Blocklist of hostnames and domains for blocking ads, trackers and others (format: snort -- for use with Snort)

[ view the list in a different format | about this list | view the blocklist of IP addresses ]
blocklist last updated: Tue, 09 Apr 2024 21:21:54 GMT

listing ad servers added after: Fri, 06 Jun 2003 00:00:00

format list is displayed in: snort -- for use with Snort

total entries: 3735 / 3735
[ hide this header (view the list on its own) ]
# List of hostnames for use with Snort
#
# For more information about this list, see: https://pgl.yoyo.org/adservers/
# ----
# last updated:   Tue, 09 Apr 2024 21:21:54 GMT
# entries:        3735
# format:         snort (snort -- for use with Snort)
# credits:        Peter Lowe - pgl@yoyo.org - https://pgl.yoyo.org/ - https://twitter.com/pgl
# this URL:       https://pgl.yoyo.org/as/serverlist.php?hostformat=snort
# Patreon:        https://patreon.com/blocklist
# other formats:  https://pgl.yoyo.org/adservers/formats.php
# policy:         https://pgl.yoyo.org/adservers/policy.php
#
# start date:    Fri, 06 Jun 2003 00:00:00
alert tcp  any $HOME_NET any (msg:"1-1ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"101order.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"180hits.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"180searchassistant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"1link2020.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"1rx.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"207.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"24log.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"2mdn.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"2o7.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"2znp09oa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"30ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"3337723.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"33across.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"360yield.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"3lift.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"3o9s.short.gy"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"4info.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"4jnzhl0d0.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"5mcwl.pw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"6ldu6qa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"6sc.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"777partner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"77tracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"7bpeople.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"7cnq.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"7search.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"82o9v830.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.mktw.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.muloqot.uz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.sakh.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.vartoken.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.vfghd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.vfgtb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a135.wftv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"a5.overclockers.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aa-metrics.beauty.hotpepper.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aa-metrics.recruit-card.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aa-metrics.trip-ai.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aaddzz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aax-eu-dub.amazon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aaxads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abackafterthought.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abackchain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abandonedaction.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abc-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ablink.comms.trainline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ablink.news.emails-puregym.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ablinks.mail.hinge.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aboardlevel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abruptroad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"absentstream.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"absorbingband.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"absorbingcorn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abstractedauthority.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"absurdwater.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"abtasty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ac.rnm.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"acemlnb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"acid-adserver.click"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"acridtwist.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actionsplash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actonsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actuallysheep.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actuallysnake.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"actuallything.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"acuityads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"acuityplatform.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-balancer.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-balancer.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-cupid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-delivery.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-pay.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-score.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-server.gulasidorna.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-space.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.abcnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.abctv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.admitad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.allboxing.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.amgdgt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.anuntis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.auditude.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.bitmedia.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.bizo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.bondage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.cgi.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.choiceradio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.digitallook.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.domainfactory.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.exyws.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.foxnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.grafika.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.gt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.hbv.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.hodomobile.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.hyena.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.infoseek.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.intl.xiaomi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.jacotei.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.lgappstv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.liveinternet.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.lupa.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.mediastorm.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.mg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.musicmatch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.myapple.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.mynetreklam.com.streamprovider.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.nachtagenten.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.nettvservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.nttnavi.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.nwt.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.period-calendar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.profiwin.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.reachlocal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.simflight.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.style"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.tapthislink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.technoratimedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.tv2.no"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.universcine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.wavu.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.xiaomi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.xmovies8.si"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad.ztylez.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad0.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad01.mediacorpsingapore.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad1.emule-project.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad1.kde.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.lupa.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.netriota.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.nmm.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad2.xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad3.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad3.xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad4mat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad4mat.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ad4mat.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adabra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adaction.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adalliance.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adanging.blog"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adap.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adapt.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adaranth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbilty.me"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adblade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adblade.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adblockanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbroker.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbunker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbuyer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adbuyer3.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcampo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcannyads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcast.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcel.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcell.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adclixx.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcolony.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcontent.gamespy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcovery.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adcycle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"add.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adeimptrck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adetracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adexc.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adexchangegate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adexchangeprediction.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adexpose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adext.inkclub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adfeed.marchex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adforce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adform.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adform.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adformdsp.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adgardener.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adhese.be"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adhese.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adhigh.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adhoc4.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adhunter.media"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.been.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.carsoup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.homestore.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.omroepzeeland.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimg.com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimg.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adingo.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adition.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adition.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adizio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjug.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjuggler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjust.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adjustnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adk2.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adland.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlightning.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adloox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlooxtracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adlure.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adm.fwmrm.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admagnet.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adman.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adman.otenet.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admanagement.ch"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admanager.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admanager.carsoup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admanmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admantx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admarvel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admaster.com.cn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admatchly.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admeridianads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admeta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admidadsp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adminder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admix.in"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admixer.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admized.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admob.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"admonitor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adn.lrb.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnami.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnetasia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnetwork.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnetworkperformance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnews.maddog2000.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnium.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnxs-simple.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adnxs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adocean.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adonspot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adoptum.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adoric-om.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adotmob.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adpepper.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"adperium.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adpia.vn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adplus.co.id"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adplxmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adprofits.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adpushup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrazzi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adreactor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adreclaim.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrecover.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrecreate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adremedy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrevolver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adriver.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrolays.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrotate.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrotic.girlonthenet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adrta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-backend.chaincliq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-bilek.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-click.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-dev.pinterest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-game-187f4.firebaseapp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-kesselhaus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-trk.vidible.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads-twitter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.365.mk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.4tube.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.5ci.lt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.73dpi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.a-snag-smartmoney.fyi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.aavv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.aceweb.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.acpc.cat"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.acrosspf.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.activestate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adfox.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.administrator.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adred.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adsbtc.fun"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adstream.com.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.advance.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.alive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.alt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.amdmb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.amigos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.annabac.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.apn.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.as4x.tmcs.ticketmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bb59.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.belointeractive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.betfair.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bigchurch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bluemountain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.boerding.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.boylesports.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.casinocity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.casumoaffiliates.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cbc.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cc"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cheabit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.citymagazine.si"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.clasificadox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.co.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.colombiaonline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.comeon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.contactmusic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.cybersales.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.dada.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.dailycamera.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.deltha.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.desmoinesregister.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.detelefoongids.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.devmates.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.doit.com.cn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.dtpnetwork.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.eagletribune.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.edbindex.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.elcarado.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.electrocelt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.elitetrader.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.emdee.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.emirates.net.ae"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.epi.sk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.eu.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.expat-blog.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fastcomgroup.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fasttrack-ignite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.faxo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.femmefab.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ferianc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.financialcontent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.flooble.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.footymad.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.forbes.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.formit.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.fotosidan.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.foxnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gamigo.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gaming-universe.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gaming1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.getlucky.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gld.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.goyk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gplusmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gradfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.grindinggears.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.gsmexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.guardian.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.guru3d.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hbv.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.horsehero.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.hsoub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ibryte.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.imagistica.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.independent.com.mt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.infi.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.internic.co.il"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ipowerweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.itv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.jewishfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.jobsite.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.justhungry.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kabooaffiliates.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kaktuz.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kelbymediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kinxxx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.kompass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.krawall.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.leovegas.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.lesbianpersonals.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.liberte.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.lifethink.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.linkedin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.livenation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.lordlucky.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ma7.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mail.bg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.massinfra.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mcafee.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mediasmart.es"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.medienhaus.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.meetcelebs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mmania.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mobilebet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.multimania.lycos.