last updated: Thu, 21 Nov 2024 11:03:43 GMT (3538 servers listed)
[ other stuff | list of ad server hostnames | information about this list | choose another format to view the list in ]
hide these links (see the main page for other formats in which to view the list.)
# List of IP addresses for use with Snort # # last updated: Thu, 21 Nov 2024 11:03:43 GMT # total IPs listed: 9134 # format: snort # credits: Peter Lowe - pgl@yoyo.org - https://pgl.yoyo.org/ - https://twitter.com/pgl # other formats: https://pgl.yoyo.org/adservers/formats.php # # WARNING: using this list in IP address format may block legitimate content # from IP addresses listed. IP addresses used are the reverse IPs for hostnames # included in a hostname block list, so may also be valid for other hostnames. # # The latest version of this list and other ways of viewing it are at: # # https://pgl.yoyo.org/adservers/ # # - Peter Lowe # pgl@yoyo.org # alert tcp 103.245.223.131 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 103.245.223.194 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.184 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.32 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.33 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.34 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.35 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.36 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.5 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.6.6 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.7.184 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.7.31 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.7.32 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.7.33 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.7.34 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.7.35 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.7.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 103.31.7.5 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 107.1.218.112 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.140.119 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.144.200 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.150.214 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 107.20.165.101 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.170.67 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.172.247 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.182.114 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.187.182 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.192.122 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.206.69 any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.210.46 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.223.131 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.229.0 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.248.225 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 107.20.250.140 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.100.192 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.110.141 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.120.42 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.236.39 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.247.135 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.247.218 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.249.192 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.249.25 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.249.38 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.251.222 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.92.233 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.95.174 any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;) alert tcp 107.21.95.48 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 107.22.161.177 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.161.53 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.174.69 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.182.17 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.193.46 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.20.174 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.211.212 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 107.22.213.178 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.218.51 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.231.138 any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.240.237 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.246.83 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.250.156 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.251.105 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.252.153 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;) alert tcp 107.22.253.9 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 107.23.168.79 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;) alert tcp 107.23.18.192 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.193.94 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.194.161 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.194.164 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.194.167 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 108.162.194.177 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.194.45 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.194.64 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.195.161 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.195.167 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 108.162.195.177 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.195.197 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.195.45 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.198.193 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.198.94 any $HOME_NET any (msg:"proton-tm.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.198.98 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 108.162.199.94 any $HOME_NET any (msg:"proton-tm.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.203.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.203.253 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.203.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.204.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.204.253 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.204.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.205.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.205.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.206.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.206.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.162.207.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 108.163.163.194 any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;) alert tcp 108.166.79.51 any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 108.168.132.186 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;) alert tcp 108.168.160.69 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;) alert tcp 108.168.170.82 any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;) alert tcp 108.168.218.164 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 108.168.218.168 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 108.168.218.175 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 108.168.218.176 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 108.168.218.180 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 108.60.149.204 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;) alert tcp 108.61.16.85 any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;) alert tcp 108.61.4.52 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 108.61.5.242 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 108.61.5.243 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 109.123.194.85 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 109.123.74.252 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;) alert tcp 109.123.89.175 any $HOME_NET any (msg:"clickcompare.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 109.163.234.50 any $HOME_NET any (msg:"webseoanalytics.com"; classtype:trojan-activity; priority:1;) alert tcp 109.169.13.178 any $HOME_NET any (msg:"sid-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 109.201.131.15 any $HOME_NET any (msg:"thebugs.ws"; classtype:trojan-activity; priority:1;) alert tcp 109.205.184.118 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 109.205.184.32 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 109.205.184.67 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 109.205.186.118 any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;) alert tcp 109.205.186.32 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 109.205.186.67 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 109.234.109.20 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;) alert tcp 109.234.109.21 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;) alert tcp 109.234.109.80 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;) alert tcp 109.235.249.19 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;) alert tcp 109.68.230.160 any $HOME_NET any (msg:"ad2games.com"; classtype:trojan-activity; priority:1;) alert tcp 109.71.162.230 any $HOME_NET any (msg:"awempire.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.130 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.131 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.132 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.133 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.134 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.135 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.136 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.137 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.138 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.186.139 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.187.7 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 110.75.200.3 any $HOME_NET any (msg:"dmtracking.alibaba.com"; classtype:trojan-activity; priority:1;) alert tcp 111.171.193.53 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 111.171.195.164 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 111.223.33.103 any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;) alert tcp 112.121.185.190 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 112.140.42.24 any $HOME_NET any (msg:"x6.yakiuchi.com"; classtype:trojan-activity; priority:1;) alert tcp 112.175.233.250 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 112.175.255.100 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 112.175.255.20 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 112.175.255.21 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 112.175.255.32 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 112.175.255.33 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 112.78.196.110 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;) alert tcp 113.107.42.34 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 113.107.96.156 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 113.107.96.157 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 114.112.176.12 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 114.112.176.21 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 114.112.176.218 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 114.112.176.88 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 114.80.101.42 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;) alert tcp 114.80.101.52 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;) alert tcp 115.112.200.66 any $HOME_NET any (msg:"campaign.bharatmatrimony.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.13 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.14 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.17 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.18 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.19 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.20 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.21 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.22 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.27 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.182.49.8 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.238.137.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.238.137.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 115.239.210.151 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;) alert tcp 116.55.241.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 116.55.241.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 117.135.134.17 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;) alert tcp 117.135.134.88 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;) alert tcp 117.21.191.223 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 117.21.224.236 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 117.21.227.34 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 117.21.227.47 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 117.27.140.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 117.27.140.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 117.41.235.38 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 118.123.202.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.123.202.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.13 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.14 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.17 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.19 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.20 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.21 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.22 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.27 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 118.145.5.8 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 119.123.233.83 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 119.146.222.121 any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;) alert tcp 119.147.47.121 any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;) alert tcp 119.147.86.8 any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;) alert tcp 119.15.70.9 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;) alert tcp 119.245.243.82 any $HOME_NET any (msg:"xrea.com"; classtype:trojan-activity; priority:1;) alert tcp 119.252.148.13 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 119.31.248.68 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 119.59.124.169 any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;) alert tcp 119.77.12.181 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.12.182 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.12.183 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.12.184 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.12.185 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.13.165 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.13.166 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.13.167 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.13.168 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.77.13.169 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 119.84.122.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 119.84.122.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 119.84.77.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 119.84.77.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 119.97.134.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 119.97.134.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.1.15 any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.1.155 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.13.105 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.17.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.21.105 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.21.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.25.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.29.105 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.29.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.33.15 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.37.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.41.105 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.41.15 any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.45.15 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.5.15 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.69.15 any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.81.105 any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.81.15 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.9.105 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 12.120.9.15 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.129.204.125 any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;) alert tcp 12.129.206.71 any $HOME_NET any (msg:"ads.ipowerweb.com"; classtype:trojan-activity; priority:1;) alert tcp 12.130.14.155 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 12.130.3.118 any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;) alert tcp 12.130.50.205 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 12.130.62.118 any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;) alert tcp 12.130.62.126 any $HOME_NET any (msg:"atdmt.com"; classtype:trojan-activity; priority:1;) alert tcp 12.130.86.86 any $HOME_NET any (msg:"advert.bayarea.com"; classtype:trojan-activity; priority:1;) alert tcp 12.14.172.204 any $HOME_NET any (msg:"openad.travelnow.com"; classtype:trojan-activity; priority:1;) alert tcp 12.153.224.22 any $HOME_NET any (msg:"etrade.com"; classtype:trojan-activity; priority:1;) alert tcp 12.158.234.169 any $HOME_NET any (msg:"adserver.gorillanation.com"; classtype:trojan-activity; priority:1;) alert tcp 12.171.94.36 any $HOME_NET any (msg:"ads.websiteservices.com"; classtype:trojan-activity; priority:1;) alert tcp 12.171.94.38 any $HOME_NET any (msg:"ads.websiteservices.com"; classtype:trojan-activity; priority:1;) alert tcp 12.171.94.40 any $HOME_NET any (msg:"7search.com"; classtype:trojan-activity; priority:1;) alert tcp 12.46.185.206 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 12.47.46.231 any $HOME_NET any (msg:"gostats.com"; classtype:trojan-activity; priority:1;) alert tcp 121.0.16.130 any $HOME_NET any (msg:"dmtracking.alibaba.com"; classtype:trojan-activity; priority:1;) alert tcp 121.10.132.223 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 121.10.132.235 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 121.11.149.28 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 121.11.69.211 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 121.11.69.212 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 121.14.35.166 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 121.14.35.167 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 121.35.188.203 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 121.35.188.56 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 122.224.146.36 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 122.224.146.77 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 122.225.99.192 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 122.228.242.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 122.228.243.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 122.228.243.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 122.248.250.236 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;) alert tcp 123.125.115.43 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;) alert tcp 123.125.115.50 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;) alert tcp 123.125.115.51 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;) alert tcp 124.108.65.81 any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity; priority:1;) alert tcp 124.232.159.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 124.232.159.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 124.36.209.244 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;) alert tcp 125.46.73.195 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 125.46.73.250 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 125.46.73.252 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.1 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.11 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.12 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.123 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.13 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.16 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.17 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.2 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.6 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.7.34.7 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 125.76.224.