetaeditorial.com/p/tykn/$all +||gade4senate.com/dfgg45g.exe$all +||gade4senate.com/m.dll$all +||gadebrigade.com/783s.exe$all +||gadeforussenate.com/163.exe$all ||gadgetbay.com/letsdeal/7o/$all ||gadgetbay.com/letsdeal/gdfjfq/$all ||gadgetbay.com/letsdeal/jon994gs2ivhlmfxedgxfpgwvabi4vzkytblmgq4na3bqqa5fsrf10/$all @@ -561729,7 +561867,6 @@ zzznan.com ||goldenbw.com/cgi-bin/omgx5xd6o10ims54itatycyhjrsn/$all ||goldentrading.com.bd/godrejlocks.com/emlb7cwe2ieyhneewg5vlef5zwvv4h5fta6cnnae2tiq6n0ksqhx2mqeeep/$all ||goldenyemen.com/wp-admin/inc/ruorw1w0odkqg/$all -||gomsuminhlongthainguyen.vn/wp-includes/statement/trb4t-2766-65677976-vlvfxh32a-yg8z93/$all ||goodnesspharmacy.in/blogs/fihqvgjr43nmp5mt6bd32aj7ymimuspne/$all ||gopherhole.com/7qrarjz/balance/5537267970601382/8sbaw26-0043997/$all ||gordon-and-son.com/content/inc/laljbjzxrefspp/$all @@ -561796,6 +561933,8 @@ zzznan.com ||guojiazui.com/b/y0qnnwbk/$all ||guridosinferno.s3.us-east-2.amazonaws.com/0.zip$all ||gurtravel.ge/rechnungs-details/$all +||h.top4top.io/p_14754cwzr1.jpg$all +||h.top4top.io/p_1593skpl71.jpg$all ||h8y9u9b2.ssl.hwcdn.net/apsfadexpnr/dynlink_1594433895121.exe$all ||hadaskatz.co.il/wp-content/uploads/etrac/ya9zp1bizd1m/$all ||hadaskatz.co.il/wp-content/uploads/protected-resource/test-portal/zebncmdzyp-mhrt3a3yjk9f/$all @@ -561872,12 +562011,165 @@ zzznan.com ||hilmagym.com/alden-s-ylxyau/rljs3s/$all ||hoangtuyen.com/wp-admin/548-9w-2672/$all ||hoarystarsmotorbike.com/wp-includes/payment/dhcltdzp/$all +||home.earthlink.net/~4winds1/dec3th.exe$all +||home.earthlink.net/~4winds1/imortantdocument.exe$all +||home.earthlink.net/~adminawg/usps/shipping-label/shipping-label(e-copy).jar$all +||home.earthlink.net/~archbarrett/adobe/0.37646700%201523567821.jar$all +||home.earthlink.net/~archbarrett/amazon-order-copy.jar$all +||home.earthlink.net/~archbarrett/donation/donation.jar$all +||home.earthlink.net/~archbarrett/dropbox/reference~ecopy.jar$all +||home.earthlink.net/~archbarrett/file2018.jar$all +||home.earthlink.net/~banderso1066/e~label.jar$all +||home.earthlink.net/~baysidejetdrive/shipment-label.jar$all +||home.earthlink.net/~bigrose26/12-21-2017.jar$all +||home.earthlink.net/~bigrose26/shipment/shipment-label.jar$all +||home.earthlink.net/~captaindiego/amazon/amazon.jar$all +||home.earthlink.net/~captaindiego/ecopy/ecopy.jar$all +||home.earthlink.net/~captaindiego/fedex/ecopy.jar$all +||home.earthlink.net/~captaindiego/fedex/fedex-shipping-label.jar$all +||home.earthlink.net/~captaindiego/software/ecopy.jar$all +||home.earthlink.net/~carwashregional/ship/ups~label.jar$all +||home.earthlink.net/~cathygrellet/data/saved/order.jar$all +||home.earthlink.net/~cathygrellet/dropbox/saved/artwork.jar$all +||home.earthlink.net/~cathygrellet/filemanager/order.jar$all +||home.earthlink.net/~cathygrellet/javto/print.jar$all +||home.earthlink.net/~cathygrellet/ship/info/usps%20order.jar$all +||home.earthlink.net/~craigbayhi/1-9-2018.jar$all +||home.earthlink.net/~craigslane/fedex-shipment~label.jar$all +||home.earthlink.net/~cvaleallen/delivery-report.jar$all +||home.earthlink.net/~cvaleallen/ups-shipping-details.jar$all +||home.earthlink.net/~cvaleallen/your-shipping-details.jar$all +||home.earthlink.net/~dalegibson/shipping-label.jar$all +||home.earthlink.net/~dalegibson/shipping_details.jar$all +||home.earthlink.net/~damturney/invoice/invoice_05122017_outputcca6aaf.scr$all +||home.earthlink.net/~damturney/invoice27112017/invoice_output68cf6b0.scr$all +||home.earthlink.net/~damturney/invoice27112017/newinvoice/invoice_04122017_output7bca030.scr$all +||home.earthlink.net/~damturney/specification/invoice04122017_output13026b0.scr$all +||home.earthlink.net/~davidtrojan/ups/ecopy.jar$all +||home.earthlink.net/~dcamjr/invoice20180205.exe$all +||home.earthlink.net/~dcmusicbox/usp/tracking~details.jar$all +||home.earthlink.net/~decalgene/ups_tracking.jar$all +||home.earthlink.net/~dvidmar1/shipment-label.jar$all +||home.earthlink.net/~ebony319/shippinglabel(e-copy).jar$all +||home.earthlink.net/~edclarkortho/label/e~label.jar$all +||home.earthlink.net/~edclarkortho/shipmentlabel.jar$all +||home.earthlink.net/~ellenweiss/new_message.jar$all +||home.earthlink.net/~ersinc/0.06213400%201521213842.jar$all +||home.earthlink.net/~ersinc/directory/ecopy.jar$all +||home.earthlink.net/~ersinc/ebay/ecopy00017717.jar$all +||home.earthlink.net/~ersinc/ecopy/ups.jar$all +||home.earthlink.net/~ersinc/order/order.jar$all +||home.earthlink.net/~ersinc/usps/order.jar$all +||home.earthlink.net/~fahertydoc/data/qrypted.janvy.jar$all +||home.earthlink.net/~fahertydoc/return-label.jar$all +||home.earthlink.net/~fahertydoc/usps~label.jar$all +||home.earthlink.net/~flajobs/e~label.jar$all +||home.earthlink.net/~flajobs/fedex/ecopy.jar$all +||home.earthlink.net/~flajobs/fedex~e~label.jar$all +||home.earthlink.net/~flajobs/shipment~label.jar$all +||home.earthlink.net/~freshourglen/5-2-2018.jar$all +||home.earthlink.net/~g.rhoads/dhl(view_shipping_label).jar$all +||home.earthlink.net/~g.rhoads/fedex/fedex.jar$all +||home.earthlink.net/~g.rhoads/ups(view-delivery-copy).jar$all +||home.earthlink.net/~georgejagels/usps-shipment-label.jar$all +||home.earthlink.net/~gouette/%20corel%20digital/%20license.jar$all +||home.earthlink.net/~gouette/data/license.jar$all +||home.earthlink.net/~gouette/docusign/documentfile.jar$all +||home.earthlink.net/~gouette/fedex/fedexcopy.jar$all +||home.earthlink.net/~gouette/invoice/document.jar$all +||home.earthlink.net/~gouette/trade/tradecopy.jar$all +||home.earthlink.net/~gouette/trade/tradecopy.zip$all +||home.earthlink.net/~grabanski/cve2017jar.zip$all +||home.earthlink.net/~itshq/usps_tracking.jar$all +||home.earthlink.net/~james.pender/shipping-label.jar$all +||home.earthlink.net/~jmzegan/your-order.jar$all +||home.earthlink.net/~joserealty/ecopy/ecopy.jar$all +||home.earthlink.net/~joserealty/webdocs/01/11-28-2017.jar$all +||home.earthlink.net/~joserealty/webdocs/02/11-30-2017.jar$all +||home.earthlink.net/~joserealty/webdocs/03/12-8-2017.jar$all +||home.earthlink.net/~kentscott4643/trk_fedex_46866461644881255.jar$all +||home.earthlink.net/~kmc2read/paypal/ecopy.jar$all +||home.earthlink.net/~kmc2read/ups/ups.jar$all +||home.earthlink.net/~ksak/fedex/shipping-label(e-copy).jar$all +||home.earthlink.net/~ksak/fedex/tobeused300.jar_javacrypt2.jar$all +||home.earthlink.net/~lorrainebubar/usps-shipping-label.jar$all +||home.earthlink.net/~loubill/ups.jar$all +||home.earthlink.net/~macjanutol/01-29-2019.jar$all +||home.earthlink.net/~macjanutol/01-29-20199.jar$all +||home.earthlink.net/~macjanutol/02-2-2019.jar$all +||home.earthlink.net/~macjanutol/cdv%20book%20k-2%20pag47.zip$all +||home.earthlink.net/~margolisme/12.16.17.jar$all +||home.earthlink.net/~margolisme/eopy/e-copy.jar$all +||home.earthlink.net/~michlee/trk_fedex_46866461644881255.jar$all +||home.earthlink.net/~mkramer65/dropbox_upgrade.jar$all +||home.earthlink.net/~mkramer65/fedex_shippinglabel.jar$all +||home.earthlink.net/~mkramer65/scan-copy.exe$all +||home.earthlink.net/~mnludvik/01-21-2019.jar$all +||home.earthlink.net/~mnludvik/1-21-2019.jar$all +||home.earthlink.net/~morrisonb/date/fedex.jar$all +||home.earthlink.net/~morrisonb/ecopy/fedex.jar$all +||home.earthlink.net/~morrisonb/softcopy/e-copy.jar$all +||home.earthlink.net/~narcisocortez/shipping_verification.1.0.1.1.1.1.0.jar$all +||home.earthlink.net/~ncfire/usps-shipping-label.jar$all +||home.earthlink.net/~ncgreen2/e-log.jar$all +||home.earthlink.net/~ngardels/112220188.exe$all +||home.earthlink.net/~ngardels/26112018.exe$all +||home.earthlink.net/~p3nd3r/shipment~label.jar$all +||home.earthlink.net/~p3nd3r/shipping-label.jar$all +||home.earthlink.net/~palmermusic/1-04-2018.jar$all +||home.earthlink.net/~peggylegault/june-25-2018.jar$all +||home.earthlink.net/~pepper12/shipping-label.jar$all +||home.earthlink.net/~pepper12/ups_invoice.jar$all +||home.earthlink.net/~pgregory2/ups/upstracker.jar$all +||home.earthlink.net/~phwilson/case_details.jar$all +||home.earthlink.net/~phwilson/e~label.jar$all +||home.earthlink.net/~phwilson/paypal_credit_info.jar$all +||home.earthlink.net/~prislen/ups_z10023838484.exe$all +||home.earthlink.net/~rclaws35/245646572983677974505708.jar$all +||home.earthlink.net/~rclaws35/61234567.jar$all +||home.earthlink.net/~rclaws35/package~label.jar$all +||home.earthlink.net/~rclaws35/re/shipment~label.jar$all +||home.earthlink.net/~rclaws35/shipment~label.jar$all +||home.earthlink.net/~roib/usps/usps~order~copy.jar$all +||home.earthlink.net/~roib/usps/usps~tracking~receipt.jar$all +||home.earthlink.net/~rsellsema/fedex/fedex.jar$all +||home.earthlink.net/~rsellsema/ups/ups.jar$all +||home.earthlink.net/~ruthtraa/shipment-label.jar$all +||home.earthlink.net/~rwhall38/01/3-28-2018.jar$all +||home.earthlink.net/~sallyhansen1/usps-shipment~label.jar$all +||home.earthlink.net/~sallyhansen1/usps_delivery.jar$all +||home.earthlink.net/~sherylhagen/usps-shipment-label.jar$all +||home.earthlink.net/~sherylhagen/usps~label.jar$all +||home.earthlink.net/~sidewinder4/comfirm(delivery-details).jar$all +||home.earthlink.net/~sidewinder4/ecopy/ups.jar$all +||home.earthlink.net/~sltdmd/ebay01.jar$all +||home.earthlink.net/~sltdmd/ups-shipping-label.jar$all +||home.earthlink.net/~suzystar/brief/invoice/order/ratata.qrypted.jar$all +||home.earthlink.net/~suzystar/cgggihfdyjojok/ecopy.jar$all +||home.earthlink.net/~suzystar/ecopy/e-copy.jar$all +||home.earthlink.net/~suzystar/pp/luv.qrypted.jar$all +||home.earthlink.net/~suzystar/ups~costomer~service.jar$all +||home.earthlink.net/~suzystar/usps-shipment-label.jar$all +||home.earthlink.net/~thfenner/shipping-label-ecopy.jar$all +||home.earthlink.net/~timstaacke/ecopy/ecopy.jar$all +||home.earthlink.net/~timstaacke/fedex(efile).jar$all +||home.earthlink.net/~tom12345678/return-label.jar$all +||home.earthlink.net/~tom12345678/shipment~label.jar$all +||home.earthlink.net/~tom12345678/shipping-label.jar$all +||home.earthlink.net/~twwjr/usps_delivery.jar$all +||home.earthlink.net/~vehanes/12-20-17.jar$all +||home.earthlink.net/~veteransmemorial/usps/trackingorder.jar$all +||home.earthlink.net/~wisebob/shipment~e~label.jar$all +||home.earthlink.net/~wisebob/shipping-label.jar$all +||home.earthlink.net/~youngcl/shipping-label101.jar$all +||home.earthlink.net/~zrippeto/invoice.jar$all +||home.earthlink.net/~zrippeto/order-comfirmation.jar$all +||home.earthlink.net/~zrippeto/pal/payment~details.jar$all ||homecass.com/wp-content/if/$all ||honeybearlane.com/epj71/tbtwanzjs/$all ||honeybearlane.com/wp-admin/n4o/$all ||honeynet.org/sites/default/files/files/1309361194_eschweiler_forensic_challenge_8.zip$all ||hostelpandasevas.ru/prediksi-togel-pu4tr/2f7dkue7adjvxi1kvm/$all -||hostimpel.com/js/q/$all ||hostingcloud.racing/7991.js$all ||hostvngiare.com/u179068337/uvclx146bn93au8uyyxxg/$all ||hotellizbeth.mx/cgi-bin/4ymek8o-wz0k2-65/$all @@ -562166,6 +562458,9 @@ zzznan.com ||khjhggfgbyj67ytfg.s3.us-east-2.amazonaws.com/jhgfd.exe$all ||khjhggfgbyj67ytfg.s3.us-east-2.amazonaws.com/oorrg.exe$all ||kiet.edu/blog/wp-content/uploads/2019/05/mur187.exe$all +||kilopaskal.ru/0203.bin$all +||kilopaskal.ru/0203s.bin$all +||kilopaskal.ru/6jhfa478.exe$all ||kimyen.net/upload/autopk.exe$all ||kimyen.net/upload/ctctanthu.exe$all ||kimyen.net/upload/loginctcus.exe$all @@ -562180,6 +562475,7 @@ zzznan.com ||kittycashonline.com/googlelib/4cb382d4qecna4io7eefimjaskzz1ijk4kziqoujdv/$all ||kkclassvip.com/wp-admin/pjce/$all ||klaksona2.net/_dump/buyy0zaa4vob1rf8ff0abcgsiggrypyxblfqamlrxag/$all +||klaustrofebia.ru/6jhfa478.exe$all ||kleberribeiro.com.br/wp-admin/payment/ehznl38duciepvo/q5/$all ||ko-racingshop.com/account-eu/y6w/$all ||kodjdsjsdjf.tk/mine.exe$all @@ -562343,10 +562639,6 @@ zzznan.com ||lgpass.com/images/common_resource/interior_cloud/637368803912_d35jil4kauy8qn/$all ||lgpass.com/images/d1q66rszmw123555/$all ||lgpass.com/images/wk128/$all -||library.mju.ac.th/2018/cfjdes/$all -||library.mju.ac.th/2018/mnnw0cr-ptv5a-370268/$all -||library.mju.ac.th/2018/rn-72c-0657/$all -||library.mju.ac.th/2018/zoipdun1a0/$all ||lidaautoparts.com/wp-admin/plcy4qz3/$all ||life-and-spice.com/uqvvclish1323826/rechnungs-docs/form/$all ||lifejordan.com/payment%20confirmation%20for%20over%20due%20invoices-191020gx.jar$all @@ -562389,12 +562681,13 @@ zzznan.com ||lullimyri.weebly.com/uploads/1/2/4/0/124043330/bee.exe$all ||lumina.it/wp-content/plugins/all-in-one-wp-migration/storage/client/invoice-978561$all ||lumina.it/wp-content/plugins/all-in-one-wp-migration/storage/client/invoice-978561/$all +||lumoura.com/0496giif/payroll/commercial$all +||lumoura.com/0496giif/payroll/commercial/$all ||luoyb.com/wp-includes/ruhbvqxwav/$all ||lusterconsultancy.com/unexterminated/lkwebnuq4kvxze/$all ||luxelistreviews.com/wp-includes/ayr/$all ||lvecarehomes.com/vvzjddpdllk/751057/employmentverification_751057_05062020.zip$all ||lvnskin.com/h/ib/$all -||lyllacarter.com/3578001584444_ycu75_resource/personal-box/interior-warehouse/arfilpvie-v6v1ws6tt/$all ||macexpertguide.com/wp-content/uploads/h5235/$all ||madame-coccinelle.fr/site/dll_rewiew.exe$all ||madame-coccinelle.fr/site/win_dll.exe$all @@ -562737,8 +563030,6 @@ zzznan.com ||mssql.4i7i.com/ms19.exe$all ||mssql.4i7i.com/mssql.exe$all ||mstr11.s3.us-east-2.amazonaws.com/dc090991001.zip$all -||mtdc.com.my/csm/mtdc_tenant/uploadedimages/file/o3xzk5h347jxshu8k73a66d4j0k087_aid8t27-174416710418/$all -||mtdc.com.my/csm/mtdc_tenant/uploadedimages/inc/erfrjwbgc5k/$all ||mtrack.me/tracking/rawzmz50pamkcgd3zwxkagv2zwhzmkwjqza2pzsaqar9agz2bgl4bqdmway2lku2pg0kamtkbgpjzqp0zsv$all ||muabannodanluat.com/wp-admin/2u8kbtjy3v0jqnk/jhknyauotia1/$all ||muabannodanluat.com/wp-admin/css/colors/kixtl8/$all @@ -562761,6 +563052,7 @@ zzznan.com ||myhub.autodesk360.com/ue2c34f1d/shares/download/file/sh56a43qtfd62c1cd96895e94cde31bd6bf2/dxjuomfkc2sud2lwchjvzdpmcy5mawxlonzmljryqvbzzlryu3jdm1btq2z6bu5sbhc_dmvyc2lvbj0x$all ||myhub.autodesk360.com/ue2c34f1d/shares/download/file/sh56a43qtfd62c1cd96895e94cde31bd6bf2/dxjuomfkc2sud2lwchjvzdpmcy5mawxlonzmljryqvbzzlryu3jdm1btq2z6bu5sbhc_dmvyc2lvbj0x%20e13d7143a29f3c2a_pcnamey.exe$all ||myhub.autodesk360.com/ue2cf7455/shares/download/file/sh7f1edqt22b515c761e461181d2507388bd/dxjuomfkc2sud2lwchjvzdpmcy5mawxlonzmlnfluhrkztmxuvhpbxzpmzvln05zamc_dmvyc2lvbj0x$all +||myinstabuzzz.co/6hyuyj.exe$all ||myphamjapan.com/dup-installer/db/$all ||mypostletter.com/wp-admin/g3/$all ||mypostletter.com/wp-admin/hsqqdgmpl/$all @@ -562881,6 +563173,9 @@ zzznan.com ||nuftp.com/site112/swift/swift/$all ||nusaindahjaya.com/wp-content/w8smsrt3fuudhtsyb3f0wyaial9c6mvgxtlug9gbbqlnr7qlrqemhuqwnbcgnyw9z5/$all ||nvcsps.com/en_us/corporation/copy_invoice/vrfm-kaqqe_a-j0z/$all +||nvgeeforsegt.ru/0303.bin$all +||nvgeeforsegt.ru/0303s.bin$all +||nvgeeforsegt.ru/6jhfa478.exe$all ||nxcvjksdhiougfhiosdgfsgdfohsoidfhc16c.s3.us-east-2.amazonaws.com/p-16-5.dll$all ||nxtfdata.xyz/cl.exe$all ||nxtfdata.xyz/cl2.exe$all @@ -563026,6 +563321,8 @@ zzznan.com ||onedrive.live.com/download?