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.muslimehelfen.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.mvscoelho.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.myadv.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nccwebs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ndtv1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.networksolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newgrounds.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newsint.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nj.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nordichardware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nordichardware.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nyx.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.nzcity.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.okcimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ole.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.oneplace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.opensubtitles.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.optusnet.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.outpersonals.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.oxyshop.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.paymonex.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pexi.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pfl.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pinterest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.planet.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pni.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.pof.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.powweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ppvmedien.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.printscr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.program3.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.psd2html.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.quoka.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.radialserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.radio1.lv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.recoletos.es"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.revjet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.samsung.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.saymedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.schmoozecom.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.scifi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.servebom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.sexgratuit.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.sift.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.simplyhired.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.sjon.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.socialtheater.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.soweb.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.stackoverflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.sun.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.suomiautomaatti.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.syscdn.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tahono.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.themovienation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.thestar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.thrillsaffiliates.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tiktok.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.todoti.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.toplayaffiliates.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.travelaudience.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.trinitymirror.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.es"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tripod.lycos.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.twitter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.twojatv.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.ultimate-guitar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.uncrate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.unison.bg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.uxs.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.v-lazer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.verticalresponse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.vgchartz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.virtuopolitan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.vnumedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.walkiberia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.watson.ch"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.webinak.sk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.webmasterpoint.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.websiteservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.whoishostingthis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wiezoekje.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wineenthusiast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.wwe.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.xhamster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.xtra.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yap.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yldmgrimg.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.youtube.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads.yumenetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1-adnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.mediacapital.pt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.rne.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads1.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads10.speedbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads180.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.contentabc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.femmefab.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.hsoub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.net-communities.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.rne.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.techads.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.webdrive.no"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2.xnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads2004.treiberupdate.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads24h.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads3.contentabc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads3.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads3.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads4.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads4.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads5.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads6.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ads7.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsafeprotected.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsatt.abcnews.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsby.bidtheatre.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsbydelema.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adscale.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adscience.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsco.re"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsdk.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsend.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsensecustomsearchads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserve.ams.rhythmxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserve.gkeurope.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserve.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserve.jbs.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.adverty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.anawe.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.ariase.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.bdoce.cl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.betandwin.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.bizedge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.break-even.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.cams.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.cdnstream.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.cherryfind.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.diariodosertao.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.echdk.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.generationiron.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.hwupgrade.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.ilango.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.industryarena.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.info7.mx"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.irishwebmasterforum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.janes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.kontent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.lecool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.mobi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.msmb.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.news.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.nydailynews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.omroepzeeland.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.otthonom.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.pampa.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.piksel.mk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.portugalmail.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.pressboard.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.sciflicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.scr.sk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.smgfiles.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.theonering.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.trojaner-info.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.tupolska.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.virginmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver.waggonerguide.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver01.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver1.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserver2.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserverplus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserverpub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserverxxl.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adservetx.media.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adservice.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adservice.google.com.mt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adserving.unibet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adservingfront.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adservrs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adservrs.com.edgekey.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsfactor.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsfeed.brabys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adshrink.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adside.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsiduous.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adskeeper.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adskeeper.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adskpak.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmartracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmetadata.startappservice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsmogo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsnative.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsolut.in"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adspeed.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adspirit.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adspredictiv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adspsp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsroller.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv.eacdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv.iol.co.za"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv.kobi.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv.moebelmarkt.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrv2.swidnica24.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsrvr.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adstacks.in"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adstanding.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsupply.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adswizz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsxyz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsys.townnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adsystem.simplemachines.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adt598.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtech-digital.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtech.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtechjp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtechus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtegrity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adthis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adthrive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtilt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtng.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtology.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtoma.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtrace.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtrack.voicestar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtraction.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adtriplex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adultadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv-adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.cooperhosting.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.donejty.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.hwupgrade.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.mpvc.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.nexthardware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.wp.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adv.yo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advangelists.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adventurousamount.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advert.bayarea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advert.dyna.ultraweb.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adverticum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertiseireland.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertisementafterthought.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertiserurl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertisingbox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertmedia.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertpro.ya.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advideo.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adview.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advisormedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adwebone.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adwhirl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adworx.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adworx.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adx.gayboy.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adxpansion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adyea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adyoulike.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adz.rashflash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adz2you.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzbazar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzerk.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzerk.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzestocp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"adzrevads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aerserv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"af-ad.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affec.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affili.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.rusvpn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliate.treated.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatefuture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.allposters.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.babylon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.digitalriver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.globat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.streamray.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.thinkhost.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.thrixxx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliates.ultrahosting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatetracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatetracking.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliatewindow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"affiliation-france.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"afftracking.justanswer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"afraidlanguage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"agkn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"agreeablestew.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ahalogy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aheadday.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aim4media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"airpush.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aistat.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ak0gsh40.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alchemist.go2cloud.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alenty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alertafterthought.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"algorix.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aliasanvil.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alikeaddition.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alipromo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"all4spy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alluringbucket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aloofmetal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aloofvest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"alphonso.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"als-svc.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"amazingcounters.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"amazon-adsystem.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ambiguousquilt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ambitiousagreement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"americash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics-production.hapyak.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.adpost.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.algoepico.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.bitrix.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.cloudron.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.cohesionapps.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.emarketer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.ext.go-tellm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.htmedia.in"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.icons8.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.inlinemanual.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.jst.ai"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.justuno.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.lucid.app"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.mailmunch.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.mobile.yandex.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.momentum-institut.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.myfinance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.ostr.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.phando.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.picsart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.pinterest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.pointdrive.linkedin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.poolshool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.posttv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.samdd.me"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.santander.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.shorte.st"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.swiggy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.tiktok.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.xelondigital.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analytics.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"analyticsapi.happypancake.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ancientact.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"androiddownload.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"angossa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aniview.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"annonser.dagbladet.no"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"annoyedairport.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"annoyingacoustics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"anrdoezrs.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"anstrex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"anuncios.edicaoms.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"anxiousapples.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api.amplitude.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api.eu.amplitude.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api.iterable.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api.kameleoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api.lab.amplitude.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api.rudderlabs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"api2.amplitude.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"apolloprogram.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"app-analytics-v2.snapchat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"app-analytics.snapchat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"app-measurement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"app.pendo.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"app2.salesmanago.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"apparatuslip.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"appboycdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"appmetrica.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"appsflyer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aps.hearstnp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"apsalar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"apture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"apu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aquaticanswer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aquaticowl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ar1nvz5.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aralego.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"archswimming.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ard.xxxblackbook.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"argyresthia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aromamirror.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"artisany.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"as.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"as2.adserverhd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aserv.motorsgate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"asewlfjqwlflkew.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aso1.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aswpapius.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aswpsdkus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"at-adserver.alltop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"at-o.