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 125.76.224.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 125.76.247.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 125.76.247.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 128.11.42.61 any $HOME_NET any (msg:"burstnet.com"; classtype:trojan-activity; priority:1;) alert tcp 128.121.236.169 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.168.154 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.168.160 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.168.65 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.168.66 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.131 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.133 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.135 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.137 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.139 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.141 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.143 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.145 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.147 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.149 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.192 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.194 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.196 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.198 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.202 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.204 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.206 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.208 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.222 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.226 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.228 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.232 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.242 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.244 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.140.169.248 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 128.241.88.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 128.241.88.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 128.241.88.55 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 128.242.118.139 any $HOME_NET any (msg:"quinst.com"; classtype:trojan-activity; priority:1;) alert tcp 128.242.120.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 128.242.120.22 any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;) alert tcp 128.242.127.7 any $HOME_NET any (msg:"dmtracking2.alibaba.com"; classtype:trojan-activity; priority:1;) alert tcp 128.242.247.185 any $HOME_NET any (msg:"ads10.speedbit.com"; classtype:trojan-activity; priority:1;) alert tcp 128.242.249.133 any $HOME_NET any (msg:"ad.digitallook.com"; classtype:trojan-activity; priority:1;) alert tcp 128.242.252.86 any $HOME_NET any (msg:"humanclick.com"; classtype:trojan-activity; priority:1;) alert tcp 129.121.239.156 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 129.121.53.4 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 129.250.159.170 any $HOME_NET any (msg:"iwin.com"; classtype:trojan-activity; priority:1;) alert tcp 129.33.228.192 any $HOME_NET any (msg:"ru4.com"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.10 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.11 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.12 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.13 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.14 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.15 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.151 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.152 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.153 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.154 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.16 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.17 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.18 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.19 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.20 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.21 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.22 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.23 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.4 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.5 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.6 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.7 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.8 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.117.88.9 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 130.94.18.222 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;) alert tcp 130.94.183.145 any $HOME_NET any (msg:"berp.com"; classtype:trojan-activity; priority:1;) alert tcp 130.94.21.10 any $HOME_NET any (msg:"secure.webconnect.net"; classtype:trojan-activity; priority:1;) alert tcp 130.94.70.82 any $HOME_NET any (msg:"secure.webconnect.net"; classtype:trojan-activity; priority:1;) alert tcp 130.94.74.189 any $HOME_NET any (msg:"shareasale.com"; classtype:trojan-activity; priority:1;) alert tcp 130.94.79.174 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 131.253.13.32 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;) alert tcp 131.253.33.200 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;) alert tcp 133.237.4.12 any $HOME_NET any (msg:"ba.afl.rakuten.co.jp"; classtype:trojan-activity; priority:1;) alert tcp 134.0.26.179 any $HOME_NET any (msg:"top-casting-termine.de"; classtype:trojan-activity; priority:1;) alert tcp 137.254.16.65 any $HOME_NET any (msg:"ads.sun.com"; classtype:trojan-activity; priority:1;) alert tcp 14.63.233.90 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 140.174.9.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 140.174.9.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 140.174.9.55 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 140.186.79.19 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 140.186.79.30 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 140.186.79.35 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 140.186.79.36 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 140.99.94.175 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;) alert tcp 141.0.173.86 any $HOME_NET any (msg:"trafficfactory.biz"; classtype:trojan-activity; priority:1;) alert tcp 141.0.173.87 any $HOME_NET any (msg:"trafficfactory.biz"; classtype:trojan-activity; priority:1;) alert tcp 141.0.23.181 any $HOME_NET any (msg:"mr-rank.de"; classtype:trojan-activity; priority:1;) alert tcp 141.101.112.11 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 141.101.112.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 141.101.112.42 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 141.101.113.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 141.101.113.42 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 141.101.114.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 141.101.115.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 141.101.116.137 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 141.101.116.64 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 141.101.117.137 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 141.101.117.64 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 141.101.123.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 141.101.123.42 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 141.138.198.120 any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;) alert tcp 141.8.224.185 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;) alert tcp 141.8.224.25 any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 141.8.224.67 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;) alert tcp 142.4.45.147 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;) alert tcp 144.76.199.138 any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;) alert tcp 144.76.37.44 any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;) alert tcp 144.76.39.37 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;) alert tcp 146.101.66.152 any $HOME_NET any (msg:"banners.resultonline.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.109.225 any $HOME_NET any (msg:"trafficsyndicate.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.202.112 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.202.121 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.202.87 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.202.88 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.205.104 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.205.119 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.205.123 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.205.96 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.205.97 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.205.99 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.206.237 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 146.82.206.34 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 147.208.175.16 any $HOME_NET any (msg:"affiliates.allposters.com"; classtype:trojan-activity; priority:1;) alert tcp 149.210.134.160 any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;) alert tcp 151.1.244.2 any $HOME_NET any (msg:"adv.hwupgrade.it"; classtype:trojan-activity; priority:1;) alert tcp 151.1.32.173 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;) alert tcp 151.1.32.174 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;) alert tcp 151.1.32.177 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;) alert tcp 151.1.32.178 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;) alert tcp 151.1.33.3 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;) alert tcp 151.1.65.8 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;) alert tcp 151.249.93.133 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.93.83 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.136 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.139 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.14 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.140 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.15 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.18 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.205 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.210 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.23 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.68 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.7 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.71 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.73 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.77 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.79 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.8 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.80 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.81 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.84 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.86 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.88 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 151.249.94.89 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 152.163.226.121 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 152.163.226.153 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 152.163.226.185 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 152.163.226.25 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 152.163.226.57 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 152.163.226.89 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 154.53.129.43 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 154.53.129.44 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 154.53.129.45 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 154.53.129.47 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 156.154.164.9 any $HOME_NET any (msg:"juicyads.com"; classtype:trojan-activity; priority:1;) alert tcp 157.151.81.100 any $HOME_NET any (msg:"aaddzz.com"; classtype:trojan-activity; priority:1;) alert tcp 158.127.18.27 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 158.127.30.72 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 158.255.224.131 any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;) alert tcp 158.255.224.136 any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;) alert tcp 159.33.1.57 any $HOME_NET any (msg:"ads.cbc.ca"; classtype:trojan-activity; priority:1;) alert tcp 159.54.238.18 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.238.2 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.238.23 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.238.69 any $HOME_NET any (msg:"ad.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.239.2 any $HOME_NET any (msg:"ads.desmoinesregister.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.239.72 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.34.142 any $HOME_NET any (msg:"ad.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.34.17 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.34.194 any $HOME_NET any (msg:"ad.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 159.54.34.225 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 160.7.249.22 any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;) alert tcp 161.58.12.234 any $HOME_NET any (msg:"ads.internic.co.il"; classtype:trojan-activity; priority:1;) alert tcp 161.58.178.209 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;) alert tcp 161.58.179.169 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;) alert tcp 161.58.181.137 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;) alert tcp 161.58.187.157 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;) alert tcp 161.58.191.254 any $HOME_NET any (msg:"shareasale.com"; classtype:trojan-activity; priority:1;) alert tcp 161.58.56.25 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 161.58.80.46 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 161.69.13.22 any $HOME_NET any (msg:"ads.mcafee.com"; classtype:trojan-activity; priority:1;) alert tcp 162.144.0.192 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 162.144.1.246 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 162.42.211.167 any $HOME_NET any (msg:"adsynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 164.115.2.134 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;) alert tcp 164.115.2.135 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;) alert tcp 164.115.2.144 any $HOME_NET any (msg:"truehits1.gits.net.th"; classtype:trojan-activity; priority:1;) alert tcp 164.115.2.146 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;) alert tcp 164.115.2.149 any $HOME_NET any (msg:"truehits.net"; classtype:trojan-activity; priority:1;) alert tcp 164.115.31.100 any $HOME_NET any (msg:"truehits.net"; classtype:trojan-activity; priority:1;) alert tcp 164.115.31.102 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;) alert tcp 164.115.31.103 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;) alert tcp 165.193.245.54 any $HOME_NET any (msg:"adwhirl.com"; classtype:trojan-activity; priority:1;) alert tcp 165.193.78.137 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;) alert tcp 165.193.78.159 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;) alert tcp 165.193.78.248 any $HOME_NET any (msg:"voicefive.com"; classtype:trojan-activity; priority:1;) alert tcp 165.193.78.252 any $HOME_NET any (msg:"scorecardresearch.com"; classtype:trojan-activity; priority:1;) alert tcp 166.78.85.233 any $HOME_NET any (msg:"justrelevant.com"; classtype:trojan-activity; priority:1;) alert tcp 166.78.95.129 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;) alert tcp 167.8.128.40 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 167.8.128.41 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 167.8.226.26 any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;) alert tcp 168.103.22.243 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 168.143.117.49 any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 168.143.35.194 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 168.143.84.99 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;) alert tcp 168.144.168.116 any $HOME_NET any (msg:"monsterpops.com"; classtype:trojan-activity; priority:1;) alert tcp 168.161.242.59 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;) alert tcp 168.215.71.242 any $HOME_NET any (msg:"adimages.carsoup.com"; classtype:trojan-activity; priority:1;) alert tcp 168.215.71.243 any $HOME_NET any (msg:"admanager.carsoup.com"; classtype:trojan-activity; priority:1;) alert tcp 168.75.211.34 any $HOME_NET any (msg:"adminder.com"; classtype:trojan-activity; priority:1;) alert tcp 168.75.65.73 any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;) alert tcp 168.75.65.86 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;) alert tcp 168.75.66.156 any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;) alert tcp 168.75.66.158 any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;) alert tcp 170.149.168.130 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;) alert tcp 170.149.172.130 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;) alert tcp 170.224.109.13 any $HOME_NET any (msg:"ru4.com"; classtype:trojan-activity; priority:1;) alert tcp 172.228.163.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 173.0.67.27 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;) alert tcp 173.160.113.22 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.146.14 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 173.192.200.107 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.200.108 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.200.109 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.200.110 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.200.111 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.200.112 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.200.113 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.200.114 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.21.2 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.21.3 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.33.225 any $HOME_NET any (msg:"easyhits4u.