%20cid=6bf4bc82222119f1&resid=6bf4bc82222119f1%21146&authkey=adpxoamsqubznpo$all ||onedrive.live.com/download?%20cid=86515363ec4e1d86&resid=86515363ec4e1d86!230&authkey=acct5emtpwqk2pk$all ||onedrive.live.com/download?%20cid=86515363ec4e1d86&resid=86515363ec4e1d86%21230&authkey=acct5emtpwqk2pk$all +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc!1431&authkey=afbifi7o9ywbjpm$all +||onedrive.live.com/download?%20cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$all ||onedrive.live.com/download?&resid=81445407a9f44d37!197&authkey=apuz15kftzlrysa$all ||onedrive.live.com/download?&resid=81445407a9f44d37!198&authkey=ags5rgb15_esaqq$all ||onedrive.live.com/download?&resid=b4c15a27928f663b!229&authkey=aiarm61fwmd_npe$all @@ -563283,9 +563580,17 @@ zzznan.com ||onedrive.live.com/download?cid=208d58450f73ce00&resid=208d58450f73ce00%21121&authkey=ac_pc9_txxg1knu$all ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21184&authkey=ae6l_lmeqbcwqs4$all ||onedrive.live.com/download?cid=208dce306fa91736&resid=208dce306fa91736%21185&authkey=abpinbsiqu9kj0c$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!112&authkey=afjxmbcllibdbvo$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!113&authkey=afgwn8crgexgr9i$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba!114&authkey=adecqvkvvvadznc$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21112&authkey=afjxmbcllibdbvo$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21113&authkey=afgwn8crgexgr9i$all +||onedrive.live.com/download?cid=20bb12e82cb1e8ba&resid=20bb12e82cb1e8ba%21114&authkey=adecqvkvvvadznc$all ||onedrive.live.com/download?cid=20dee8b81c08a987&resid=20dee8b81c08a987%21298&authkey=aj9kqwsgcfz-_hs$all ||onedrive.live.com/download?cid=2156ca1e52db3c63&resid=2156ca1e52db3c63!133&authkey=aoandx4a2on7qms$all ||onedrive.live.com/download?cid=2156ca1e52db3c63&resid=2156ca1e52db3c63%21133&authkey=aoandx4a2on7qms$all +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8!330&authkey=apiugomnim7heom$all +||onedrive.live.com/download?cid=216ef243e34992b8&resid=216ef243e34992b8%21330&authkey=apiugomnim7heom$all ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!105&authkey=!absbumceicuzi2o$all ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!108&authkey=!ajhg3v4jcff7_ja$all ||onedrive.live.com/download?cid=21757e11f03b2792&resid=21757e11f03b2792!109&authkey=!anhbzybkg3mekig$all @@ -563386,6 +563691,10 @@ zzznan.com ||onedrive.live.com/download?cid=2a486306c325f908&resid=2a486306c325f908%21111&authkey=affiexy2cqzci_et1$all ||onedrive.live.com/download?cid=2a486306c325f908&resid=2a486306c325f908%21113&authkey=ahqsrzlqf0ufb-w$all ||onedrive.live.com/download?cid=2a4a2d5d947e1370&resid=2a4a2d5d947e1370%21108&authkey=amv_prbtm21h9cw$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!287&authkey=advpfy_0ry8upmi$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b!288&authkey=aembucxemjjo3bk$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21287&authkey=advpfy_0ry8upmi$all +||onedrive.live.com/download?cid=2a56f979f12efc6b&resid=2a56f979f12efc6b%21288&authkey=aembucxemjjo3bk$all ||onedrive.live.com/download?cid=2ad47a1c2578bc9d&resid=2ad47a1c2578bc9d!109&authkey=!aimagsabj48hkvc$all ||onedrive.live.com/download?cid=2ad9152585a10979&resid=2ad9152585a10979%21263&authkey=ajckc28yc3ipv20$all ||onedrive.live.com/download?cid=2b099f9549ffb495&resid=2b099f9549ffb495%21120&authkey=abiwvt9gevnrdko$all @@ -563643,6 +563952,7 @@ zzznan.com ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21137&authkey=ai0mrummy_5dvngl$all ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21139&authkey=aizxtnwpadmihus$all ||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21141&authkey=aazwaw2xjms24o0$all +||onedrive.live.com/download?cid=46de06f83c43e1aa&resid=46de06f83c43e1aa%21145&authkey=aaenjqj018fjmc0$all ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa!450&authkey=ahw0j-cme0jg6pw$all ||onedrive.live.com/download?cid=470febb155be50fa&resid=470febb155be50fa%21450&authkey=ahw0j-cme0jg6pw$all ||onedrive.live.com/download?cid=47366308b4485d1f&resid=47366308b4485d1f!122&authkey=acz6efuryflte_u$all @@ -563796,6 +564106,7 @@ zzznan.com ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21270&authkey=anrpgfgppanni2m$all ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21282&authkey=ahmiyfvsdq29oyct$all ||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21306&authkey=aax3ppfvza6zr2y!w$all +||onedrive.live.com/download?cid=4f8c6df2ff2783f8&resid=4f8c6df2ff2783f8%21316&authkey=aglr8gaawuvqnr4$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21104&authkey=ah1rwakpsbjkvg8$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21105&authkey=ajkwu0e9dzantl8$all ||onedrive.live.com/download?cid=5012a067b5dec1df&resid=5012a067b5dec1df%21107&authkey=apd9um4_12-kpe0$all @@ -564029,6 +564340,8 @@ zzznan.com ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21130&authkey=anw-ddr7601fex8$all ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21133&authkey=ajujzgibyp0njn4$all ||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21138&authkey=abl76arjzra98i8$all +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21139&authkey=ainfmzrjpezd0cq$all +||onedrive.live.com/download?cid=61089708cbad1277&resid=61089708cbad1277%21140&authkey=anjlipyo6j89w6s$all ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b!330&authkey=akerwhui2attmd0$all ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b!332&authkey=alf8w-tcidmmiaw$all ||onedrive.live.com/download?cid=612a2b99a1fba35b&resid=612a2b99a1fba35b%21330&authkey=akerwhui2attmd0$all @@ -564466,9 +564779,11 @@ zzznan.com ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21106&authkey=akfcfq3zq5oof2i$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21108&authkey=amfbkmapqbvzpvk$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21110&authkey=aov1iwhtxtdchie$all +||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21114&authkey=aootzdl0ufej408!w$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21115&authkey=aigiblfwx-m-sf0$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21117&authkey=akq2ufr3rag9vrw$all ||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21118&authkey=agbhxyxdkrvcvo0$all +||onedrive.live.com/download?cid=89360b4c7415c088&resid=89360b4c7415c088%21119&authkey=ai2fryyoppe4_hm$all ||onedrive.live.com/download?cid=896080f2b56fcb9c&resid=896080f2b56fcb9c%21105&authkey=aathdxz2aww0jkm$all ||onedrive.live.com/download?cid=8983011c6ecfb1d8&resid=8983011c6ecfb1d8%21132&authkey=ah0vja7wpyfjj84$all ||onedrive.live.com/download?cid=89c2283e219d084b&resid=89c2283e219d084b%21715&authkey=al6csxgxuywk1bs$all @@ -564496,6 +564811,8 @@ zzznan.com ||onedrive.live.com/download?cid=8ca507baa15fdb5c&resid=8ca507baa15fdb5c%21184&authkey=aeek7ofguvsjqwe$all ||onedrive.live.com/download?cid=8d14d74eb13b02d0&resid=8d14d74eb13b02d0%21158&authkey=angcyyr-keximec$all ||onedrive.live.com/download?cid=8d14d74eb13b02d0&resid=8d14d74eb13b02d0%21165&authkey=ak9xkr3bswk3pso$all +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43!148&authkey=apxflxvdsy-q71y$all +||onedrive.live.com/download?cid=8d4fc9be60d8bd43&resid=8d4fc9be60d8bd43%21148&authkey=apxflxvdsy-q71y$all ||onedrive.live.com/download?cid=8db649572ecd3a9a&resid=8db649572ecd3a9a%21235&authkey=akc-pr82u6uhq3o$all ||onedrive.live.com/download?cid=8db649572ecd3a9a&resid=8db649572ecd3a9a%21255&authkey=ameysz-ajuakv_i$all ||onedrive.live.com/download?cid=8e778d4a23c91a07&resid=8e778d4a23c91a07%21109&authkey=amsqkmfaht5lg9s$all @@ -564775,6 +565092,7 @@ zzznan.com ||onedrive.live.com/download?cid=aca36329f96145e7&resid=aca36329f96145e7%21108&authkey=aig30xmo50hun6s$all ||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21111&authkey=aczey5fkpwajy-a$all ||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21114&authkey=afetsliuakyqj5a$all +||onedrive.live.com/download?cid=ad0a4bf4c53dfec5&resid=ad0a4bf4c53dfec5%21115&authkey=ap7w_ryx7dsh--4$all ||onedrive.live.com/download?cid=ad9ac90c6da9c574&resid=ad9ac90c6da9c574!202&authkey=ajnelcik0ivjcvm$all ||onedrive.live.com/download?cid=ae1f8ba4b67f2e7b&resid=ae1f8ba4b67f2e7b%21111&authkey=aoudc31yiw3xahw$all ||onedrive.live.com/download?cid=ae28961c75435487&resid=ae28961c75435487%21106&authkey=alph5awcis8r9iw$all @@ -564880,6 +565198,7 @@ zzznan.com ||onedrive.live.com/download?cid=b9e0bf86d3bee8e7&resid=b9e0bf86d3bee8e7%21182&authkey=abo_l9b2wjewd5w$all ||onedrive.live.com/download?cid=b9e0bf86d3bee8e7&resid=b9e0bf86d3bee8e7%21189&authkey=agaoq4of9yuqxqe$all ||onedrive.live.com/download?cid=b9f97974937af42d&resid=b9f97974937af42d%21183&authkey=apzbr8b3xgtai1y$all +||onedrive.live.com/download?cid=ba02d68febf523dc&resid=ba02d68febf523dc%211431&authkey=afbifi7o9ywbjpm$all ||onedrive.live.com/download?cid=bada6e9b193308e5&resid=bada6e9b193308e5!107&authkey=ajyxxwmnlvllxc8$all ||onedrive.live.com/download?cid=bada6e9b193308e5&resid=bada6e9b193308e5%21115&authkey=aohc9j6cj1s-dp4$all ||onedrive.live.com/download?cid=badaf4192eeddcdc&resid=badaf4192eeddcdc!3724&authkey=agywwcss9tb9x5g$all @@ -564943,6 +565262,7 @@ zzznan.com ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214200&authkey=adqtju8i3nmlgai$all ||onedrive.live.com/download?cid=c121261804708478&resid=c121261804708478%214201&authkey=ahqber27s7gg8kk$all ||onedrive.live.com/download?cid=c1bc60e9d8507226&resid=c1bc60e9d8507226%21146&authkey=afqh6zg990rdk7w$all +||onedrive.live.com/download?cid=c29fdbf45b3d2671&resid=c29fdbf45b3d2671%21608&authkey=aafwhzmybg1czta$all ||onedrive.live.com/download?cid=c2f597e8f3af4bc2&resid=c2f597e8f3af4bc2%2164846&authkey=aocl-frlas3c6v4$all ||onedrive.live.com/download?cid=c333554726f00e84&resid=c333554726f00e84%21242&authkey=adizb0tcuo6pvxm$all ||onedrive.live.com/download?cid=c359b1a8babc6019&resid=c359b1a8babc6019!1251&authkey=act34eizpzjugfa$all @@ -565340,7 +565660,9 @@ zzznan.com ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21139&authkey=an3wktzxopu6ktq$all ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21140&authkey=ag-kppl_uvownco$all ||onedrive.live.com/download?cid=ef04dd7f0a6a5f7c&resid=ef04dd7f0a6a5f7c%21142&authkey=aad-nuysvlhc-i4$all +||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8!124&authkey=anbjbhqwzwajouc$all ||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8%21108&authkey=anmpeqm9gm_zv9m$all +||onedrive.live.com/download?cid=ef7cc06ce7ffafb8&resid=ef7cc06ce7ffafb8%21124&authkey=anbjbhqwzwajouc$all ||onedrive.live.com/download?cid=efa0769fcf42dbd8&resid=efa0769fcf42dbd8%21108&authkey=ab3oob0eydsxowg$all ||onedrive.live.com/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!202&authkey=ah1gjq8j29darw4$all ||onedrive.live.com/download?cid=efdf2c8d834a1928&resid=efdf2c8d834a1928!203&authkey=af8xr99mrqp8um8$all @@ -565549,6 +565871,10 @@ zzznan.com ||onemart.vn/wp-content/sites/eyagc81443753061rnbmv6gd1lbfqd/$all ||onetechsolution.com.vn/wp-content/grnejymqpgvgevx2lqt3e6/$all ||onlineprojectdemo.net/nationsroofing/file/u0ose5k5vtij3iq0pcj51ba8jr7_xxaqjk-9587131473/$all +||onlybamboofabrics.com/2601.bin$all +||onlybamboofabrics.com/2701.bin$all +||onlybamboofabrics.com/2701s.bin$all +||onlybamboofabrics.com/6gdwwv.exe$all ||onlyinnovate.com/wp-admin/awm8wo1utjbcl/$all ||onmovie.pl/wp-admin/5zp1us/$all ||onvictinitor.com$all @@ -571761,6 +572087,9 @@ zzznan.com ||protect-us.mimecast.com/s/7ihcc82oqycqx96qh15qw5$all ||protect-us.mimecast.com/s/c27ac0rx9ru80p3fw0bgj$all ||protect-us.mimecast.com/s/qki9c73wxjupxq5ps8qcm_$all +||protect.mimecast-offshore.com/s/ip17cn9blzfnq4n4h4tudd?domain=meraqsa.com/$all +||protect.mimecast-offshore.com/s/loqwcg5rvpcjndxqc76apn?domain=ronakfence.ir/$all +||protect.mimecast-offshore.com/s/rd0zcjqxyvf8w6o3igppxq?domain=ronakfence.ir/$all ||protect2.fireeye.com/v1/url?k=59eacb3c-0560e9d5-59ed97de-0cc47ad93e2e-0f5e34e79adab692&q=1&e=e7991bbc-cc93-4814-a8f2-fd6d6950b0d5&u=https%3a%2f%2fwww.mediafire.com%2ffile%2fs2uyxs8t8kbuyye%2fdocumentos_de_env%25cdo.7z%2ffile$all ||protect2.fireeye.com/v1/url?k=6d0c09d2-33bdd2b2-6d0f7943-86e2237f51fb-ab55eb53c2dfee1f&q=1&e=358c9b57-d351-4b0f-80cf-d0755ec21127&u=https://pottershousedurban.co.za/cgi-bin/file/xzbx0cb5wywuw5/179vj6b9dpsp7advozp/$all ||prowestappraisal.com/ms-t/xqgkotgvdwhezypdfhwvwrjfe/$all @@ -571796,7 +572125,6 @@ zzznan.com ||qualcommmedia.com/wp-includes-old/m4/$all ||qualcommmedia.com/wp-includes-old/rw1/$all ||qualirent.com.gt/cgi-bin/browse/sslqg7obhzzy/$all -||quatangtaynguyen.vn/egw5/inc/ixgcfpguvzhumrl/$all ||quatria.com.br/wp-includes/ognrrpmkvytptywuw3l7zpko6negtnixjybbiouc7hhshjpow/$all ||quaxel2.net/v1/t/c/ac95f29a-4b23-8bed-a80c-19848f03d48c/outlk:97b7fdec-1450-4311-b9e5-698749862d93/irespond@financeofamerica.com/https://laminingraphics.co.za/wp-admin/etrac/$all ||quaxel2.net/v1/t/c/ac95f29a-4b23-8bed-a80c-19848f03d48c/outlk:97b7fdec-1450-4311-b9e5-698749862d93/irespond@financeofamerica.com/https:/laminingraphics.co.za/wp-admin/etrac/$all @@ -572010,6 +572338,7 @@ zzznan.com ||rgho.st/download/6nnmwrj65/e2fd966cb90832c49db58889a5bce7fa7eb6f67c/e2fd966cb90832c49db58889a5bce7fa7eb6f67c/fornite%20hack%202018.exe$all ||riparazioni-radiotv.com/softaculous/dzz/$all ||rnecentre.ru/content/xgun3q94phpvv6mk8y66ajrmvpstvt/$all +||roanokemortgages.com/6lhjgfdghj.exe$all ||robvanderwoude.com/updates/caldemo.txt$all ||rodrigoresende.com.br/toad-for-gdyb4/4od0hogwmrneuw1l6/$all ||rogerbaulenas.com/j/z96x/$all @@ -572452,7 +572781,6 @@ zzznan.com ||slpsrgpsrhojifdij.ru/o.exe$all ||slpsrgpsrhojifdij.ru/p.exe$all ||slpsrgpsrhojifdij.ru/t.exe$all -||slsbearings.com.sg/en/corporation/cdiih-tcjn3_vdroc-dsx/$all ||smartgrocerysl.com/content/dlm/$all ||smartitventures.com/671295aysj/biz/smallbusiness$all ||smartpresence.id/wp-includes/blocks/overview/$all @@ -572519,6 +572847,7 @@ zzznan.com ||srishtiherbs.com/jms/pages/907ukpinvdw7qoe/$all ||srishtiherbs.com/jms/payment/eamg/$all ||srishtiherbs.com/jms/uwld9lewozrneutvcgdxaz7mbs/$all +||sromecorlduce.ru/6sfsgfsgqwert.exe$all ||srv-file9.gofile.io/download/zw9mex/oms_financial.support.measurespdf.vbs$all ||srv-store4.gofile.io/download/g3fddj/virus.exe$all ||srv-store4.gofile.io/download/y3yzhk/payload.exe$all @@ -574194,6 +574523,7 @@ zzznan.com ||sulselekspres.com/test777/a/$all ||sunchipaint.com.vn/wp-admin/document/dawb84xl_piuu2as-9919296896/$all ||suncitycarrental.com/ingersoll-rand-7qtka/8jhka7zy/$all +||sungardspo.com/6lhjgfdghj.exe$all ||super-registry.s3.eu-central-1.amazonaws.com/installc_sh_directly.exe$all ||superbeaute.ca/wp-content/nachrichten/nachprufung/de_de/04-2019/$all ||superdomain1709.info/c4fxp3oiuoyf.67w$all @@ -574297,7 +574627,6 @@ zzznan.com ||theculturetrip.ru/d/wlx7lgpigfeok8fjokrvmdt7dfaywyl855h9qwh7hakd8rv1dlcgipmgn/$all ||thedarkweb.biz/wp-includes/gm8javj0nrwxybccdn466vcymzev/$all ||thedesirelife.com/wp-content/microsoft.net/$all -||thefrees.com/.docs/jtvrvznswjba/nbar_6606_29052020.zip$all ||thegioiso24g.com/wp-admin/t60acsmswu/$all ||thegoat.in/auk.php$all ||thejanimal.com/contact_send/tckgsyljg42nev62/$all @@ -574341,7 +574670,6 @@ zzznan.com ||tikkunafrica.org/bjudvojuopvc/565719007/nbsa_565719007_28052020.zip$all ||tikkunafrica.org/bjudvojuopvc/nbsa_7421_28052020.zip$all ||timelinerentals.com/content/vigjqqqio27ngpjciew4npr5/$all -||timenow.pw/api/files/stub.exe$all ||tingchaojianxin.com/shouqian/a7wzljw8se/$all ||tingchaojianxin.com/shouqian/maliq0crqi/$all ||tingchaojianxin.com/shouqian/overview/8344/fwkxhp/$all @@ -574418,6 +574746,9 @@ zzznan.com ||trueapparels.com/a/4k/$all ||trueapparels.com/a/bodojlil7zineh/$all ||truemerit.io/databases/merit.php$all +||trustpilot-scam.com/1612.bin$all +||trustpilot-scam.com/1612s.bin$all +||trustpilot-scam.com/32453.exe$all ||ts-prod-assets.tripleseat.com.s3.amazonaws.com/assets/006/920/181/morph_hospitality_inquiry.doc?1528110432$all ||ts-prod-assets.tripleseat.com.s3.amazonaws.com/assets/006/920/226/morph_hospitality_inquiry.doc?1528110892$all ||ts-prod-assets.tripleseat.com.s3.amazonaws.com/assets/006/920/272/morph_hospitality_inquiry.doc?1528111216$all @@ -574437,7 +574768,6 @@ zzznan.com ||ts-prod-assets.tripleseat.com.s3.amazonaws.com/assets/009/485/756/thevillagepub.doc?1545218354$all ||ts-prod-assets.tripleseat.com.s3.amazonaws.com/assets/009/486/201/thevillagepub.doc?1545223316$all ||ts-prod-assets.tripleseat.com.s3.amazonaws.com/assets/010/943/655/inv11533395908.doc?1553863076/$all -||tsapparel.com.my/fd66e6.php$all ||tsg339.com/invoice/$all ||tsrv4.ws/23.exe$all ||tsuburaya-prod.co.jp/wp-content/plugins/wp-ogp/sa.exe$all @@ -574629,6 +574959,19 @@ zzznan.com ||u.teknik.io/zrnp7.txt$all ||u.teknik.io/zsmdk.txt$all ||u.teknik.io:443/n42bg.exe$all +||u1.huatu.com/fuzhou/2012/6yue/20120626009_hlq.rar$all +||u1.huatu.com/guizhou/fujian/wendang/2012071006.rar$all +||u1.huatu.com/guizhou/fujian/wendang/2012082801.rar$all +||u1.huatu.com/guizhou/fujian/wendang/2012102205.rar$all +||u1.huatu.com/henan/2012-08/2012bishi.rar$all +||u1.huatu.com/henan/201211/121127054744.rar$all +||u1.huatu.com/jinan/fujian/%e4%b8%b4%e6%9c%90%e6%9a%91%e6%9c%9f%e6%95%99%e5%b8%88%e7%ac%94%e8%af%95%e6%88%90%e7%bb%a9.rar$all +||u1.huatu.com/jinan/fujian/20130710153845754ba1c09b3695e0.rar$all +||u1.huatu.com/nmg/20120716001.rar$all +||u1.huatu.com/tianjin/201212/20131218zwb_tjxds.rar$all +||u1.huatu.com/wuhu/fujian/201205/20120522104242271.rar$all +||u1.huatu.com/wuhu/fujian/20120507110444635.rar$all +||u1.huatu.com/wuhu/fujian/20120814113927927.rar$all ||u2752257.ct.sendgrid.net/wf/click?upn=4llwqy7bcwok6ck4fq-2fa5lpwfd6y-2b1nvij13u8fv2-2fwaeqhrmyo-2fijybx7mg7quk2reucnz9jbdsuewaz7sdvbtbgut7pczk3ajj1qg7v6k-3d_4jfias-2fx23byq2x2lx0ffs7qczla5f1baandjgpkvv7wr8hmre-2fup91-2bamksbt92zjnis3rzxvaa5mwkvughbu-2bnjh91zrtlj5ss85jutkxeqagi9batupuq6-2fc97je2dfmdfbsxpkrlzjpgxhqpxp-2ff21lhuscbu26xs5garj3ov4pfx0w8tugrgjsiaqqojbr4ji7rh9ur7suxb2-2fj-2fq-3d-3d$all ||u2752257.ct.sendgrid.net/wf/click?upn=4llwqy7bcwok6ck4fq-2fa5lpwfd6y-2b1nvij13u8fv2-2fwnpt0z59t-2b5sb7o2dwemisytjrws0xqtv5gqyn4uhn9j-2bwj0xcciosn8ompjuhwio-3d_ablk4d9y6jxb75fcpulw9h44zy01oxpdr7yzz-2bpnj-2flpw054tb8yjrclr5rzaqjqjizatzgsfvsohaxd-2fbjbkshsolxqo4ycsvt0w-2beofu3ktqu2nl-2fzd9eabmlekg8x-2fvgzfnyfrayj-2bujs80oo2iqimkcitedgdwb6d8ep4scilqnphaob8xu2hmjgbvedvgsahkvxyr-2fjcjsocgcw0q-3d-3d$all ||u2752257.ct.sendgrid.net/wf/click?upn=4llwqy7bcwok6ck4fq-2fa5lpwfd6y-2b1nvij13u8fv2-2fwsxwjnosfhdr9o9p9b-2f0ny6u6ydjks1sj0rzg8ltfmejtoedrw05vziu6xbuwcqqy-3d_ablk4d9y6jxb75fcpulw9h44zy01oxpdr7yzz-2bpnj-2fn5bwcdhzigxnm9vr61xt14dg9eswsttaul0-2fsc1br-2bosjj0qtrjplvm8hgrcnajspcw429mpbyy6s8-2b3fphqohs-2bvdjtz2gok9wj5akzgiybao4l6iaeu2c2ftssso-2buyag3isfiidagv7bejmftc19aamtlibjkx51-2f3aozbsmg-3d-3d$all @@ -575179,6 +575522,7 @@ zzznan.com ||urldefense.proofpoint.com/v2/url?u=http-3a__www.noelportelles.com_acuerdos-2d07_&d=dwmfaq&c=-nidxp95v38whwnfcom0huicxh-zv-kamxwytub8tka&r=f0qlnmvt4h0nwhscbkmzens5pw6nb16ectkdmouq3rg&m=h6onp5vzujslfrkq8uluja-svkxy727zj0hv6bgi7kg&s=_giuui9mytwjmdqu0aojwj59ycacwqnzlfvb1g055lm&e=/$all ||urldefense.proofpoint.com/v2/url?u=http-3a__www.sindquimsuzano.com.br_payment_zzn34252g_aug-2d07-2d2018-2d4493466_hul-2dgsmu&d=dwmgaq&c=zwy66qcyutyucoev9c2gldeckuykzowdvnr_l93z9mq&r=niwg9z1drtcbkwjfypvhoyqckwxpvcuznakuz4s8tqi&m=dvgau9m2j67nnjvwqltpdwr1secpedjmnf6k8tdvhce&s=bcniagjeltt_ln_3efp3jjggw-kxw0a1v5wthm1wysi&e=$all ||urldefense.proofpoint.com/v2/url?u=http-3a__www.sx-2dzj.net_default_us-5fus_doc_hri-2dmonthly-2dinvoice_&d=dwifaq&c=eugzstcatdllvimen8b7jxrwqof-v5a_cdpgnvfiimm&r=ftodw-zjb1u6omhnvdnv5xpe4nk-1jws78c28vgfogapkvxv5mlulnefw3g60a0o&m=qs8izqf3b77bbbv4ce5xetvb_lj3d6tp8yc7h7b_j_4&s=hgfffu7ph5qurvwxahcnjcn8_j3-kc-vy2u6javehtq&e/$all +||urldefense.us/v2/url?u=http-3a__facanha.com.br_temp_parts-5fservice_s9baz8isbijg0xhd7z0n_&d=dwmfaq&c=qtsr2lo3xh19jsonxq96-b_j2zkvnyyojwvjnv4r9is&r=iouefzkkvlfqwzcan5qausnvmpi9hiz9pebs6ko1o94&m=gyxbuywhcwmdgd9tipsfye4sd4mhyexdiwsgp_6fkhg&s=qoq4llc83hmmkungnrsxiof9m8vzk0asnj8uej2oiaq&e=/$all ||us-west-2.protection.sophos.com/?d=live.com&u=ahr0chm6ly9vbmvkcml2zs5saxzllmnvbs9kb3dubg9hzd9jawq9rku4ndy0q0zbnzk0reezmszyzxnpzd1grtg0njrdrke3otreqtmxjtixmzkwjmf1dghrzxk9qvbbrgprznitbkvnnlk4&e=c2fszxnac2vydmljzxrocmvhzc5jb20=&h=1803547f4c89428aa593c931d1c99564&t=c3h2nw1abxdwnnhrcnddrhk5mstra1krcfq5n1dlvhlzzvnvnzazakw5dz0=$all ||us15.campaign-archive.com/pages?u=cd5e2bf0aa684eff0aeb54377&id=030032cee1f0$all ||us2.campaign-archive.com/pages?u=035496fc182d3cf5353219b28&id=03009ec6e1f0$all @@ -575201,20 +575545,10 @@ zzznan.com ||users.telenet.be/rudisb/public_html/cgi-bin/run.sh$all ||users.telenet.be/rudisb/public_html/cgi-bin/xmrig$all ||usrubber.com/wp-admin/0in/$all +||ussbd.net/content/scan/271459/ojyq8by38-28/$all +||ussbd.net/wp-admin/scan/xlhuy5brujs4c4sbq/$all ||utenti.info/1.exe$all ||utenti.live/1.exe$all -||uyen.vn/rxmln/06521/servicecontractagreement_06521_04292020.zip$all -||uyen.vn/rxmln/0944160/servicecontractagreement_0944160_04292020.zip$all -||uyen.vn/rxmln/719658340/servicecontractagreement_719658340_04292020.zip$all -||uyen.vn/rxmln/92790700/servicecontractagreement_92790700_04292020.zip$all -||uyen.vn/rxmln/servicecontractagreement_23932918_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/192074507/servicecontractagreement_192074507_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/26862161/servicecontractagreement_26862161_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/30940317/servicecontractagreement_30940317_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/80951402/servicecontractagreement_80951402_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/899028826/servicecontractagreement_899028826_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/servicecontractagreement_127640399_04292020.zip$all -||uyen.vn/wp-content/uploads/2020/04/uvgnwigmi/servicecontractagreement_22521330_04292020.zip$all ||uzkon.com.tr/wp-admin/zzbi71rw0idiacknh4ul059zb8kterjhvfilc1ecvn8/$all ||vaidapt.s3.amazonaws.com/0.zip$all ||valquathailand.com/300rzdxjpah/wire/personal$all @@ -575354,6 +575688,7 @@ zzznan.com ||worm.ws/32.exe$all ||worm.ws/avv.exe$all ||worm.ws:8080/winsysdrv.exe$all +||wouatiareves.ru/6hy67438ue.exe$all ||woweasily.com/accounts/webbrowser.php$all ||wowsoftware.weebly.com/uploads/6/0/1/3/60131139/spell_checker_64bit.exe$all ||woyodev.org/doc/us/outstanding-invoices$all @@ -575396,6 +575731,7 @@ zzznan.com ||xn--tkrw6sl75a3cq.com/xn0hw/attachments/$all ||xn--tkrw6sl75a3cq.com/xn0hw/esp/jcfqltt-8492799152-002052-71rbfn13w3-wfu4/$all ||xn--tkrw6sl75a3cq.com/xn0hw/payment/$all +||xnxxfullhd.com/wp-admin/nak/$all ||xorbr.s3.amazonaws.com/az235.jpg$all ||xorbr.s3.amazonaws.com/az240.jpg$all ||xorbr.s3.amazonaws.com/azz35.jpg$all @@ -575430,6 +575766,16 @@ zzznan.com ||yeknam.com/blog/wp-content/themes/calliope/beads/5972191.zip$all ||yeknam.com/blog/wp-content/themes/calliope/previous/5344565.zip$all ||yellomosquito.com/wp-includes/w/$all +||yeumoitruong.vn/install/cqblnc/$all +||yeumoitruong.vn/install/document/$all +||yeumoitruong.vn/install/esp/gkh96px4g19/$all +||yeumoitruong.vn/install/esp/gkh96px4g19//$all +||yeumoitruong.vn/install/esp/gkh96px4g19///$all +||yeumoitruong.vn/install/lm/k9238129131598300n5b5sb4mhqb/$all +||yeumoitruong.vn/install/tbn/$all +||yeumoitruong.vn/src/09j/$all +||yeumoitruong.vn/src/attachments/kryx1iotp3u/$all +||yeumoitruong.vn/src/invoice/2m1r3dh36j/$all ||yiqixue.site/depict.php$all ||yongian.com/kwolq5u5.zip$all ||yougile.com/user-data/3b4be708-0db9-4c34-b270-4082a3908053/report-review26-10.exe$all