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"atdmt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ato.mx"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"attractionbanana.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"attractiveafternoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"attribution.report"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"auctionads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aud.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"audience.media"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"audience2media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"audienceinsights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"augur.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"auto-bannertausch.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"automaticflock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avalonalbum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avazutracking.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"avocet.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"awakebird.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"awempire.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"awstrack.me"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"awzbijw.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"axiomaticalley.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"axonix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ay.delivery"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"aztracking.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"b-s.tercept.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"b.videoamp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"b3.videoamp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ba.afl.rakuten.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"balloontexture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banik.redigy.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.ambercoastcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.buempliz-online.ch"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.cotedazurpalace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.coza.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.elisa.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.eurogrand.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.finzoom.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.goldenpalace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.inyourpocket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.linux.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.media-system.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.nixnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.noblepoker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.rbc.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.reinstil.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner.titan-dsl.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banner10.zetasystem.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerconnect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannergrabber.internet.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerlandia.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannermall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannermanager.bnr.bg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannermarkt.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.amigos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.babylon-x.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.cams.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.clubseventeen.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.czi.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.dine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.direction-x.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.getiton.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.payserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.resultonline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.sys-con.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.thomsonlocal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"banners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannersng.yell.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannertesting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannertrack.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannery.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bannieres.wdmedia.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"barbarousnerve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"baremetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"barnesandnoble.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"basebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"basketballbelieve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"baskettexture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bat.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"batbuilding.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bawdybeast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bbelements.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"beachfront.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"beacon.gu-web.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"beacons.gcp.gvt2.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"beacons.gvt2.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"beamincrease.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bebi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"beemray.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"begun.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"behavioralengine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"belstat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"belstat.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"benefits.sovendus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"benfly.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"berp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bespoke.iln8.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bestboundary.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bestbuy.7tiv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bewilderedblade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bfmio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bhcumsc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bid.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidbarrel.cbsnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidclix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidr.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidsopt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidswitch.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidtellect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bidvertiser.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"big-bang-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bigreal.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bikesboard.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"billboard.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"birthdaybelief.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bitmedianetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bizible.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bizographics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bizzclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bkrtx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blingbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blockadblock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogherads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogtoplist.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blogtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blueadvertise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blueconic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blueconic.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bluelithium.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bluewhaleweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blushingbeast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blushingboundary.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"blushingbread.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bm.annonce.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bnrs.ilm.ee"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boffoadsapi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boilingbeetle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boilingumbrella.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bongacash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boomads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boomtrain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boredcrown.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boringcoat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"boudja.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bounceads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bounceexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bowie-cdn.fathomdns.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bpath.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bpu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brand-display.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brandreachsys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brandybison.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"braze.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"breadbalance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"breahant.site"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"breakableinsurance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"breaktime.com.tw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brealtime.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"briefstem.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brightcom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brightinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"brightmountainmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"broadboundary.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"broadcastbed.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"broaddoor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"broadstreetads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"browser-http-intake.logs.datadoghq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"browser-http-intake.logs.datadoghq.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"btglss.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"btrll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bttrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bucketbean.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"businessbells.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bustlinganimal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"buzzonclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"c1exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"c212.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cabledemand.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cakesdrum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"calculatingcircle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"calculatingtoothbrush.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"calculatorcamera.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"calculatorstatement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"call-ad-network-api.marchex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"callousbrake.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"callrail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"calmcactus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"calypsocapsule.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"campaign.bharatmatrimony.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"caniamedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"capablecows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"capriciouscorn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"captainbicycle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"carambo.la"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"carbonads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"carbonads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"caringcast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"carscannon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cartstack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"carvecakes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casalemedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cash4members.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cash4popup.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashcrate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashengines.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashfiesta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cashstaging.me"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casinopays.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casinorewards.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cattlecommittee.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"causecherry.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cautiouscredit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.bannerflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.branch.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.freshmarketer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.heapanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.keywee.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.mouseflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.onesignal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.scarabresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdn.segment.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cdnondemand.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ceciliavenus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cedato.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"celtra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"centerpointmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cetrk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cgicounter.puretec.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chairscrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chargecracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chart.dk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chartbeat.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chartboost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"checkm8.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"checkstat.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cheerfulrange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cherriescare.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chewcoat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chickensstation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"childlikecrowd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chinsnakes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chitika.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"chubbycreature.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"citrusad.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cityads.telus.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cjbmanagement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cjlog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cl0udh0st1ng.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clarifyverse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clck.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clevernt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.airmalta-mail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.aliexpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.allkeyshop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.bkdpt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.cartsguru.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.cision.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.classmates.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.comm.rcibank.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.digital.metaquestmail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.discord.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.e.bbcmail.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.e.progressive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.e.zoom.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.em.blizzard.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.email.bbc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.email.microsoftemail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.email.sonos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.email.strawberry.no"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.emails.argos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.hookupinyourcity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.hooligapps.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.i.southwesternrailway.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.infoblox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.justwatch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.kmindex.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.mail.hotels.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.mail.salesforce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.mailing.ticketmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.mkt.grab.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.news.vans.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.nl.npr.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.nvgaming.nvidia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.redditmail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click.twcwigs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"click360v2-ingest.azurewebsites.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickagents.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickbrokers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickcease.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickcompare.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickdensity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickfuse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickmate.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickonometrics.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicks.deliveroo.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicks.eventbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicks.mods.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicks.monzo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktag.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktrack.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktrack.ziyu.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktracks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clicktrade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickyab.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clientgear.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clientmetrics-pa.googleapis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clikerz.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cliksolution.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clixgalore.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clk1005.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clk1011.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clk1015.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clkrev.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clksite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cloisteredcord.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cloisteredhydrant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"closedcows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cloudflareinsights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clrstm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cluster.adultworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"clustrmaps.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cmp.dmgmediaprivacy.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cmvrclicks000.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cnomy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cnt.spbland.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cnt1.pocitadlo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cny.yoyo.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"codeadnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cognitiv.ai"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cointraffic.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"coldbalance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"collector-dev.cdp-dev.cnn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"collector.cdp.cnn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"comfortablecheese.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"commindo-media-ressourcen.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"commonswing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"communications.melitaltd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"comparereaction.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"compiledoctor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"completecabbage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"complextoad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"comprabanner.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"concernedchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"concernedcondition.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"conditionchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"conductrics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"connatix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"connectad.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"consciouschairs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"consciouscheese.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"consensad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"consensu.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"contadores.miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"content.acc-hd.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"content.ad"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"content22.online.citi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"controlcola.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"converge-digital.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"conversantmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"conversionbet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"conversionruler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"convertingtraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"convrse.media"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cootlogix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"copperchickens.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"copycarpenter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"copyrightaccesscontrols.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"coremetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cosmosjackson.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"count.west263.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.cnw.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.dreamhost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.mirohost.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.mojgorod.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.search.bg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counter.snackly.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"counting.kmindex.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"coupling-media.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"coxmt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cozyhillside.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpays.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpx-traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpx.to"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crabbychin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"craktraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crashchance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crashlytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crashlyticsreports-pa.googleapis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cratecamera.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crawlability.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crawlclocks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crazyegg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crazypopups.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"creatives.livejasmin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crimsonmeadow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"criteo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"criteo.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"critictruck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crowdedmass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crsspxl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crta.dailymail.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crypto-loot.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"crystalboulevard.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cs.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cumbersomecloud.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"curtaincows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"curvedsquirrel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cushiondrum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"customad.cnn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"customads.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"customers.kameleoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cutcurrent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cutechin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cutecushion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cuteturkey.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cxense.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"d-collect.jennifersoft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"d-collector.jennifersoft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"d.adroll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"d1f0tbk1v3e25u.cloudfront.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"d2cmedia.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"d81mfvml8p5ml.cloudfront.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dabiaozhi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dacdn.visualwebsiteoptimizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dacdn.vwo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dakic-ia-300.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"damageddistance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"damdoor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dancemistake.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dangerouswinter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dapper.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dapperfloor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dashingdirt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dashingsweater.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"data.namesakeoscilloscopemarquis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"data8a8altrk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"daughterstone.com"; classtype:trojan-activity; priority:1;)