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.76.133 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.76.134 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.76.138 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 173.192.76.171 any $HOME_NET any (msg:"ads.co.com"; classtype:trojan-activity; priority:1;) alert tcp 173.193.15.18 any $HOME_NET any (msg:"net-filter.com"; classtype:trojan-activity; priority:1;) alert tcp 173.193.174.194 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.105 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.106 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.107 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.108 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.109 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.110 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.111 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.121 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.122 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.123 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.124 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.128 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.129 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.130 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.131 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.132 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.133 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.134 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.135 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.136 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.137 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.138 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.139 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.140 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.141 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.142 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.143 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.144 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.145 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.146 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.147 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.148 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.153 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.155 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.156 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.160 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.161 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.162 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.163 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.164 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.165 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.166 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.167 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.168 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.169 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.170 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.171 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.172 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.173 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.174 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.175 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.176 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.177 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.178 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.179 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.180 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.185 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.186 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.187 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.188 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.64 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.65 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.66 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.67 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.68 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.69 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.70 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.71 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.72 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.73 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.74 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.75 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.76 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.77 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.78 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.89 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.90 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.91 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.92 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.96 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.97 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.98 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.34.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.36.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.37.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.105 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.106 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.107 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.108 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.109 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.110 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.121 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.122 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.123 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.124 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.128 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.129 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.130 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.131 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.132 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.133 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.134 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.135 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.136 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.137 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.138 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.139 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.140 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.141 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.142 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.143 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.144 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.145 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.146 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.148 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.153 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.155 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.156 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.160 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.161 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.162 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.163 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.164 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.165 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.166 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.167 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.168 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.169 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.170 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.171 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.172 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.173 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.174 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.185 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.186 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.187 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.188 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.64 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.65 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.66 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.67 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.68 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.69 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.70 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.71 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.72 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.73 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.74 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.75 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.76 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.77 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.78 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.89 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.90 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.91 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.92 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.96 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.97 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.98 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.41.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.65.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.65.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.65.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.65.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.65.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.65.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.132 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.148 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.149 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.155 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.156 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.157 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.164 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.165 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.166 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.167 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.66.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.67.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.70.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.70.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.70.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.70.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.70.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.70.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.132 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.148 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.149 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.155 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.156 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.157 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 173.194.78.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 173.199.115.168 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 173.199.120.68 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 173.199.133.86 any $HOME_NET any (msg:"liftdna.com"; classtype:trojan-activity; priority:1;) alert tcp 173.199.149.66 any $HOME_NET any (msg:"seeq.com"; classtype:trojan-activity; priority:1;) alert tcp 173.199.149.72 any $HOME_NET any (msg:"seeq.com"; classtype:trojan-activity; priority:1;) alert tcp 173.201.20.57 any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;) alert tcp 173.201.239.14 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 173.203.191.118 any $HOME_NET any (msg:"campaign.bharatmatrimony.com"; classtype:trojan-activity; priority:1;) alert tcp 173.203.89.94 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;) alert tcp 173.204.49.131 any $HOME_NET any (msg:"ads-click.com"; classtype:trojan-activity; priority:1;) alert tcp 173.208.154.130 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.172 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.177 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.178 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.183 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.184 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.186 any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.199 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.209 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.210 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.232 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;) alert tcp 173.212.56.97 any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;) alert tcp 173.214.168.171 any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;) alert tcp 173.224.124.149 any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;) alert tcp 173.224.124.177 any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;) alert tcp 173.225.27.85 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.102 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.108 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.117 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.14 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.20 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.23 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.26 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.29 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.227.66.5 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.230.141.57 any $HOME_NET any (msg:"carbonads.com"; classtype:trojan-activity; priority:1;) alert tcp 173.231.140.218 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 173.231.140.219 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 173.236.110.98 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;) alert tcp 173.236.165.119 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;) alert tcp 173.236.188.251 any $HOME_NET any (msg:"oxen.hillcountrytexas.com"; classtype:trojan-activity; priority:1;) alert tcp 173.236.31.170 any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.240.1.37 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 173.240.1.38 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 173.241.240.4 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 173.245.60.121 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 173.245.60.15 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 173.245.60.44 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 173.245.61.145 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 173.245.61.15 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 173.245.61.30 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 173.245.61.56 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 173.251.68.85 any $HOME_NET any (msg:"percentmobile.com"; classtype:trojan-activity; priority:1;) alert tcp 173.255.205.157 any $HOME_NET any (msg:"flurry.com"; classtype:trojan-activity; priority:1;) alert tcp 173.255.229.104 any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;) alert tcp 173.255.248.208 any $HOME_NET any (msg:"fusionads.net"; classtype:trojan-activity; priority:1;) alert tcp 173.255.250.118 any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 173.44.62.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 173.45.100.242 any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 173.45.161.14 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;) alert tcp 173.46.7.31 any $HOME_NET any (msg:"opienetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 173.8.109.182 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.0.156 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.113.133 any $HOME_NET any (msg:"directaclick.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.120.175 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.120.208 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.120.221 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.120.229 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.139.9 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.152.167 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 174.120.152.186 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 174.121.38.247 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;) alert tcp 174.122.238.251 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;) alert tcp 174.123.154.147 any $HOME_NET any (msg:"ads.justhungry.com"; classtype:trojan-activity; priority:1;) alert tcp 174.123.175.226 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;) alert tcp 174.123.55.226 any $HOME_NET any (msg:"blogtopsites.com"; classtype:trojan-activity; priority:1;) alert tcp 174.127.101.225 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;) alert tcp 174.127.127.178 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.102.210 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.11.178 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.12.237 any $HOME_NET any (msg:"cetrk.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.14.235 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.16.231 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.19.78 any $HOME_NET any (msg:"admarvel.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.20.213 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.201.226 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 174.129.201.230 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 174.129.203.88 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.209.156 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.21.25 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.216.213 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.217.153 any $HOME_NET any (msg:"gvisit.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.218.62 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.220.107 any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.222.175 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.227.33 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.232.188 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.233.188 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.236.152 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 174.129.240.12 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.243.62 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.244.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.249.79 any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.252.108 any $HOME_NET any (msg:"servedbyopenx.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.253.18 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.35.49 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 174.129.43.138 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.43.206 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 174.129.44.143 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;) alert tcp 174.129.7.234 any $HOME_NET any (msg:"adwhirl.com"; classtype:trojan-activity; priority:1;) alert tcp 174.132.110.250 any $HOME_NET any (msg:"adreactor.com"; classtype:trojan-activity; priority:1;) alert tcp 174.132.34.18 any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;) alert tcp 174.132.65.58 any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;) alert tcp 174.132.67.194 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;) alert tcp 174.132.67.76 any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;) alert tcp 174.133.78.191 any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;) alert tcp 174.133.96.9 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.114.57 any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.114.60 any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.114.62 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.125.110 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.125.35 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.125.36 any $HOME_NET any (msg:"actionsplash.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.125.68 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.125.78 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.125.92 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.125.95 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.182.164 any $HOME_NET any (msg:"privatecash.com"; classtype:trojan-activity; priority:1;) alert tcp 174.137.34.105 any $HOME_NET any (msg:"videoegg.com"; classtype:trojan-activity; priority:1;) alert tcp 174.140.166.211 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 174.140.17.100 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;) alert tcp 174.142.113.41 any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;) alert tcp 174.142.113.46 any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.100.53 any $HOME_NET any (msg:"liveintent.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.114.147 any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.140.88 any $HOME_NET any (msg:"stats.olark.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.172.51 any $HOME_NET any (msg:"tlvmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.234.59 any $HOME_NET any (msg:"yoggrt.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.241.129 any $HOME_NET any (msg:"theadhost.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.241.76 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.242.228 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.242.242 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.243.5 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.243.8 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.45.106 any $HOME_NET any (msg:"justrelevant.