alert tcp 10.0.0.1 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"deadpangate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dealdotcom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"debonairway.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"debtbusterloans.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"decenterads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"decisivebase.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"decisivedrawer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"decisiveducks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"decknetwork.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"decoycreation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"deepintent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"delegatediscussion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"delicatecascade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"deloplen.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"deloton.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"demandbase.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"demdex.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"deployads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"desertedbreath.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"desertedrat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"desiredirt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"detailedglue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"detailedgovernment.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"detectdiscovery.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dev.visualwebsiteoptimizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dewdroplagoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dianomi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"digestiondrawer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"digital-ads.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"digitalmerkat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"direct-events-collector.spot.im"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"discreetfield.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dispensablestranger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"disqusads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"distillery.wistia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"distributionneck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"districtm.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"districtm.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dk4ywix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dmp.mall.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dmtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dmtracking.alibaba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dmtracking2.alibaba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dnsdelegation.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"do-global.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dockdigestion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dogcollarfavourbluff.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"domdex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dotmetrics.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dotomi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubleclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubleclick.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doublepimp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubleverify.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"doubtfulrainstorm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dpbolvw.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dpu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dq95d35.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"drabsize.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dragzebra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"drumcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"drydrum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dsp.colpirio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dsp.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dstillery.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dustyhammer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dustywave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"dyntrk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e-m.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e-planning.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e.kde.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"e37364.dscd.akamaiedge.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eadexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"earthquakescarf.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"earthycopy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eas.almamedia.fi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"easyhits4u.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ebayadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ecircle-ag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ecleneue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eclick.vn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eclkmpbn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eclkspbn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"economicpizzas.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"edaa.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"edgexads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"efficaciouscactus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ejyymghi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elasticchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elderlyscissors.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elderlytown.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elephantqueue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elitedollars.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"em1.yoursantander.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"email-link.adtidy.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"email-link.adtidy.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"email-links.crowdfireapp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"email-open.adtidy.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"email-open.adtidy.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"email.mg1.substack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emaillinks.soundiiz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emebo.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emerse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emetriq.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emjcd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emltrk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emodoinc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emptyescort.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"emxdigital.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"encourageidea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"encouragingwilderness.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"endurableshop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"energeticladybug.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"engage.tines.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"engage.windows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"engagebdr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"engageya.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"engineertrick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"enormousearth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ensighten.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"enthusiasticdad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"enviousthread.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"epom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"epp.bih.net.ba"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eqads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eqy.link"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"erne.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"estat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"esty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"et.educationdynamics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"et.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"etahub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"etargetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"etracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"etracker.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eule1.pmu.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eulerian.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eurekster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eusta.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"evadav.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"evadavdsp.pro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eventexistence.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"events-eu.freshsuccess.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"events-us.freshsuccess.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"everestads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"everesttech.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"evergage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eversales.space"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"evs.sgmt.loom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"evyy.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exampleshake.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exchange-it.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exclusivebrass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exelate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exelator.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exhibitsneeze.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exit76.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exitfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exoclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exosrv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"experianmarketingservices.digital"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"explorads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exponea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"exponential.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"express-submit.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"extractobservation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"extreme-dm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"extremetracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyeota.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyeviewads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ezula.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"f7ds.liberation.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fabric.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"facilitategrandfather.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fadedprofit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fadedsnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fairfeeling.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fallaciousfifth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fam-ad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"famousquarter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"farethief.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"farmergoldfish.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fascinatedfeather.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fast-redirecting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fastclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fastclick.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fastly-insights.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"faultycanvas.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"faultyfowl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fave.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fc.webmasterpro.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"feathr.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"feebleshock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"feedjit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"feedmob.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"findcommerce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fineoffer.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fingahvf.top"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fireworkadservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fireworkanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fireworks-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"firstlightera.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"firsttexture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fixedfold.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flairadscpc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flakyfeast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flexbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flimsycircle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flimsythought.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"floodprincipal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"floweryflavor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"flurry.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fly-analytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"foo.cosmocode.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"foresee.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"forkcdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"forwrdnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fourarithmetic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fpctraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fpjs.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fqtag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"frailflock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"free-counter.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freecounterstat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freeskreen.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freewheel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freewheel.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freezingbuilding.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"frequentflesh.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"freshrelevance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"frightenedpotato.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fronttoad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"frtyj.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"frtyk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fullstory.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"functionalcrown.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"functionalfeather.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"funklicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"funnelytics.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"furryfork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fusionads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fusionquest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"futuristicapparatus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"futuristicfairies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"futuristicfifth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"futuristicframe.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fuzzybasketball.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fuzzyflavor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fuzzyweather.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fvl1f.pw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fwcdn1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fwcdn2.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ga.clearbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gadsbee.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"galaxien.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"game-advertising-online.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gamesites100.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gammamaximum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gaug.es"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gavvia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gearwom.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"generateoffice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"geo.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"geobanner.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"georiot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"geovisite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"getclicky.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"getintent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"getmyads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"giddycoat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"glisteningsign.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"globalismedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"globaltakeoff.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gloriousbeef.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"glossysense.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gloyah.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gmads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gml.email"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go-mpulse.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go.dhs.gov"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go.eu.sparkpostmail1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go.icann.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go.scmagazine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go.usa.gov"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go.xlirdr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"go2affise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gondolagnome.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"google-analytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"googleadservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"googleanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"googletagmanager.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"googletagservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gorgeousground.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gostats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gothamads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gotraffic.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gp.dejanews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gracefulsock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"graizoah.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"grandfatherguitar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"grapeshot.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"greetzebra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"greyinstrument.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"greystripe.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"grouchybrothers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"groundtruth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gscontxt.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gstaticx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"guardeddirection.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"guardedschool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"gunggo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"h-bid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"h0.t.hubspotemail.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"h78xb.pw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"habitualhumor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"halcyoncanyon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"haltingbadge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hammerhearing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"handsomehose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"handyfield.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"handyfireman.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"handyincrease.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"haplesshydrant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hardtofindmilk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"harrenmedianetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hb.afl.rakuten.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hb.vntsm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hbb.afl.rakuten.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hbopenbid.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hdscout.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"heap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hearinglizards.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hellobar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"helpcollar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hentaicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"herbalaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hexcan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hexusads.fluent.ltd.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"heyos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hf5rbejvpwds.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hfc195b.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hgads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"highfalutinroom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hilariouszinc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"histats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"historicalrequest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hit-parade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hit.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hit.webcentre.lycos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitbox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitcounters.miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitometer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits-i.iubenda.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.europuls.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.puls.lv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.sh"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits.theguardian.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hits4me.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hitslink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hlok.qertewrt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hocgeese.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hollowafterthought.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"homelycrown.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"homepageking.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"honeygoldfish.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"honorablehall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"honorableland.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hostedads.realitykings.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hotjar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hotrank.com.tw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hoverowl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hs-analytics.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hs-banner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hsadspixel.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hsleadflows.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hsn.uqhv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"htlbid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hubadnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hubspotlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hueads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hueadsortb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hueadsxml.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hurtteeth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hyperbanner.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hypertracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hyprmx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hystericalcloth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"hystericalhelp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"i-i.lt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"i1media.no"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"i305175.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ia.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iadnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iasds01.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ibillboard.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"id5-sync.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"idealadvertising.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"idevaffiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"idtargeting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ientrymail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iesnare.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ilbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ilead.itrack.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"illfatedsnail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"illustriousoatmeal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"image2.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"image3.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"image4.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"image6.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"images-pw.secureserver.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imarketservices.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"img.prohardver.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imgpromo.easyrencontre.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"immensehoney.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imonomy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imp.i312864.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"importedincrease.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"impossibleexpansion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imprese.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"impressionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"improvedigital.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"impulsehands.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"imrworldwide.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inclk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"incognitosearches.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"incoming-telemetry.thunderbird.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"incoming.telemetry.mozilla.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"indexexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"indexstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"indexww.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inetlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"infinityads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"infoevent.startappservice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inmobi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inner-active.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"innocentwax.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"innovid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inquisitiveinvention.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"insgly.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"insightexpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"insightexpressai.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inskinad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inspectlet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"install.365-stream.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"insticator.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"instinctiveads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"instrumentsponge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"intelligenceadx.com"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"interactive.forthnet.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"intercom-clicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"internalcondition.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"interreklame.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"intnotif.club"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"inventionpassenger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"invitesugar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ioam.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ip.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ipredictive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ipstack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"irchan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ireklama.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"is-tracking-pixel-api-prod.appspot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"itop.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ivwbox.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ivykiosk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iyfbodn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"iyfnzgb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"j93557g.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jadeitite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jads.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jauchuwa.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jdoqocy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jinkads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"joyoussurprise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"js-agent.newrelic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"js-api.otherlevels.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"js-tags.otherlevels.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"js.iterable.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jsecoin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jsrdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jubilantglimmer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"juicyads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"juicyads.me"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jumptap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"jungroup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"justicejudo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"justpremium.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"justrelevant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"k.iinfo.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kameleoon.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kanoodle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kargo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"karonty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kesmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"keymedia.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kindads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"klclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"klclick1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"klsdee.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kmpiframe.keepmeposted.com.mt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"knorex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"knottyswing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"komoona.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kompasads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kost.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kpu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"krxd.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kt5850pjz0.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ktu.sv2.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"kubient.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"l1.britannica.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"l6b587txj1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lameletters.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"larati.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"largebrass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"laughablecopper.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"laughcloth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"launchbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"layer-ad.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadplace.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leadzupc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leaplunchroom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"leftliquid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lemmatechnologies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lemnisk.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lettucelimit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lever-analytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lfeeder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lgad.cjpowercast.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lgsmartad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.alibris.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.azstarnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.dailycaller.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.gatehousemedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.gq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.livingsocial.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.mw.drhinternet.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.onetravel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.patheos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.pmc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.purch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.realtor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.walmart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"li.ziffimages.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liadm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lifeimpressions.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liftdna.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ligatus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ligatus.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lightcast.leadscoringcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lightcushion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lightstep.medium.systems"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lijit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link-booster.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link.axios.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link.email.usmagazine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link.sbstck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link.theatlantic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link.uk.expediamail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"links.email.crunchbase.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"links.zoopla.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkstorms.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linksynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linktarget.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"linkvertise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"litix.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liveadexchanger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liveintent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"livelylaugh.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"livelyreward.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"liverail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"livingsleet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lizardslaugh.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lkqd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lnks.gd"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"loadsurprise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"locked4.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lockerdome.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"locpub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"log.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"log.logrocket.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"log.pinterest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"log.videocampaign.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"logger.snackly.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"logs.roku.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"logs.spilgames.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"logsss.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"longinglettuce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"look.djfiln.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"look.ichlnk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"look.opskln.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"look.ufinkln.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"loopme.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"loudlunch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lp3tdqle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lucidmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"luckyorange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ludicrousarch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lytics.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"lzjl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"m.trb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"m2.ai"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"m32.media"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"m4n.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"m6r.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mackeeperapp.mackeeper.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"madclient.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"madcpms.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"madinad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"magicadz.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"magicaljoin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"magnificentmist.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mail-ads.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"maltiverse.lt.acemlnc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"manageadv.cblogs.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mantisadnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marinsm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"markedcrayon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"markedmeasure.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"markedpail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.desertcart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.hearstmagazines.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.net.brillen.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.net.home24.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.net.occhiali24.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marketo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marlowpillow.sjv.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"marriedbelief.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mas.sector.sk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"massivemark.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"matchcraft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"materialmoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"matheranalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mathtag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"matomo.activate.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"matomo.crossiety.app"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mautic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"max.i12.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"maximiser.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"maxonclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mbs.megaroticlive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mcdlks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mcs-va.tiktok.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mcs-va.tiktokv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"meadowlullaby.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"measlymiddle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"measure.office.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"meatydime.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media.funpic.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media01.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediabridge.cc"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediafuse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaiqdigital.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediamath.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediamgr.ugo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaplazza.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaplex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediascale.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaserver.bwinpartypartners.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediasmart.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediatext.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediavine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediavoice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mediaz.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"medleyads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"medyanetads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"meetrics.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"megapu.sh"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"megawerbung.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"meltmilk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"memorizeneck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"memorycobweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"messagenovice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metadsp.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"methodcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics-logger.spot.im"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.api.drift.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.articulate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.cnn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.consumerreports.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.ctv.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.getrockerbox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.gfycat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.govexec.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.icloud.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrics.mzstatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"metrilo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mfadsrvr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mg2connext.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mgid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"microticker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"milotree.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"minewhat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"minormeeting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mintegral.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"minusmental.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"minuterhythm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mittencattle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mix2ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mixedreading.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mkto-ab410147.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mktoresp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ml314.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mlm.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mlsend.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mltrk.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mmismm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mmstat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mmtro.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mntzrlt.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"moartraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"moat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"moatads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"moatpixel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mobclix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mobfox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mobileanalytics.us-east-1.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mobilefuse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"modernpricing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"modifyeyes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"moldyicicle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mon-va.byteoversea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mon.byteoversea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"monarchads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"monetate.