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.51.42 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.53.252 any $HOME_NET any (msg:"blogherads.com"; classtype:trojan-activity; priority:1;) alert tcp 174.143.73.146 any $HOME_NET any (msg:"at-adserver.alltop.com"; classtype:trojan-activity; priority:1;) alert tcp 174.34.228.181 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 174.34.255.64 any $HOME_NET any (msg:"zeusclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 174.35.64.38 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 174.35.64.49 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 174.35.65.93 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 174.35.66.74 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 174.35.66.82 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 174.35.67.30 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 174.36.103.119 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 174.36.103.124 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 174.36.105.210 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 174.36.138.28 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 174.36.193.150 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;) alert tcp 174.36.232.136 any $HOME_NET any (msg:"histats.com"; classtype:trojan-activity; priority:1;) alert tcp 174.36.240.233 any $HOME_NET any (msg:"histats.com"; classtype:trojan-activity; priority:1;) alert tcp 174.36.45.48 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;) alert tcp 174.36.58.233 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;) alert tcp 174.37.147.184 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 174.37.154.104 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;) alert tcp 174.37.154.236 any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;) alert tcp 174.37.172.68 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 174.37.172.69 any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;) alert tcp 174.37.205.202 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;) alert tcp 174.37.207.102 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;) alert tcp 174.37.214.225 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 174.46.248.90 any $HOME_NET any (msg:"precisionclick.com"; classtype:trojan-activity; priority:1;) alert tcp 174.47.188.40 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;) alert tcp 174.47.188.6 any $HOME_NET any (msg:"onenetworkdirect.com"; classtype:trojan-activity; priority:1;) alert tcp 174.47.188.8 any $HOME_NET any (msg:"affiliates.digitalriver.com"; classtype:trojan-activity; priority:1;) alert tcp 175.41.139.218 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;) alert tcp 175.41.3.36 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 176.31.115.188 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 176.31.89.10 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.193 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.195 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.198 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.201 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.240 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.248 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.64 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.67 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.68 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.72 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.100.75 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.101.129 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.101.137 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.101.145 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.101.148 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.101.65 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.101.73 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.101.8 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.102.122 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.102.49 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.102.57 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.97.252 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.98.226 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.98.230 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.98.233 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.98.234 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.100 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.153 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.161 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.164 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.201 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.204 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.212 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.35 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.43 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.47 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.32.99.96 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.100.20 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.109.246 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.186.134 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.190.192 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.191.0 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;) alert tcp 176.34.191.3 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;) alert tcp 176.34.191.4 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;) alert tcp 176.34.191.5 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;) alert tcp 176.34.224.89 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.224.94 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.225.33 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.227.166 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.234.52 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.243.178 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.250.173 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 176.34.250.175 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 176.58.105.10 any $HOME_NET any (msg:"clickcompare.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 176.74.176.178 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 176.74.176.179 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 176.9.12.70 any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;) alert tcp 176.9.195.100 any $HOME_NET any (msg:"advertisingbox.com"; classtype:trojan-activity; priority:1;) alert tcp 176.9.224.89 any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;) alert tcp 176.9.38.163 any $HOME_NET any (msg:"net-filter.com"; classtype:trojan-activity; priority:1;) alert tcp 176.9.45.195 any $HOME_NET any (msg:"linktarget.com"; classtype:trojan-activity; priority:1;) alert tcp 176.9.46.73 any $HOME_NET any (msg:"ad.nachtagenten.de"; classtype:trojan-activity; priority:1;) alert tcp 176.9.83.231 any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;) alert tcp 178.18.22.157 any $HOME_NET any (msg:"ads.ultimate-guitar.com"; classtype:trojan-activity; priority:1;) alert tcp 178.18.22.159 any $HOME_NET any (msg:"ads.ultimate-guitar.com"; classtype:trojan-activity; priority:1;) alert tcp 178.20.8.56 any $HOME_NET any (msg:"ads.krawall.de"; classtype:trojan-activity; priority:1;) alert tcp 178.217.244.6 any $HOME_NET any (msg:"ads2.xnet.cz"; classtype:trojan-activity; priority:1;) alert tcp 178.250.0.87 any $HOME_NET any (msg:"criteo.com"; classtype:trojan-activity; priority:1;) alert tcp 178.32.3.115 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 178.32.5.13 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 178.32.5.2 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;) alert tcp 178.33.210.24 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 178.63.121.138 any $HOME_NET any (msg:"pagerank-ranking.de"; classtype:trojan-activity; priority:1;) alert tcp 178.63.130.36 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 178.63.30.79 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;) alert tcp 178.63.45.1 any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;) alert tcp 178.63.48.27 any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;) alert tcp 178.63.48.50 any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;) alert tcp 178.73.224.61 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;) alert tcp 180.137.255.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 180.137.255.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 180.179.78.6 any $HOME_NET any (msg:"admagnet.net"; classtype:trojan-activity; priority:1;) alert tcp 180.188.130.168 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 180.188.173.89 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 180.96.17.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 180.96.17.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 182.131.17.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 182.131.17.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 182.140.130.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 182.140.130.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 182.48.20.237 any $HOME_NET any (msg:"clicktrack.ziyu.net"; classtype:trojan-activity; priority:1;) alert tcp 182.48.45.175 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;) alert tcp 183.60.136.42 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 183.60.136.43 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 183.60.136.44 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 183.60.136.45 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 183.60.136.46 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 183.60.136.65 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 184.105.177.9 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;) alert tcp 184.106.113.79 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;) alert tcp 184.106.162.192 any $HOME_NET any (msg:"profero.com"; classtype:trojan-activity; priority:1;) alert tcp 184.106.218.181 any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;) alert tcp 184.106.40.102 any $HOME_NET any (msg:"reedbusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 184.107.176.141 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;) alert tcp 184.107.179.18 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;) alert tcp 184.154.27.234 any $HOME_NET any (msg:"affiliates.babylon.com"; classtype:trojan-activity; priority:1;) alert tcp 184.154.42.132 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 184.154.83.2 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 184.164.68.45 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 184.168.192.134 any $HOME_NET any (msg:"audience2media.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.198.1 any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.11 any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.29 any $HOME_NET any (msg:"adexpose.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.32 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.35 any $HOME_NET any (msg:"adthis.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.44 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.5 any $HOME_NET any (msg:"fusionquest.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.52 any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.82 any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.83 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;) alert tcp 184.168.221.88 any $HOME_NET any (msg:"targetingnow.com"; classtype:trojan-activity; priority:1;) alert tcp 184.168.60.1 any $HOME_NET any (msg:"7bpeople.com"; classtype:trojan-activity; priority:1;) alert tcp 184.171.243.83 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 184.172.159.35 any $HOME_NET any (msg:"toplistcity.com"; classtype:trojan-activity; priority:1;) alert tcp 184.172.32.211 any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;) alert tcp 184.172.61.109 any $HOME_NET any (msg:"ads.co.com"; classtype:trojan-activity; priority:1;) alert tcp 184.173.144.76 any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;) alert tcp 184.173.170.82 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;) alert tcp 184.173.170.84 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;) alert tcp 184.173.190.238 any $HOME_NET any (msg:"aistat.net"; classtype:trojan-activity; priority:1;) alert tcp 184.173.198.30 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 184.173.227.227 any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;) alert tcp 184.72.145.174 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.217.144 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.222.11 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 184.72.222.208 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.222.69 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.223.181 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.225.218 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.230.138 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.238.78 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.243.126 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.251.95 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.252.42 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.48.158 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.49.147 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.53.95 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.55.242 any $HOME_NET any (msg:"bluewhaleweb.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.56.252 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.72.57.7 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.155.159 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.157.167 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.157.169 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.158.147 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.168.169 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.168.97 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.172.97 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.173.83 any $HOME_NET any (msg:"tapad.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.179.240 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.181.220 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.182.116 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.208.18 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.218.61 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.219.21 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.220.206 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.222.134 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.226.176 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.227.129 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.227.206 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.228.195 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.229.70 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.232.179 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.233.176 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.234.18 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.235.191 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 184.73.241.202 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 184.82.236.89 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 184.85.205.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 185.31.16.131 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 185.31.18.131 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 185.31.18.194 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 185.31.19.131 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 185.31.19.194 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 185.33.52.68 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;) alert tcp 187.31.192.6 any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;) alert tcp 188.120.246.197 any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 188.138.117.219 any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 188.138.16.84 any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 188.138.86.110 any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 188.165.126.242 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 188.165.17.196 any $HOME_NET any (msg:"novem.pl"; classtype:trojan-activity; priority:1;) alert tcp 188.165.32.146 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 188.165.32.158 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 188.165.32.199 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;) alert tcp 188.165.33.86 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 188.165.95.83 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 188.165.95.84 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 188.240.88.251 any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;) alert tcp 188.40.102.72 any $HOME_NET any (msg:"fc.webmasterpro.de"; classtype:trojan-activity; priority:1;) alert tcp 188.40.128.14 any $HOME_NET any (msg:"commindo-media-ressourcen.de"; classtype:trojan-activity; priority:1;) alert tcp 188.40.175.83 any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;) alert tcp 188.40.236.153 any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;) alert tcp 188.40.29.131 any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;) alert tcp 188.40.52.146 any $HOME_NET any (msg:"mypagerank.ru"; classtype:trojan-activity; priority:1;) alert tcp 188.40.68.199 any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;) alert tcp 188.40.81.145 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;) alert tcp 188.65.61.50 any $HOME_NET any (msg:"affiliatefuture.com"; classtype:trojan-activity; priority:1;) alert tcp 188.93.15.70 any $HOME_NET any (msg:"mr-rank.de"; classtype:trojan-activity; priority:1;) alert tcp 188.93.8.30 any $HOME_NET any (msg:"muwmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 188.95.224.186 any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;) alert tcp 188.95.49.42 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 190.210.100.72 any $HOME_NET any (msg:"harrenmedianetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 190.210.100.86 any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.240.10 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.240.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.240.178 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.240.42 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 190.93.241.10 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.241.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.241.178 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.242.10 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.242.166 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 190.93.243.10 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.243.166 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 190.93.243.41 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 190.93.244.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.245.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.246.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.247.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.248.22 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.249.22 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.250.41 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.250.67 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.251.41 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.251.67 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.252.179 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.252.31 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.252.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.253.179 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.253.31 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 190.93.253.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 192.0.80.247 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 192.0.80.248 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 192.104.182.105 any $HOME_NET any (msg:"adsys.townnews.com"; classtype:trojan-activity; priority:1;) alert tcp 192.104.182.111 any $HOME_NET any (msg:"stats.townnews.com"; classtype:trojan-activity; priority:1;) alert tcp 192.148.26.68 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;) alert tcp 192.155.48.93 any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;) alert tcp 192.155.50.93 any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;) alert tcp 192.185.21.186 any $HOME_NET any (msg:"topsite.lv"; classtype:trojan-activity; priority:1;) alert tcp 192.185.225.201 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 192.185.34.198 any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;) alert tcp 192.185.37.235 any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;) alert tcp 192.185.39.38 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;) alert tcp 192.185.99.201 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 192.185.99.63 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;) alert tcp 192.206.150.192 any $HOME_NET any (msg:"ads.thestar.com"; classtype:trojan-activity; priority:1;) alert tcp 192.221.106.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 192.221.111.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 192.221.111.253 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 192.221.115.254 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 192.221.120.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 192.221.97.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 192.237.150.253 any $HOME_NET any (msg:"ads.kelbymediagroup.com"; classtype:trojan-activity; priority:1;) alert tcp 192.237.165.27 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 192.245.235.5 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;) alert tcp 192.254.237.121 any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.13 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.143 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.149 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.162 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.17 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.22 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.23 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.24 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.31 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.51 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.31.186.8 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;) alert tcp 192.41.45.75 any $HOME_NET any (msg:"ads.internic.co.il"; classtype:trojan-activity; priority:1;) alert tcp 192.71.58.232 any $HOME_NET any (msg:"ads.fotosidan.se"; classtype:trojan-activity; priority:1;) alert tcp 192.95.22.192 any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;) alert tcp 192.95.33.163 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 193.105.127.48 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;) alert tcp 193.108.153.110 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;) alert tcp 193.108.153.133 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 193.108.89.46 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 193.108.89.48 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 193.108.89.49 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 193.110.128.200 any $HOME_NET any (msg:"elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 193.110.128.209 any $HOME_NET any (msg:"elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 193.110.128.212 any $HOME_NET any (msg:"elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 193.110.128.95 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 193.110.128.96 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 193.110.128.99 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 193.110.146.70 any $HOME_NET any (msg:"ktu.sv2.biz"; classtype:trojan-activity; priority:1;) alert tcp 193.110.146.71 any $HOME_NET any (msg:"ktu.sv2.biz"; classtype:trojan-activity; priority:1;) alert tcp 193.111.160.200 any $HOME_NET any (msg:"ads.hbv.de"; classtype:trojan-activity; priority:1;) alert tcp 193.111.199.175 any $HOME_NET any (msg:"addcontrol.net"; classtype:trojan-activity; priority:1;) alert tcp 193.126.240.136 any $HOME_NET any (msg:"ads1.mediacapital.pt"; classtype:trojan-activity; priority:1;) alert tcp 193.138.212.50 any $HOME_NET any (msg:"banner.buempliz-online.ch"; classtype:trojan-activity; priority:1;) alert tcp 193.138.214.40 any $HOME_NET any (msg:"banner.buempliz-online.ch"; classtype:trojan-activity; priority:1;) alert tcp 193.142.100.166 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;) alert tcp 193.149.47.98 any $HOME_NET any (msg:"ad.amgdgt.com"; classtype:trojan-activity; priority:1;) alert tcp 193.164.131.150 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 193.164.131.165 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 193.164.131.171 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 193.164.131.173 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 193.164.131.20 any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;) alert tcp 193.164.133.215 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 193.164.139.34 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 193.164.139.35 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 193.164.139.37 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 193.164.140.205 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;) alert tcp 193.169.234.204 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;) alert tcp 193.169.234.205 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;) alert tcp 193.17.41.167 any $HOME_NET any (msg:"ads.o2.pl"; classtype:trojan-activity; priority:1;) alert tcp 193.17.41.242 any $HOME_NET any (msg:"adserver.o2.pl"; classtype:trojan-activity; priority:1;) alert tcp 193.17.41.30 any $HOME_NET any (msg:"adserver.o2.pl"; classtype:trojan-activity; priority:1;) alert tcp 193.17.41.75 any $HOME_NET any (msg:"adserver.o2.pl"; classtype:trojan-activity; priority:1;) alert tcp 193.17.41.97 any $HOME_NET any (msg:"ads.o2.pl"; classtype:trojan-activity; priority:1;) alert tcp 193.178.145.193 any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;) alert tcp 193.189.137.205 any $HOME_NET any (msg:"quarterserver.de"; classtype:trojan-activity; priority:1;) alert tcp 193.19.137.248 any $HOME_NET any (msg:"webcounter.goweb.de"; classtype:trojan-activity; priority:1;) alert tcp 193.19.159.130 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;) alert tcp 193.19.159.131 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;) alert tcp 193.19.159.133 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;) alert tcp 193.192.41.2 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;) alert tcp 193.201.10.242 any $HOME_NET any (msg:"tfag.de"; classtype:trojan-activity; priority:1;) alert tcp 193.201.12.48 any $HOME_NET any (msg:"statistik.motorpresse.de"; classtype:trojan-activity; priority:1;) alert tcp 193.202.82.155 any $HOME_NET any (msg:"ads.deltha.hu"; classtype:trojan-activity; priority:1;) alert tcp 193.203.227.118 any $HOME_NET any (msg:"adserver.betandwin.de"; classtype:trojan-activity; priority:1;) alert tcp 193.22.164.62 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 193.227.204.179 any $HOME_NET any (msg:"ad.tv2.no"; classtype:trojan-activity; priority:1;) alert tcp 193.229.3.120 any $HOME_NET any (msg:"banner.elisa.net"; classtype:trojan-activity; priority:1;) alert tcp 193.231.202.29 any $HOME_NET any (msg:"ip.ro"; classtype:trojan-activity; priority:1;) alert tcp 193.239.249.18 any $HOME_NET any (msg:"partnercash.de"; classtype:trojan-activity; priority:1;) alert tcp 193.239.4.55 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;) alert tcp 193.239.5.103 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;) alert tcp 193.239.68.42 any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;) alert tcp 193.239.68.68 any $HOME_NET any (msg:"ad0.bigmir.net"; classtype:trojan-activity; priority:1;) alert tcp 193.239.68.78 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;) alert tcp 193.239.68.90 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;) alert tcp 193.24.252.33 any $HOME_NET any (msg:"ads.gamigo.de"; classtype:trojan-activity; priority:1;) alert tcp 193.24.255.11 any $HOME_NET any (msg:"ads.gamigo.de"; classtype:trojan-activity; priority:1;) alert tcp 193.252.138.38 any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;) alert tcp 193.252.138.84 any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;) alert tcp 193.252.242.154 any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;) alert tcp 193.252.242.218 any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;) alert tcp 193.254.184.86 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 193.254.241.63 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;) alert tcp 193.254.241.64 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;) alert tcp 193.28.195.17 any $HOME_NET any (msg:"adserver.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 193.28.197.214 any $HOME_NET any (msg:"adserver.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 193.28.197.91 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 193.33.115.57 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;) alert tcp 193.33.115.64 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;) alert tcp 193.34.150.139 any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.110 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.111 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.113 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.118 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.70 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.71 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.73 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.82 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.94 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.95 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;) alert tcp 193.45.1.96 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;) alert tcp 193.45.10.95 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 193.45.10.97 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 193.56.143.16 any $HOME_NET any (msg:"ads.kompass.com"; classtype:trojan-activity; priority:1;) alert tcp 193.68.35.131 any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;) alert tcp 193.68.35.136 any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;) alert tcp 193.68.35.149 any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;) alert tcp 193.84.187.9 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;) alert tcp 193.85.207.202 any $HOME_NET any (msg:"counter.cnw.cz"; classtype:trojan-activity; priority:1;) alert tcp 193.85.232.68 any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;) alert tcp 193.85.232.69 any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;) alert tcp 193.85.233.130 any $HOME_NET any (msg:"ad.hyena.cz"; classtype:trojan-activity; priority:1;) alert tcp 193.86.103.74 any $HOME_NET any (msg:"webcounter.cz"; classtype:trojan-activity; priority:1;) alert tcp 193.88.187.9 any $HOME_NET any (msg:"instadia.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.111 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.114 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.141 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.149 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.150 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.154 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.155 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.156 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.158 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.161 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.163 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.164 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.165 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.167 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.168 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.170 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.71.172 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 193.88.89.178 any $HOME_NET any (msg:"banner.webdmz.tv2.dk"; classtype:trojan-activity; priority:1;) alert tcp 193.88.89.48 any $HOME_NET any (msg:"banner.webdmz.tv2.dk"; classtype:trojan-activity; priority:1;) alert tcp 193.91.69.232 any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;) alert tcp 194.0.131.16 any $HOME_NET any (msg:"stat24.meta.ua"; classtype:trojan-activity; priority:1;) alert tcp 194.100.134.17 any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;) alert tcp 194.100.134.20 any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;) alert tcp 194.100.33.176 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 194.100.33.178 any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 194.103.17.20 any $HOME_NET any (msg:"ads.fotosidan.se"; classtype:trojan-activity; priority:1;) alert tcp 194.105.56.11 any $HOME_NET any (msg:"hits.puls.lv"; classtype:trojan-activity; priority:1;) alert tcp 194.107.19.164 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 194.108.10.68 any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 194.108.76.226 any $HOME_NET any (msg:"add.newmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 194.110.246.62 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 194.116.154.20 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;) alert tcp 194.116.167.31 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;) alert tcp 194.116.167.51 any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;) alert tcp 194.116.167.56 any $HOME_NET any (msg:"affiliatewindow.com"; classtype:trojan-activity; priority:1;) alert tcp 194.126.131.54 any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;) alert tcp 194.126.157.60 any $HOME_NET any (msg:"estat.com"; classtype:trojan-activity; priority:1;) alert tcp 194.126.157.64 any $HOME_NET any (msg:"estat.com"; classtype:trojan-activity; priority:1;) alert tcp 194.135.19.60 any $HOME_NET any (msg:"rate.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.146.224.73 any $HOME_NET any (msg:"provexia.com"; classtype:trojan-activity; priority:1;) alert tcp 194.149.10.19 any $HOME_NET any (msg:"indexstats.com"; classtype:trojan-activity; priority:1;) alert tcp 194.149.10.56 any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;) alert tcp 194.149.10.57 any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;) alert tcp 194.149.10.58 any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;) alert tcp 194.154.228.75 any $HOME_NET any (msg:"naj.sk"; classtype:trojan-activity; priority:1;) alert tcp 194.158.120.145 any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;) alert tcp 194.158.121.145 any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;) alert tcp 194.169.128.28 any $HOME_NET any (msg:"banners.thomsonlocal.com"; classtype:trojan-activity; priority:1;) alert tcp 194.169.129.228 any $HOME_NET any (msg:"banners.thomsonlocal.com"; classtype:trojan-activity; priority:1;) alert tcp 194.169.201.115 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;) alert tcp 194.169.201.160 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;) alert tcp 194.169.201.166 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;) alert tcp 194.169.201.252 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;) alert tcp 194.17.24.163 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.24.164 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.24.230 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.24.231 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.24.232 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.24.233 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.179 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.181 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.182 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.183 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.184 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.185 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.186 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.187 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.188 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.17.45.189 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;) alert tcp 194.177.4.133 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;) alert tcp 194.177.4.217 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;) alert tcp 194.186.25.4 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.186.36.222 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.186.88.102 any $HOME_NET any (msg:"adland.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.187.110.81 any $HOME_NET any (msg:"uarating.com"; classtype:trojan-activity; priority:1;) alert tcp 194.187.96.138 any $HOME_NET any (msg:"cjlog.com"; classtype:trojan-activity; priority:1;) alert tcp 194.20.232.3 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;) alert tcp 194.203.155.31 any $HOME_NET any (msg:"reedbusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 194.213.53.208 any $HOME_NET any (msg:"adrenaline.cz"; classtype:trojan-activity; priority:1;) alert tcp 194.213.62.37 any $HOME_NET any (msg:"billboard.cz"; classtype:trojan-activity; priority:1;) alert tcp 194.213.62.41 any $HOME_NET any (msg:"billboard.cz"; classtype:trojan-activity; priority:1;) alert tcp 194.228.50.121 any $HOME_NET any (msg:"adrenaline.cz"; classtype:trojan-activity; priority:1;) alert tcp 194.230.33.138 any $HOME_NET any (msg:"admanagement.ch"; classtype:trojan-activity; priority:1;) alert tcp 194.230.33.167 any $HOME_NET any (msg:"admanagement.ch"; classtype:trojan-activity; priority:1;) alert tcp 194.232.105.60 any $HOME_NET any (msg:"oewa.at"; classtype:trojan-activity; priority:1;) alert tcp 194.236.124.44 any $HOME_NET any (msg:"banner.linux.se"; classtype:trojan-activity; priority:1;) alert tcp 194.24.252.203 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;) alert tcp 194.24.252.208 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;) alert tcp 194.24.252.213 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;) alert tcp 194.24.252.215 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;) alert tcp 194.24.252.217 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;) alert tcp 194.244.107.100 any $HOME_NET any (msg:"oas.repubblica.it"; classtype:trojan-activity; priority:1;) alert tcp 194.58.78.43 any $HOME_NET any (msg:"rate.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.6.248.18 any $HOME_NET any (msg:"ads.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 194.63.248.27 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 194.63.248.47 any $HOME_NET any (msg:"i1media.no"; classtype:trojan-activity; priority:1;) alert tcp 194.65.79.159 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;) alert tcp 194.65.79.50 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;) alert tcp 194.67.23.251 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.67.32.247 any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.67.35.133 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;) alert tcp 194.67.35.205 any $HOME_NET any (msg:"mytrix.com"; classtype:trojan-activity; priority:1;) alert tcp 194.67.45.100 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.67.45.105 any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.67.45.123 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.67.45.98 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.70.234.209 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 194.70.234.215 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 194.71.107.25 any $HOME_NET any (msg:"anus.thepiratebay.tw"; classtype:trojan-activity; priority:1;) alert tcp 194.72.108.14 any $HOME_NET any (msg:"bannersng.yell.com"; classtype:trojan-activity; priority:1;) alert tcp 194.8.80.8 any $HOME_NET any (msg:"ip.ro"; classtype:trojan-activity; priority:1;) alert tcp 194.84.16.2 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.84.16.3 any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 194.9.24.129 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;) alert tcp 194.9.24.130 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;) alert tcp 194.9.24.131 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;) alert tcp 194.9.24.132 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;) alert tcp 194.9.24.153 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;) alert tcp 194.9.94.245 any $HOME_NET any (msg:"blogtoppen.se"; classtype:trojan-activity; priority:1;) alert tcp 194.9.94.85 any $HOME_NET any (msg:"blogtoppen.se"; classtype:trojan-activity; priority:1;) alert tcp 194.9.94.86 any $HOME_NET any (msg:"blogtoppen.se"; classtype:trojan-activity; priority:1;) alert tcp 194.9.95.245 any $HOME_NET any (msg:"blogtoppen.se"; classtype:trojan-activity; priority:1;) alert tcp 194.98.19.1 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 194.98.19.196 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 194.98.19.20 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 194.98.19.21 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 194.98.19.241 any $HOME_NET any (msg:"hit-parade.com"; classtype:trojan-activity; priority:1;) alert tcp 194.98.19.28 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 194.98.19.30 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 195.10.195.150 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 195.10.195.151 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 195.10.195.152 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 195.10.195.153 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 195.10.195.154 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 195.10.195.155 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 195.10.195.227 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 195.110.103.3 any $HOME_NET any (msg:"ads.dada.it"; classtype:trojan-activity; priority:1;) alert tcp 195.110.122.162 any $HOME_NET any (msg:"ads.dada.it"; classtype:trojan-activity; priority:1;) alert tcp 195.110.126.136 any $HOME_NET any (msg:"banner.supereva.it"; classtype:trojan-activity; priority:1;) alert tcp 195.113.150.15 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.228.34 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.228.36 any $HOME_NET any (msg:"annonser.dagbladet.no"; classtype:trojan-activity; priority:1;) alert tcp 195.12.228.37 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.228.38 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.228.39 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.228.40 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.228.41 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.197 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.198 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.200 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.201 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.202 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.205 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.206 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.207 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.208 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.209 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.210 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.211 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.212 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.214 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.218 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.219 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.12.231.222 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 195.121.7.193 any $HOME_NET any (msg:"ads.planet.nl"; classtype:trojan-activity; priority:1;) alert tcp 195.122.194.228 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.122.194.234 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.122.194.236 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.122.194.240 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.122.194.246 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.130.225.240 any $HOME_NET any (msg:"ad.tiscali.com"; classtype:trojan-activity; priority:1;) alert tcp 195.131.4.166 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.137.184.101 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 195.137.184.7 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 195.14.94.9 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 195.140.186.100 any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;) alert tcp 195.140.186.101 any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;) alert tcp 195.140.186.102 any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;) alert tcp 195.140.186.183 any $HOME_NET any (msg:"ecircle-ag.com"; classtype:trojan-activity; priority:1;) alert tcp 195.146.100.126 any $HOME_NET any (msg:"reklama.mironet.