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"monetizer101.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"moneyexpert.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"monsterpops.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mookie1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mopub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"motionlessmeeting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"motionspots.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mousestats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"movad.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"movemeal.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mowfruit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mparticle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mpstat.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mr-rank.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mrskincash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mstrlytcs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mtrcs.samba.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mtree.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"munchkin.marketo.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mundanenail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mundanepollution.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"musiccounter.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"muteknife.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"muwmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mxptint.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"myads.company"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"myads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"myads.telkomsel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mybbc-analytics.files.bbci.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mybetterdl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mybloglog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mybuys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mycounter.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mydas.mobi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mylink-today.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mypagerank.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mypagerank.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mypowermall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mystat-in.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mysteriousmonth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"mytop-in.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"n2.mouseflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"naj.sk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"naj22.proasdf.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nappyattack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nappyneck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nativeroll.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"navegg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"navigator.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"navrcholu.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ncaudienceexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ndparking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nebulacrescent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nedstatbasic.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"needlessnorth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"needyneedle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"neighborlywatch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nend.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"neocounter.neoworx-blog-tools.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nervoussummer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"net-filter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netagent.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netclickstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netcommunities.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netech.postaffiliatepro.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netmera-web.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netmera.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netmng.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"neudesicmediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newads.bangbros.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newnudecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newopenx.detik.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newsadsppush.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newsletter-link.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newstarads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"newt1.adultworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nexac.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nexage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nitroclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nocturnalloom.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"noiselessplough.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nondescriptcrowd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nondescriptnote.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nondescriptsmile.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nondescriptstocking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nothingunit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"novem.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"npttech.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nr-data.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nr.mmcdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nr.static.mmcdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ns1p.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ntv.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ntvk1.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nullitics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nuseek.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nutritiousbean.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nuttyorganization.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"nzaza.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"o2.mouseflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"o333o.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oafishobservation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.repubblica.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.toronto.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oas.uniontrib.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oascentral.register.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"obscenesidewalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"observantice.com"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"oclasrv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"odbierz-bony.ovp.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oewa.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"offaces-butional.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"offer.fyber.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"offer.sponsorpay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"offerforge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"offermatica.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oglasi.posjetnica.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ogury.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ojrq.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"omnijay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"omniscientspark.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"omniture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"omtrdc.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onaudience.com"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"onclasrv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onclickads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onenetworkdirect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onestat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onestatfree.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"online-metrix.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"online.miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onlinecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onscroll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"onthe.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"opads.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"open.oneplus.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openad.tf1.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openad.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openads.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openadsnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openbid.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openx.angelsgroup.org.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openx.cairo360.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openx.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openx.skinet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openx.smcaen.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"openx2.kytary.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"operationchicken.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"opienetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"opmnstr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oppuz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optimallimit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optimizely.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optimost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optmnstr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optmstr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optnmstr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"optnx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"orientedargument.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"orionember.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ota.cartrawler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"outbrain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"overconfidentfood.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ow.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"owebanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"owlsr.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"owneriq.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ox1.shopcool.com.tw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oxado.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oxcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"oxen.hillcountrytexas.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"p-n.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"p.nag.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"padsbrown.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagead.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagefair.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pagerank-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"painstakingpickle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"paleleaf.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"panickycurtain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"panickypancake.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"panoramicplane.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"parachutehome.sjv.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"paradoxfactor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"parchedangle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"parchedsofa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pardonpopular.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"parentpicture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"parsely.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"parsimoniouspolice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partner-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partner.pelikan.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partnerads.ysm.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partnercash.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partners.priceline.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"partplanes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"passeura.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"paychat.fuse-cloud.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pbterra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pc-tc.s3-eu-west-1.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"peep-auktion.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"peer39.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pennyweb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pepperjamnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"perceivequarter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"percentmobile.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"perfectaudience.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"performancerevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"performancerevenues.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"performancing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"permutive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"personagraph.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"petiteumbrella.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pgl.example.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pgl.example0101"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pgmediaserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pgpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pheedo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"phoenix-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"photographpan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"physicalbikes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"piano.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"piet2eix3l.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pietexture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ping.ublock.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pipedream.wistia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pippio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"piquantpigs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pix.spot.im"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pixel.condenastdigital.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pixel.keywee.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pixel.sojern.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pixel.watch"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pixel.yabidos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"placed.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"placeframe.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"placidactivity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"plausibleio.workers.dev"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pleasantpump.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"plista.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"plotrabbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pltraffic8.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pluckypocket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pocketfaucet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pointlesshour.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pointlessprofit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pokkt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popcash.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popmyads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popplantation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popunhot1.blogspot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popup.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popupmoney.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"porntrack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"possessivebucket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"possibleboats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"possiblepencil.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"post.spmailtechno.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"postback.iqm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"postrelease.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ppc.adhere.marchex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"praddpro.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prchecker.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prebid.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"presetrabbits.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"previousplayground.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"previouspotato.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prf.hn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"priceypies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"priefy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"privatecash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prmtracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pro-market.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"probablepartner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"processplantation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"proext.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"profero.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"profitrumour.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"programattik.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"projectwonderful.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promos.bwin.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promote.pair.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"promotions-884485.c.cdn77.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"proof-x.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"propellerads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"propellerclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"proper.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"props.id"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prosper.on-line-casino.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"protectcrev.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"protectivemetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"protectsubrev.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"protestcopy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"proton-tm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"protraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"provenpixel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"provexia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prpops.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pstmrk.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"psychedelicchess.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ptoushoa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.chez.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.hardware.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.network"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pub.realmedia.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pubdirecte.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"publicidees.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"publicsofa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pubmine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pubnative.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"puffyloss.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"puffypaste.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"puffypull.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"puffypurpose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pureclarity.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pushame.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pushance.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pushazer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pushengage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pushno.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pushtrack.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pushwhy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"px.dynamicyield.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"px.gfycat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"px.spiceworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pxf.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pxl-mailtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pxl.iqm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"pymx5.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"q1connect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ql.tc"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"qnsr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"qrlsx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quacksquirrel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quaintcan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quantcast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quantcount.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quantummetric.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quarterbean.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quarterserver.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quickkoala.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quicksandear.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quietknowledge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quinst.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quirkysugar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quisma.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"quizzicalzephyr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"r.logrocket.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"r.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"r.scoota.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"r.sibmail.havasit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"r1.visualwebsiteoptimizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"r2.visualwebsiteoptimizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"r3.visualwebsiteoptimizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"raac33.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rabbitrifle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"radar.cedexis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"radiate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"radiateprose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rads.realadmin.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"railwayrainstorm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"railwayreason.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rambunctiousflock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rambunctiousvoyage.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rampidads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rankchamp.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-charts.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-hits.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-links.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ranking-liste.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rankingchart.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rankingscout.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rapidkittens.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"raresummer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rate.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ratings.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rayjump.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rcadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reactx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"readgoldfish.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"readingguilt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"readserver.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"readymoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realclever.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rebelhen.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rebelsubway.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rebelswing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rec5.visualwebsiteoptimizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"recapture.