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.149.105.37 any $HOME_NET any (msg:"a.sakh.com"; classtype:trojan-activity; priority:1;) alert tcp 195.151.251.41 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.161.119.52 any $HOME_NET any (msg:"www-banner.chat.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.161.119.84 any $HOME_NET any (msg:"www-banner.chat.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.161.119.85 any $HOME_NET any (msg:"www-banner.chat.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.165.77.52 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 195.165.77.53 any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 195.167.100.193 any $HOME_NET any (msg:"adman.otenet.gr"; classtype:trojan-activity; priority:1;) alert tcp 195.167.20.40 any $HOME_NET any (msg:"adman.otenet.gr"; classtype:trojan-activity; priority:1;) alert tcp 195.168.10.150 any $HOME_NET any (msg:"etargetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 195.168.10.35 any $HOME_NET any (msg:"partner.pelikan.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.170.124.167 any $HOME_NET any (msg:"foo.cosmocode.de"; classtype:trojan-activity; priority:1;) alert tcp 195.170.168.1 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;) alert tcp 195.170.168.136 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;) alert tcp 195.170.168.2 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;) alert tcp 195.170.168.6 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;) alert tcp 195.170.99.24 any $HOME_NET any (msg:"mediascale.de"; classtype:trojan-activity; priority:1;) alert tcp 195.171.206.205 any $HOME_NET any (msg:"ads.jobsite.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 195.179.163.1 any $HOME_NET any (msg:"mediavantage.de"; classtype:trojan-activity; priority:1;) alert tcp 195.189.118.37 any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;) alert tcp 195.189.143.135 any $HOME_NET any (msg:"promote.opera.com"; classtype:trojan-activity; priority:1;) alert tcp 195.189.236.35 any $HOME_NET any (msg:"affili.net"; classtype:trojan-activity; priority:1;) alert tcp 195.193.95.230 any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;) alert tcp 195.2.64.1 any $HOME_NET any (msg:"stat.zenon.net"; classtype:trojan-activity; priority:1;) alert tcp 195.2.82.69 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.20.224.83 any $HOME_NET any (msg:"cgicounter.puretec.de"; classtype:trojan-activity; priority:1;) alert tcp 195.20.225.24 any $HOME_NET any (msg:"cgicounter.puretec.de"; classtype:trojan-activity; priority:1;) alert tcp 195.20.249.19 any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;) alert tcp 195.204.232.34 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 195.204.232.40 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 195.210.96.10 any $HOME_NET any (msg:"shinystat.com"; classtype:trojan-activity; priority:1;) alert tcp 195.210.96.8 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;) alert tcp 195.214.243.112 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 195.214.243.117 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.17 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.18 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.19 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.2 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.20 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.21 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.22 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.23 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.24 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.25 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.26 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.27 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.28 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.29 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.30 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.216.243.7 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.71 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.72 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.73 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.74 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.75 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.76 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.77 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.78 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.79 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.80 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.81 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.82 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.83 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.84 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.85 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.86 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.87 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.88 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.89 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.219.3.90 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.22.10.107 any $HOME_NET any (msg:"nitroclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 195.224.235.182 any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;) alert tcp 195.225.196.197 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;) alert tcp 195.225.196.215 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;) alert tcp 195.228.155.159 any $HOME_NET any (msg:"reklamcsere.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.228.156.206 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;) alert tcp 195.228.254.126 any $HOME_NET any (msg:"reklamcsere.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.228.254.53 any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.228.45.195 any $HOME_NET any (msg:"ad.wavu.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.228.75.120 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;) alert tcp 195.228.75.156 any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.228.75.171 any $HOME_NET any (msg:"ad.wavu.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.228.75.214 any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.228.75.92 any $HOME_NET any (msg:"ad.mediastorm.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.229.240.108 any $HOME_NET any (msg:"ads.emirates.net.ae"; classtype:trojan-activity; priority:1;) alert tcp 195.235.97.80 any $HOME_NET any (msg:"ads.ole.com"; classtype:trojan-activity; priority:1;) alert tcp 195.239.86.26 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.242.117.32 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 195.245.125.226 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 195.245.125.243 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 195.245.179.177 any $HOME_NET any (msg:"adserver.portugalmail.net"; classtype:trojan-activity; priority:1;) alert tcp 195.246.99.153 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;) alert tcp 195.248.250.50 any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;) alert tcp 195.248.251.137 any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;) alert tcp 195.248.83.71 any $HOME_NET any (msg:"comprabanner.it"; classtype:trojan-activity; priority:1;) alert tcp 195.249.40.10 any $HOME_NET any (msg:"stat.cliche.se"; classtype:trojan-activity; priority:1;) alert tcp 195.250.147.210 any $HOME_NET any (msg:"banners.czi.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.250.204.84 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 195.26.11.160 any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;) alert tcp 195.27.248.187 any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;) alert tcp 195.28.79.58 any $HOME_NET any (msg:"etargetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 195.34.132.38 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 195.36.162.14 any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;) alert tcp 195.36.166.14 any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;) alert tcp 195.39.196.36 any $HOME_NET any (msg:"counter.mirohost.net"; classtype:trojan-activity; priority:1;) alert tcp 195.39.234.210 any $HOME_NET any (msg:"ads.hbv.de"; classtype:trojan-activity; priority:1;) alert tcp 195.39.44.210 any $HOME_NET any (msg:"banik.redigy.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.41.47.113 any $HOME_NET any (msg:"au2m8.com"; classtype:trojan-activity; priority:1;) alert tcp 195.47.108.138 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.47.116.72 any $HOME_NET any (msg:"window.nixnet.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.47.86.2 any $HOME_NET any (msg:"bm.annonce.cz"; classtype:trojan-activity; priority:1;) alert tcp 195.5.165.34 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 195.5.165.35 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 195.5.165.37 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 195.52.220.67 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 195.54.192.200 any $HOME_NET any (msg:"rotabanner.com"; classtype:trojan-activity; priority:1;) alert tcp 195.54.192.50 any $HOME_NET any (msg:"musiccounter.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.54.209.9 any $HOME_NET any (msg:"musiccounter.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.54.48.30 any $HOME_NET any (msg:"weborama.fr"; classtype:trojan-activity; priority:1;) alert tcp 195.56.44.150 any $HOME_NET any (msg:"ads.deltha.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.56.77.184 any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;) alert tcp 195.60.188.38 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;) alert tcp 195.60.188.68 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;) alert tcp 195.60.77.145 any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;) alert tcp 195.62.28.74 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 195.68.160.179 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.68.160.185 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.68.160.186 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.69.128.11 any $HOME_NET any (msg:"partner-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 195.69.131.37 any $HOME_NET any (msg:"partner-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 195.70.16.138 any $HOME_NET any (msg:"ads-click.com"; classtype:trojan-activity; priority:1;) alert tcp 195.71.93.131 any $HOME_NET any (msg:"adscale.de"; classtype:trojan-activity; priority:1;) alert tcp 195.77.175.83 any $HOME_NET any (msg:"ad.anuntis.com"; classtype:trojan-activity; priority:1;) alert tcp 195.77.175.85 any $HOME_NET any (msg:"ad.anuntis.com"; classtype:trojan-activity; priority:1;) alert tcp 195.77.179.23 any $HOME_NET any (msg:"ad.anuntis.com"; classtype:trojan-activity; priority:1;) alert tcp 195.78.108.3 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.78.229.201 any $HOME_NET any (msg:"sixsigmatraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 195.78.94.139 any $HOME_NET any (msg:"hexusads.fluent.ltd.uk"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.101 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.102 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.103 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.104 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.105 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.106 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.107 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.108 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.109 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.110 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.111 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.112 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.113 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.114 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.115 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.116 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.117 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.118 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.119 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.81.202.120 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 195.85.207.39 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;) alert tcp 195.85.228.168 any $HOME_NET any (msg:"comprabanner.it"; classtype:trojan-activity; priority:1;) alert tcp 195.85.228.61 any $HOME_NET any (msg:"comprabanner.it"; classtype:trojan-activity; priority:1;) alert tcp 195.9.14.160 any $HOME_NET any (msg:"rate.ru"; classtype:trojan-activity; priority:1;) alert tcp 195.90.249.17 any $HOME_NET any (msg:"wondoads.de"; classtype:trojan-activity; priority:1;) alert tcp 195.93.85.51 any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;) alert tcp 195.95.133.41 any $HOME_NET any (msg:"accounts.pkr.com"; classtype:trojan-activity; priority:1;) alert tcp 196.2.24.20 any $HOME_NET any (msg:"banner.coza.com"; classtype:trojan-activity; priority:1;) alert tcp 196.2.63.180 any $HOME_NET any (msg:"banner.coza.com"; classtype:trojan-activity; priority:1;) alert tcp 196.30.168.91 any $HOME_NET any (msg:"adsrv.iol.co.za"; classtype:trojan-activity; priority:1;) alert tcp 196.34.149.71 any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;) alert tcp 196.38.17.67 any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;) alert tcp 196.38.17.68 any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;) alert tcp 198.1.115.107 any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;) alert tcp 198.104.159.65 any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;) alert tcp 198.105.193.19 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;) alert tcp 198.136.202.114 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;) alert tcp 198.136.202.143 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;) alert tcp 198.136.27.250 any $HOME_NET any (msg:"ads.kaktuz.net"; classtype:trojan-activity; priority:1;) alert tcp 198.142.76.100 any $HOME_NET any (msg:"ads.optusnet.com.au"; classtype:trojan-activity; priority:1;) alert tcp 198.145.117.105 any $HOME_NET any (msg:"pheedo.com"; classtype:trojan-activity; priority:1;) alert tcp 198.145.13.21 any $HOME_NET any (msg:"roxr.net"; classtype:trojan-activity; priority:1;) alert tcp 198.161.157.218 any $HOME_NET any (msg:"cityads.telus.net"; classtype:trojan-activity; priority:1;) alert tcp 198.172.202.250 any $HOME_NET any (msg:"specificclick.net"; classtype:trojan-activity; priority:1;) alert tcp 198.172.81.32 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 198.172.81.42 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 198.202.142.18 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;) alert tcp 198.202.142.20 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;) alert tcp 198.202.142.229 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;) alert tcp 198.202.143.18 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;) alert tcp 198.202.143.20 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;) alert tcp 198.23.53.105 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;) alert tcp 198.252.98.40 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 198.41.185.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;) alert tcp 198.41.186.34 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 198.41.186.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;) alert tcp 198.41.187.34 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 198.41.187.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;) alert tcp 198.41.188.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;) alert tcp 198.41.189.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;) alert tcp 198.51.152.82 any $HOME_NET any (msg:"tapad.com"; classtype:trojan-activity; priority:1;) alert tcp 198.51.152.83 any $HOME_NET any (msg:"tapad.com"; classtype:trojan-activity; priority:1;) alert tcp 198.58.123.32 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 198.64.128.97 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 198.64.134.121 any $HOME_NET any (msg:"herbalaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 198.65.102.164 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;) alert tcp 198.65.102.87 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;) alert tcp 198.65.116.34 any $HOME_NET any (msg:"humanclick.com"; classtype:trojan-activity; priority:1;) alert tcp 198.65.119.21 any $HOME_NET any (msg:"iad.liveperson.net"; classtype:trojan-activity; priority:1;) alert tcp 198.65.134.58 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;) alert tcp 198.65.152.9 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 198.74.57.251 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 198.74.62.254 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 198.77.36.41 any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;) alert tcp 198.78.210.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 198.78.212.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 198.78.219.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 198.80.189.106 any $HOME_NET any (msg:"adserver.janes.com"; classtype:trojan-activity; priority:1;) alert tcp 198.87.214.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 198.98.113.3 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 198.98.113.65 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 199.106.209.244 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;) alert tcp 199.106.213.104 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;) alert tcp 199.107.237.207 any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.11 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.17 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.19 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.72 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.73 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.74 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.75 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.76 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.122.7.77 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 199.15.160.100 any $HOME_NET any (msg:"adsrv.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 199.15.160.110 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 199.15.160.120 any $HOME_NET any (msg:"adsrv.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 199.15.160.121 any $HOME_NET any (msg:"adcast.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 199.15.160.36 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 199.15.160.37 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 199.181.132.207 any $HOME_NET any (msg:"log.go.com"; classtype:trojan-activity; priority:1;) alert tcp 199.181.132.250 any $HOME_NET any (msg:"ad.infoseek.com"; classtype:trojan-activity; priority:1;) alert tcp 199.181.132.80 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;) alert tcp 199.182.216.202 any $HOME_NET any (msg:"ads.pof.com"; classtype:trojan-activity; priority:1;) alert tcp 199.19.200.170 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 199.19.200.172 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 199.193.10.100 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;) alert tcp 199.193.10.122 any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;) alert tcp 199.193.10.150 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;) alert tcp 199.193.10.30 any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;) alert tcp 199.193.10.50 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;) alert tcp 199.193.10.90 any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 199.193.13.50 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;) alert tcp 199.193.13.90 any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 199.193.9.23 any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;) alert tcp 199.204.137.111 any $HOME_NET any (msg:"adzerk.net"; classtype:trojan-activity; priority:1;) alert tcp 199.21.148.10 any $HOME_NET any (msg:"yesadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 199.21.148.39 any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;) alert tcp 199.21.148.42 any $HOME_NET any (msg:"lzjl.com"; classtype:trojan-activity; priority:1;) alert tcp 199.212.222.22 any $HOME_NET any (msg:"reedbusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 199.231.210.200 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 199.233.57.41 any $HOME_NET any (msg:"crwdcntrl.net"; classtype:trojan-activity; priority:1;) alert tcp 199.239.136.200 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;) alert tcp 199.239.136.245 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;) alert tcp 199.239.137.200 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;) alert tcp 199.239.137.245 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;) alert tcp 199.27.134.14 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 199.27.134.67 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 199.27.134.96 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 199.27.134.98 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 199.27.135.14 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 199.27.135.67 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 199.27.135.98 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 199.27.76.131 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 199.27.76.194 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 199.27.76.5 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 199.27.77.131 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 199.27.77.194 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 199.34.228.130 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;) alert tcp 199.38.164.173 any $HOME_NET any (msg:"xplusone.com"; classtype:trojan-activity; priority:1;) alert tcp 199.38.164.180 any $HOME_NET any (msg:"xplusone.com"; classtype:trojan-activity; priority:1;) alert tcp 199.38.181.237 any $HOME_NET any (msg:"ads-click.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.179 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.181 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.182 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.183 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.184 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.185 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.186 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.188 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.189 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.203 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.207 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.209 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.214 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.215 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.216 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.218 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.241.250 any $HOME_NET any (msg:"adtology.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.243.105 any $HOME_NET any (msg:"topforall.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.243.118 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.243.120 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.59.243.92 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.80.54.47 any $HOME_NET any (msg:"mgid.com"; classtype:trojan-activity; priority:1;) alert tcp 199.83.128.192 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 199.83.130.4 any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;) alert tcp 199.83.132.192 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 199.85.4.63 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 199.93.42.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 199.93.54.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 199.93.57.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 199.93.57.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 199.95.206.210 any $HOME_NET any (msg:"doubleclick.de"; classtype:trojan-activity; priority:1;) alert tcp 2.16.11.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 2.16.139.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 2.16.157.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 2.16.31.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 2.16.57.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 2.16.59.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 2.16.63.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 2.16.65.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 2.18.115.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.18.118.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 2.18.120.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.18.125.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 2.18.13.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 2.18.6.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 2.18.70.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 2.18.77.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 2.18.8.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.115.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.120.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.125.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.147.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.150.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.152.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.157.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.200.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.211.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.19.221.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 2.21.211.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.21.214.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 2.21.216.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 2.21.221.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 200.123.152.52 any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 200.123.152.61 any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 200.140.126.104 any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.140.126.105 any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.140.126.106 any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.147.3.170 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.147.35.170 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.147.67.170 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.173.74.162 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.203.43.161 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.221.7.120 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.221.7.121 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.221.7.122 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.221.7.70 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;) alert tcp 200.69.192.231 any $HOME_NET any (msg:"ads.e-planning.net"; classtype:trojan-activity; priority:1;) alert tcp 200.69.192.239 any $HOME_NET any (msg:"ads.e-planning.net"; classtype:trojan-activity; priority:1;) alert tcp 200.98.211.10 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;) alert tcp 201.235.35.25 any $HOME_NET any (msg:"harrenmedianetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 202.100.74.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 202.100.74.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 202.101.62.9 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;) alert tcp 202.104.150.118 any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;) alert tcp 202.104.236.112 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.104.236.113 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.104.236.144 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.104.236.224 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.104.236.38 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.104.237.194 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.104.237.200 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.104.237.201 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.104.237.211 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 202.134.124.142 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 202.137.236.25 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 202.137.237.29 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 202.137.239.21 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 202.138.113.146 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 202.139.106.179 any $HOME_NET any (msg:"adserver.news.com.au"; classtype:trojan-activity; priority:1;) alert tcp 202.139.107.20 any $HOME_NET any (msg:"adserver.news.com.au"; classtype:trojan-activity; priority:1;) alert tcp 202.139.94.37 any $HOME_NET any (msg:"clixgalore.com"; classtype:trojan-activity; priority:1;) alert tcp 202.170.120.110 any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;) alert tcp 202.170.120.99 any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;) alert tcp 202.172.236.75 any $HOME_NET any (msg:"ad01.mediacorpsingapore.com"; classtype:trojan-activity; priority:1;) alert tcp 202.177.198.92 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 202.222.31.77 any $HOME_NET any (msg:"xrea.com"; classtype:trojan-activity; priority:1;) alert tcp 202.228.239.198 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;) alert tcp 202.239.162.253 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;) alert tcp 202.248.228.20 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 202.27.184.50 any $HOME_NET any (msg:"ads.xtra.co.nz"; classtype:trojan-activity; priority:1;) alert tcp 202.30.198.36 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;) alert tcp 202.43.202.46 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 202.7.109.106 any $HOME_NET any (msg:"adjustnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 202.85.137.13 any $HOME_NET any (msg:"bannerserver.com"; classtype:trojan-activity; priority:1;) alert tcp 203.110.143.97 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 203.140.231.149 any $HOME_NET any (msg:"ads.gplusmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 203.140.231.150 any $HOME_NET any (msg:"ads.gplusmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 203.151.21.60 any $HOME_NET any (msg:"truehits.net"; classtype:trojan-activity; priority:1;) alert tcp 203.166.18.103 any $HOME_NET any (msg:"imrworldwide.com"; classtype:trojan-activity; priority:1;) alert tcp 203.166.18.175 any $HOME_NET any (msg:"imrworldwide.com"; classtype:trojan-activity; priority:1;) alert tcp 203.166.18.221 any $HOME_NET any (msg:"imrworldwide.com"; classtype:trojan-activity; priority:1;) alert tcp 203.169.9.169 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;) alert tcp 203.174.66.131 any $HOME_NET any (msg:"custom-click.com"; classtype:trojan-activity; priority:1;) alert tcp 203.179.90.162 any $HOME_NET any (msg:"tatsumi-sys.jp"; classtype:trojan-activity; priority:1;) alert tcp 203.190.224.60 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 203.199.83.180 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 203.199.83.53 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 203.2.192.124 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 203.202.150.138 any $HOME_NET any (msg:"clixgalore.com"; classtype:trojan-activity; priority:1;) alert tcp 203.26.5.11 any $HOME_NET any (msg:"admonitor.com"; classtype:trojan-activity; priority:1;) alert tcp 203.26.51.157 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;) alert tcp 203.26.51.172 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;) alert tcp 203.26.51.50 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;) alert tcp 203.27.227.29 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;) alert tcp 203.69.40.90 any $HOME_NET any (msg:"hotrank.com.tw"; classtype:trojan-activity; priority:1;) alert tcp 203.84.214.58 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 204.1.152.68 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 204.1.154.218 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 204.1.154.228 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 204.1.155.74 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 204.11.109.133 any $HOME_NET any (msg:"tribalfusion.com"; classtype:trojan-activity; priority:1;) alert tcp 204.11.109.134 any $HOME_NET any (msg:"exponential.com"; classtype:trojan-activity; priority:1;) alert tcp 204.11.109.70 any $HOME_NET any (msg:"tribalfusion.com"; classtype:trojan-activity; priority:1;) alert tcp 204.11.32.22 any $HOME_NET any (msg:"pro-market.net"; classtype:trojan-activity; priority:1;) alert tcp 204.11.33.22 any $HOME_NET any (msg:"pro-market.net"; classtype:trojan-activity; priority:1;) alert tcp 204.11.51.35 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;) alert tcp 204.11.52.68 any $HOME_NET any (msg:"blogtopsites.com"; classtype:trojan-activity; priority:1;) alert tcp 204.11.56.21 any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;) alert tcp 204.12.68.104 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;) alert tcp 204.12.89.69 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;) alert tcp 204.12.89.76 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;) alert tcp 204.128.175.252 any $HOME_NET any (msg:"adserver.theonering.net"; classtype:trojan-activity; priority:1;) alert tcp 204.13.160.129 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;) alert tcp 204.13.160.131 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 204.13.160.134 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 204.13.161.127 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 204.13.161.23 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 204.13.248.125 any $HOME_NET any (msg:"mopub.com"; classtype:trojan-activity; priority:1;) alert tcp 204.13.8.18 any $HOME_NET any (msg:"roxr.net"; classtype:trojan-activity; priority:1;) alert tcp 204.13.8.76 any $HOME_NET any (msg:"roxr.net"; classtype:trojan-activity; priority:1;) alert tcp 204.137.28.46 any $HOME_NET any (msg:"ads.ibryte.com"; classtype:trojan-activity; priority:1;) alert tcp 204.145.237.105 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 204.145.71.140 any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;) alert tcp 204.15.193.131 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;) alert tcp 204.152.207.98 any $HOME_NET any (msg:"mgid.com"; classtype:trojan-activity; priority:1;) alert tcp 204.152.99.164 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;) alert tcp 204.155.175.102 any $HOME_NET any (msg:"ads.pni.com"; classtype:trojan-activity; priority:1;) alert tcp 204.155.175.112 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;) alert tcp 204.155.175.115 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;) alert tcp 204.155.175.116 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;) alert tcp 204.155.175.117 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;) alert tcp 204.155.175.201 any $HOME_NET any (msg:"ads.pni.com"; classtype:trojan-activity; priority:1;) alert tcp 204.155.175.242 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;) alert tcp 204.16.252.98 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;) alert tcp 204.160.120.125 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 204.160.98.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 204.160.98.253 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 204.176.177.140 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 204.176.88.14 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 204.181.14.4 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 204.183.113.68 any $HOME_NET any (msg:"percentmobile.com"; classtype:trojan-activity; priority:1;) alert tcp 204.197.240.133 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 204.202.132.19 any $HOME_NET any (msg:"ad.infoseek.com"; classtype:trojan-activity; priority:1;) alert tcp 204.202.148.19 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;) alert tcp 204.213.185.13 any $HOME_NET any (msg:"ads.grindinggears.com"; classtype:trojan-activity; priority:1;) alert tcp 204.232.157.46 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 204.236.230.121 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 204.236.237.158 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 204.244.102.6 any $HOME_NET any (msg:"ads.activestate.com"; classtype:trojan-activity; priority:1;) alert tcp 204.251.15.153 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 204.251.15.160 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 204.251.15.169 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 204.251.15.171 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 204.251.15.174 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 204.251.15.175 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 204.251.15.193 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 204.253.104.220 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 204.71.191.220 any $HOME_NET any (msg:"leader.linkexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 204.71.191.94 any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 204.79.197.200 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;) alert tcp 204.8.169.150 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;) alert tcp 204.8.169.182 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;) alert tcp 204.8.169.214 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;) alert tcp 204.8.169.246 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;) alert tcp 204.8.49.19 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 204.8.49.20 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 204.9.177.90 any $HOME_NET any (msg:"videoegg.com"; classtype:trojan-activity; priority:1;) alert tcp 204.9.178.17 any $HOME_NET any (msg:"videoegg.com"; classtype:trojan-activity; priority:1;) alert tcp 204.93.155.71 any $HOME_NET any (msg:"mrskincash.com"; classtype:trojan-activity; priority:1;) alert tcp 205.128.68.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 205.128.78.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 205.128.82.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 205.128.85.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 205.128.90.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 205.128.95.