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"receptiveink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"receptivereaction.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"recoco.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reconditerake.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"record.bonniergaming.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"record.mrwin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"redirectingat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"redirectvoluum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"redshell.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reduxmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"referrer.disqus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reflectivereward.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"regularplants.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklam.rfsl.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklama.mironet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklamcsere.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reklamdsp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"relmaxtop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rememberdiscussion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"remox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"republika.onet.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"resalag.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"resolutekey.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"resonantbrush.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"resonate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"responsiveads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"restrainstorm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revcatch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revcontent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reveal.clearbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revenuedirect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revenuehits.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revive.docmatic.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revive.dubcnm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revive.haskovo.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revive.netriota.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revive.plays.bg"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revlift.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revprotect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"revstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rexadvert.xyz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"reyden-x.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rhombusads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rhythmone.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"richstring.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ringplant.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ringsrecord.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ritzykey.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ritzyrepresentative.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rlcdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rle.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rmgserving.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"robotreplay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rockabox.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rollconnection.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rotabanner.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"roughroll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"roxr.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rqtrk.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rs6.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rta.dailymail.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtb.gumgum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtbadzesto.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtbflairads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtbplatform.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtbpop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtbpopd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtmark.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rtxplatform.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ru4.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rubiconproject.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rum-http-intake.logs.datadoghq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rum-http-intake.logs.datadoghq.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"runads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"rundsp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ruralrobin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ruthlessrobin.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"s.adroll.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"s.dmmew.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"s1-adfly.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"s20dh7e9dh.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sabio.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sadloaf.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"safeanalytics.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sail-horizon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"samplesamba.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"samsungacr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"samsungads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sanalytics.disneyplus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sanity-dataplane.rudderstack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"savoryorange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"saysidewalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sbird.xyz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sc-analytics.appspot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scambiobanner.aruba.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scanscout.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scarcesign.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scaredsnakes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scaredsong.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scaredswing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scarfsmash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scatteredheat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scatteredquiver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scintillatingscissors.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scintillatingsilver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scintillatingspace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scissorsstatement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scorecardresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scratch2cash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"screechingfurniture.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"screechingstocking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"screechingstove.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scripte-monster.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"scrubswim.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sdkfjxjertertry.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"seadform.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"searchmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"secre.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"secretivecub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"secretspiders.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"secure.webconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"securedopen-bp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"securely-protectsoft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"securemetrics.apple.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"securemetrics.apple.com.cn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sedoparking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sedotracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"segment-cdn.producthunt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"selectivesummer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"semasio.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sendmepixel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"separatesilver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"seraphichorizon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"serendipityecho.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"serpentshampoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"serve.tercept.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servedby-buysellads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servedbyadbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servedbyopenx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"servethis.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"serving-sys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sessioncam.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sexcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sexinyourcity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sexlist.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sextracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shakegoldfish.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shakesuggestion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shakytaste.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shareasale.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sharethrough.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sharppatch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sher.index.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shesubscriptions.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shinystat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shiveringspot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shiverscissors.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shockinggrass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shoppingads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"showads.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shrillspoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"shxtrk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sickflock.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sicksmash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sidebar.angelfire.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"signalayer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"silkysquirrel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sillyscrew.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"silvermob.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"simpleanalytics.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"simpli.fi"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"simulateswing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sincerebuffalo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sitedataprocessing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"siteimproveanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"siteimproveanalytics.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"siteintercept.qualtrics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sixscissors.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sixsigmatraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sizesidewalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sizmek.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"skimresources.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"skisofa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"skroutza.skroutz.gr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"skylink.vn"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"slipperysack.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"slopeaota.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smaato.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smart-data-systems.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smart-traffik.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smart-traffik.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smart4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smartlook.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smartstream.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smartyads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smashquartz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smashsurprise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smetrics.10daily.com.au"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smetrics.bestbuy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smetrics.ctv.ca"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smetrics.fedex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smetrics.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smetrics.walgreens.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smetrics.washingtonpost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smilingcattle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smilingwaves.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smoggysnakes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"smrtb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"snoobi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"soggysponge.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"soggyzoo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sombersea.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sombersquirrel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sombersurprise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"somniture.stuff.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"somoaudience.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sonobi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sordidsmile.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sordidstation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sortable.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sortsail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sourcepoint.vice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sovrn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spacash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spaceleadster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spadelocket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sparklingshelf.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"speakol.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"specially4u.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"specificpop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"speedomizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"speedshiftmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spezialreporte.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spidersboats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spiffymachine.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spinbox.techtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spinbox.versiontracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spinnaker-js.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spirebaboon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sponsors.thoughtsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spookysleet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spotlessstamp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spotscenered.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spotx.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spotxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"springaftermath.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"springbot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"springserve.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spulse.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spurioussteam.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spywarelabs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"spywords.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"srvmath.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"srvtrck.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"srwww1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sshowads.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"st.dynamicyield.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"st.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stack-sonar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stackadapt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stakingscrew.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stakingslope.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stakingsmile.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stalesummer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"standingnest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"startapp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat-track.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.cliche.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.dyna.ultraweb.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.webmedia.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.xiaomi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat.zenon.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat24.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stat24.meta.ua"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statdynamic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"static-tracking.klaviyo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"static.itrack.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"static.kameleoon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"staticads.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statm.the-adult-company.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.blogger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.merriam-webster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.mirrorfootball.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.nextgen-email.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.olark.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.pusher.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.rdphv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.self.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.stb-ottow.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.townnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.wp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats.x14.eu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats2.self.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stats4all.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statserv.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statsie.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"steadfastsound.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"steadfastsystem.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"steelhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"steelhousemedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"steepscale.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stepplane.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stickssheep.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stickyadstv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stiffgame.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stimulatingsneeze.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stomachscience.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stopstomach.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"storesurprise.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"storetail.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stormyachiever.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"storygize.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stoveseashore.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"strack.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"straightnest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stretchsquirrel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"strivesidewalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"structurerod.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stupendoussleet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"stupendoussnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"succeedscene.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"suddensidewalk.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sugarcurtain.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sulkybutter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sulkycook.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"summerhamster.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"summerobject.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sumo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sumome.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"superclix.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"superficialsquare.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"supersonicads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"superstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"supertop.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"supertop100.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"supply.colossusssp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"supportwaves.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"surfmusik-adserver.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"surveygizmobeacon.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"sw88.espn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"swan-swan-goose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"swankysquare.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"swimslope.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"swingslip.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"swordgoose.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"synonymoussticks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.appsflyer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.bawafx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.carta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.eloqua.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.email.superdrug.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.en25.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.firstpromoter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.insigit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.irtyd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.leady.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.mmtrkr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.news.browns-restaurants.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.notif-colissimo-laposte.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.podcast.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.salesmatemail.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.vacations.disneydestinations.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.visit.disneydestinations.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"t.visitorqueue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"taboola.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tag-demo.mention-me.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tag.links-analytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tag.mention-me.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tagcommander.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tagger.opecloud.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tags.tiqcdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tagular.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tailsweep.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tailsweep.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"takethatad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"talentedsteel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tamgrt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tangibleteam.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tangyamount.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tapad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tapfiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tapinfluence.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tapjoy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tappx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targad.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"target.microsoft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targeting.api.drift.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targeting.nzme.arcpublishing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targeting.voxus.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targetingnow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"targetpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tastefulsongs.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tatsumi-sys.jp"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tawdryson.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"teads.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tealeaf.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tealium.cbsnews.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tealium.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tealiumiq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tediousticket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tedioustooth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"teenyvolcano.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"teethfan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"telaria.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"telemetrics.klaviyo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"telemetry.dropbox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"telemetry.goodlifefitness.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"telemetry.malwarebytes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"telemetry.v.dropbox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"temelio.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tend.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tendertest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"terriblethumb.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"textad.sexsearch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"textads.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tfag.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"the-ozone-project.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"theadex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"theadhost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thebugs.ws"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"theclickads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"themoneytizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"therapistla.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thinkablerice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thinkitten.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thirdparty.bnc.lt"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thirdrespect.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thirstytwig.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thomastorch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"threechurch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"throattrees.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"throtle.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"thunderhead.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tia.timeinc.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ticketaunt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ticklesign.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ticksel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tics.techdirt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tidaltv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tidint.pro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tinytendency.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tiresomethunder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tkbo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tls.telemetry.swe.quicinc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tlvmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tm.br.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tnkexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tns-counter.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tntclix.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toothbrushnote.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top-casting-termine.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top-site-list.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top100-images.rambler.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"top20free.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topforall.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"toplistcity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topsites.com.br"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"topstats.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"totemcash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"touchclarity.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.canva.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.contently.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.effiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.flexlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.flexlinkspro.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.freemmo2017.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.game18click.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.lettingaproperty.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.mailalert.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.mailerlite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.miro.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.nationalgunrights.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.privacyatclearbit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.segmetrics.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.software-codes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.spe.schoolmessenger.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.themaccleanup.info"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.ultravpn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.unear.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.vcdc.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track.viewdeos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"track1.viewdeos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackalyzer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackedlink.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackedweb.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker-pm2.spilleren.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.bannerflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.cdnbye.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.icerocket.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.metricswave.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.mmdlv.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.samplicio.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracker.vgame.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.1-a1502-bi.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.1-kv015-ap.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.21-a4652-bi.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.28-91473-wbm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.39-bb4a9-osm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.42-01pr5-osm-secure.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.5-47737-bi.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.epicgames.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.hyros.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.ibxlink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.intentsify.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.internetstores.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.intl.miui.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.jiffyworld.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.markethero.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.miui.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.netalerts.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.olx-st.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.orixa-media.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.theoceanac.online"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.thinkabt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.utlservice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking.wetter.at"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking01.walmart.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tracking22.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackingsoft.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trackuhub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tradeadexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tradedoubler.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffic-redirecting.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffic.hyteck.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficfactory.biz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficforce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficholder.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffichunt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficrouter.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficshop.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficspaces.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficstrategies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trafic.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traildelsfars.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traktrafficflow.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tranquilplume.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tranquilside.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"travis.bosscasinos.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"traytouch.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trck.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trcklion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"treasuredata.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tremendoustime.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tremorhub.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trendmd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trialfire.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tribalfusion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trickycelery.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"triplelift.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"triptease.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trk.bad-tool-tell-doubt.xyz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trk.bc.shutterfly.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trk.pinterest.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trk.techtarget.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trk42.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trkn.us"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trknths.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trkoptimizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trkpnt.ongage.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trmit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"truckstomatoes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"truculentrate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"truehits.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"truehits1.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trust.titanhq.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trustpid.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"trustx.org"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tsyndicate.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tsyndicate.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tubemogul.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tumbleicicle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"turboadv.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"twyn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tynt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"typicalteeth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"uarating.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ucfunnel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"udkcrj.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"udncoeln.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"uib.ff.avast.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ukoffzeh.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ultimateclixx.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ultramercial.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ultraoranges.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unaccountablepie.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unarmedindustry.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unbecominglamp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"understoodocean.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unknowntray.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unrulymedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"untidyquestion.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unusualtitle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unwieldyhealth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unwieldyimpulse.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"unwrittenspot.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"upu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"urldata.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"user-shield-check.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"userreplay.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"userreplay.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"users.maxcluster.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"utl-1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"uttermosthobbies.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"uu.domainforlite.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"v1adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valerie.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valuead.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valueclick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valueclickmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"valuecommerce.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vanfireworks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vcommission.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"veille-referencement.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"velismedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"venetrigni.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vengefulgrass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ventivmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"venturead.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vericlick.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vertamedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"verticalmass.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vibrantsundown.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vid.pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vidcpm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"videoadex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"videoegg.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"videostats.kakao.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vidible.tv"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vidora.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"viglink.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"virtualvincent.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visiblemeasures.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visistat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visitbox.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visual-pagerank.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"visualrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vivads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vivtracking.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vmmpxl.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"voicefive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"voicelessvein.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"voicevegetable.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"volatilevessel.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"voluum.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"voluumtrk2.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"voyagepotato.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vpon.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vrs.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vs.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vtracy.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"vungle.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"w55c.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wa.and.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"waardex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"walkets.click"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"warmafterthought.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"waryfog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"washbanana.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wateryvan.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wdads.sx.atl.publicus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wdfl.co"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webads.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webanalytics.zohodcm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webcontentassessor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webcounter.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webcounter.goweb.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"weborama.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"weborama.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webpower.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webreseau.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webseoanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtracker.jp"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"webtrackerplus.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtracky.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtraffic.se"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtrends.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webtrendslive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"webxcdn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wellmadefrog.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"welved.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wetrack.it"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whaleads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wheredoyoucomefrom.ovh"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whirlwealth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whiskyqueue.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whisperingcascade.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whisperingcrib.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whisperingsummit.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wickedreports.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"widespace.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"widget.educationdynamics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"widget.privy.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"win.iqm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"window.nixnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wirecomic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wirypaste.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wisepops.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"witch-counter.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wittypopcorn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wizaly.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wl.spotify.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wlmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wonderlandads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wondoads.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"worldwide-cash.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"worldwidedigitalads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"worriednumber.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wryfinger.com"; classtype:trojan-activity; priority:1;)
alert tcp 127.0.0.1 any $HOME_NET any (msg:"wt-eu02.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wt.bankmillennium.pl"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wtlive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www-banner.chat.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www.photo-ads.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"wwwpromoter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"x-traceur.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"x6.yakiuchi.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xad.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xapads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xertive.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xfreeservice.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xg4ken.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xovq5nemr.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xplusone.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xpu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xtracker.logimeter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"xxxmyself.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yadro.ru"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yamstamp.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yepads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yesads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yesadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldlab.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldmanager.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldmo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldoptimizer.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yieldtraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yldbt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ymetrica1.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yoads.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yoggrt.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"youradexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"ypu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"yrquuaxo.ajrimmobilier.fr"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zanox-affiliate.de"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zanox.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zantracker.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zarget.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zbwp6ghm.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zdbb.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zealousfield.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zedo.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zemanta.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zencudo.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zenkreka.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zephyrlabyrinth.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zeus.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zeusclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zion-telemetry.api.cnn.io"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zippingcare.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zlp6s.pw"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zm232.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zpu.samsungelectronics.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zqtk.net"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zukxd6fkxqn.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zy16eoat1w.com"; classtype:trojan-activity; priority:1;)
alert tcp  any $HOME_NET any (msg:"zzhc.vnet.cn"; classtype:trojan-activity; priority:1;)
blocklist last updated:	Tue, 09 Apr 2024 21:21:54 GMT
listing ad servers added after:	Fri, 06 Jun 2003 00:00:00
format list is displayed in:	snort -- for use with Snort
total entries:	3735 / 3735