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 205.128.95.254 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 205.134.165.70 any $HOME_NET any (msg:"clickbrokers.com"; classtype:trojan-activity; priority:1;) alert tcp 205.134.169.121 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;) alert tcp 205.134.177.105 any $HOME_NET any (msg:"bannerspace.com"; classtype:trojan-activity; priority:1;) alert tcp 205.134.177.110 any $HOME_NET any (msg:"bannerspace.com"; classtype:trojan-activity; priority:1;) alert tcp 205.138.3.230 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 205.139.101.150 any $HOME_NET any (msg:"admax.nexage.com"; classtype:trojan-activity; priority:1;) alert tcp 205.139.28.97 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 205.139.40.76 any $HOME_NET any (msg:"wdads.sx.atl.publicus.com"; classtype:trojan-activity; priority:1;) alert tcp 205.144.161.42 any $HOME_NET any (msg:"eurekster.com"; classtype:trojan-activity; priority:1;) alert tcp 205.150.0.180 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 205.153.84.207 any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;) alert tcp 205.153.85.31 any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;) alert tcp 205.178.145.65 any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;) alert tcp 205.178.152.39 any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;) alert tcp 205.178.187.14 any $HOME_NET any (msg:"ads.networksolutions.com"; classtype:trojan-activity; priority:1;) alert tcp 205.178.189.128 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 205.178.189.131 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 205.178.190.66 any $HOME_NET any (msg:"phoenix-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;) alert tcp 205.178.190.75 any $HOME_NET any (msg:"superstats.com"; classtype:trojan-activity; priority:1;) alert tcp 205.180.85.15 any $HOME_NET any (msg:"adserver.com"; classtype:trojan-activity; priority:1;) alert tcp 205.180.85.18 any $HOME_NET any (msg:"exchange-it.com"; classtype:trojan-activity; priority:1;) alert tcp 205.180.85.19 any $HOME_NET any (msg:"adcycle.com"; classtype:trojan-activity; priority:1;) alert tcp 205.180.85.9 any $HOME_NET any (msg:"adserver.com"; classtype:trojan-activity; priority:1;) alert tcp 205.180.86.20 any $HOME_NET any (msg:"adserver.com"; classtype:trojan-activity; priority:1;) alert tcp 205.180.86.4 any $HOME_NET any (msg:"fastclick.com"; classtype:trojan-activity; priority:1;) alert tcp 205.186.160.123 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 205.186.161.170 any $HOME_NET any (msg:"snoobi.com"; classtype:trojan-activity; priority:1;) alert tcp 205.186.179.165 any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;) alert tcp 205.186.187.197 any $HOME_NET any (msg:"mypowermall.com"; classtype:trojan-activity; priority:1;) alert tcp 205.188.165.121 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 205.188.165.185 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 205.188.165.249 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 205.188.165.57 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 205.201.167.135 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;) alert tcp 205.203.131.34 any $HOME_NET any (msg:"a.mktw.net"; classtype:trojan-activity; priority:1;) alert tcp 205.204.112.70 any $HOME_NET any (msg:"dmtracking2.alibaba.com"; classtype:trojan-activity; priority:1;) alert tcp 205.205.86.51 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 205.206.209.58 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;) alert tcp 205.209.147.177 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;) alert tcp 205.209.152.166 any $HOME_NET any (msg:"methodcash.com"; classtype:trojan-activity; priority:1;) alert tcp 205.209.186.68 any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 205.209.188.46 any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 205.209.188.53 any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 205.218.64.7 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;) alert tcp 205.218.65.142 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;) alert tcp 205.234.175.175 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;) alert tcp 205.236.34.206 any $HOME_NET any (msg:"webreseau.com"; classtype:trojan-activity; priority:1;) alert tcp 205.236.34.7 any $HOME_NET any (msg:"webreseau.com"; classtype:trojan-activity; priority:1;) alert tcp 205.246.203.30 any $HOME_NET any (msg:"webpower.com"; classtype:trojan-activity; priority:1;) alert tcp 205.246.203.36 any $HOME_NET any (msg:"clickcash.webpower.com"; classtype:trojan-activity; priority:1;) alert tcp 205.246.203.37 any $HOME_NET any (msg:"clickcash.webpower.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.101 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.128 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.131 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.133 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.139 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.152 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.165 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.180 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.184 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.188 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.240 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.242.248 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.243.180 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.243.65 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.243.73 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.243.89 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 205.251.243.97 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 206.107.131.10 any $HOME_NET any (msg:"ads.addesktop.com"; classtype:trojan-activity; priority:1;) alert tcp 206.123.114.138 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 206.123.90.137 any $HOME_NET any (msg:"reduxmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 206.125.166.246 any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;) alert tcp 206.125.41.13 any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;) alert tcp 206.127.24.153 any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;) alert tcp 206.131.168.12 any $HOME_NET any (msg:"adimages.homestore.com"; classtype:trojan-activity; priority:1;) alert tcp 206.131.180.161 any $HOME_NET any (msg:"adimages.homestore.com"; classtype:trojan-activity; priority:1;) alert tcp 206.132.241.147 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 206.132.241.154 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 206.132.241.176 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 206.132.241.177 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 206.138.137.100 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;) alert tcp 206.14.214.45 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;) alert tcp 206.14.64.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 206.14.64.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.0.113 any $HOME_NET any (msg:"ads.com.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.0.134 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.0.140 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.0.141 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.0.142 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.0.143 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.0.187 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.220.130 any $HOME_NET any (msg:"pepperjamnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.59.21 any $HOME_NET any (msg:"firstlightera.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.59.22 any $HOME_NET any (msg:"firstlightera.com"; classtype:trojan-activity; priority:1;) alert tcp 206.16.59.23 any $HOME_NET any (msg:"firstlightera.com"; classtype:trojan-activity; priority:1;) alert tcp 206.165.199.86 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;) alert tcp 206.168.47.1 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;) alert tcp 206.169.239.20 any $HOME_NET any (msg:"iesnare.com"; classtype:trojan-activity; priority:1;) alert tcp 206.188.192.127 any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;) alert tcp 206.188.193.206 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 206.188.193.93 any $HOME_NET any (msg:"lucidmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 206.190.56.190 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 206.190.56.191 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 206.190.60.37 any $HOME_NET any (msg:"yieldmanager.net"; classtype:trojan-activity; priority:1;) alert tcp 206.191.173.57 any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;) alert tcp 206.191.173.69 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;) alert tcp 206.196.125.120 any $HOME_NET any (msg:"tracker.icerocket.com"; classtype:trojan-activity; priority:1;) alert tcp 206.200.251.66 any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;) alert tcp 206.204.187.42 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 206.214.223.81 any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;) alert tcp 206.223.146.200 any $HOME_NET any (msg:"methodcash.com"; classtype:trojan-activity; priority:1;) alert tcp 206.223.157.210 any $HOME_NET any (msg:"methodcash.com"; classtype:trojan-activity; priority:1;) alert tcp 206.223.178.88 any $HOME_NET any (msg:"ard.xxxblackbook.com"; classtype:trojan-activity; priority:1;) alert tcp 206.223.183.156 any $HOME_NET any (msg:"ard.xxxblackbook.com"; classtype:trojan-activity; priority:1;) alert tcp 206.252.153.4 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;) alert tcp 206.252.157.58 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;) alert tcp 206.33.54.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 206.47.74.31 any $HOME_NET any (msg:"oas.toronto.com"; classtype:trojan-activity; priority:1;) alert tcp 206.51.226.142 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 206.55.125.138 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;) alert tcp 206.62.142.86 any $HOME_NET any (msg:"servethis.com"; classtype:trojan-activity; priority:1;) alert tcp 206.65.183.20 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 206.65.72.215 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 206.71.176.133 any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;) alert tcp 206.72.113.48 any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;) alert tcp 206.72.122.217 any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;) alert tcp 206.72.124.132 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;) alert tcp 206.79.171.196 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 206.79.194.73 any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;) alert tcp 207.114.236.40 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 207.123.33.124 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 207.123.33.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 207.123.34.126 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 207.123.40.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 207.123.57.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 207.13.199.239 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 207.150.160.71 any $HOME_NET any (msg:"realtechnetwork.net"; classtype:trojan-activity; priority:1;) alert tcp 207.150.160.72 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 207.153.203.227 any $HOME_NET any (msg:"server.iad.liveperson.net"; classtype:trojan-activity; priority:1;) alert tcp 207.153.253.148 any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;) alert tcp 207.155.248.14 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 207.155.248.72 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 207.155.248.9 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 207.155.252.47 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 207.155.252.72 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.14.112 any $HOME_NET any (msg:"ad.amgdgt.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.1 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.129 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.132 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.139 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.14 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.152 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.162 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.196 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.203 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.206 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.21 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.216 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.226 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.24 any $HOME_NET any (msg:"adzerk.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.34 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.163.4 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.166.176 any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;) alert tcp 207.171.175.96 any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;) alert tcp 207.178.159.100 any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 207.178.247.51 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 207.189.109.37 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;) alert tcp 207.189.97.33 any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 207.190.12.215 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;) alert tcp 207.195.225.10 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;) alert tcp 207.199.88.218 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 207.199.89.200 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 207.200.17.74 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;) alert tcp 207.200.84.59 any $HOME_NET any (msg:"hitometer.com"; classtype:trojan-activity; priority:1;) alert tcp 207.210.100.18 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 207.210.201.116 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;) alert tcp 207.210.231.201 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 207.210.234.196 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 207.218.248.11 any $HOME_NET any (msg:"adrevolver.com"; classtype:trojan-activity; priority:1;) alert tcp 207.219.111.20 any $HOME_NET any (msg:"casinorewards.com"; classtype:trojan-activity; priority:1;) alert tcp 207.226.113.55 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 207.229.11.11 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 207.231.204.32 any $HOME_NET any (msg:"as.webmd.com"; classtype:trojan-activity; priority:1;) alert tcp 207.231.204.56 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;) alert tcp 207.234.129.124 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 207.234.145.148 any $HOME_NET any (msg:"topforall.com"; classtype:trojan-activity; priority:1;) alert tcp 207.234.224.47 any $HOME_NET any (msg:"exchange-it.com"; classtype:trojan-activity; priority:1;) alert tcp 207.239.63.229 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;) alert tcp 207.243.40.150 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;) alert tcp 207.243.40.90 any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;) alert tcp 207.244.223.68 any $HOME_NET any (msg:"tracker.icerocket.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.135.45 any $HOME_NET any (msg:"mtree.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.136.167 any $HOME_NET any (msg:"sextracker.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.39 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.40 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.41 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.42 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.43 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.44 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.45 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.46 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.47 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.48 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.137.64 any $HOME_NET any (msg:"xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.138.104 any $HOME_NET any (msg:"sexlist.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.138.7 any $HOME_NET any (msg:"xxxcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.147.247 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.147.248 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.147.249 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.147.250 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.13 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.14 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.15 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.16 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.228 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.229 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.230 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.231 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.235 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.246.153.236 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;) alert tcp 207.25.71.155 any $HOME_NET any (msg:"customad.cnn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.250.14.13 any $HOME_NET any (msg:"ads.simtel.net"; classtype:trojan-activity; priority:1;) alert tcp 207.250.191.119 any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;) alert tcp 207.30.7.31 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;) alert tcp 207.34.202.4 any $HOME_NET any (msg:"casinorewards.com"; classtype:trojan-activity; priority:1;) alert tcp 207.38.0.58 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;) alert tcp 207.38.1.120 any $HOME_NET any (msg:"adcontent.gamespy.com"; classtype:trojan-activity; priority:1;) alert tcp 207.38.10.100 any $HOME_NET any (msg:"adcontent.gamespy.com"; classtype:trojan-activity; priority:1;) alert tcp 207.38.10.58 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;) alert tcp 207.38.104.86 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;) alert tcp 207.44.142.38 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.144.10 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;) alert tcp 207.44.156.26 any $HOME_NET any (msg:"yesadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.156.66 any $HOME_NET any (msg:"advertising.se"; classtype:trojan-activity; priority:1;) alert tcp 207.44.168.28 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.180.107 any $HOME_NET any (msg:"monsterpops.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.180.96 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.198.26 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.198.27 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.210.76 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.230.81 any $HOME_NET any (msg:"ads.gaming-universe.de"; classtype:trojan-activity; priority:1;) alert tcp 207.44.242.21 any $HOME_NET any (msg:"adrevolver.com"; classtype:trojan-activity; priority:1;) alert tcp 207.44.248.17 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 207.44.249.93 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 207.44.250.116 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;) alert tcp 207.46.0.87 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;) alert tcp 207.46.132.59 any $HOME_NET any (msg:"clicktrade.com"; classtype:trojan-activity; priority:1;) alert tcp 207.46.202.23 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.46.222.15 any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 207.46.222.36 any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 207.46.234.126 any $HOME_NET any (msg:"clicktrade.com"; classtype:trojan-activity; priority:1;) alert tcp 207.46.31.61 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;) alert tcp 207.57.118.69 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 207.57.97.233 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 207.57.97.241 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 207.58.130.150 any $HOME_NET any (msg:"ads.whoishostingthis.com"; classtype:trojan-activity; priority:1;) alert tcp 207.58.130.153 any $HOME_NET any (msg:"ads.whoishostingthis.com"; classtype:trojan-activity; priority:1;) alert tcp 207.58.150.206 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 207.58.150.207 any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 207.58.150.210 any $HOME_NET any (msg:"bullseye.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 207.58.150.216 any $HOME_NET any (msg:"backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 207.65.74.1 any $HOME_NET any (msg:"wetrack.it"; classtype:trojan-activity; priority:1;) alert tcp 207.65.74.65 any $HOME_NET any (msg:"trackingsoft.com"; classtype:trojan-activity; priority:1;) alert tcp 207.66.130.100 any $HOME_NET any (msg:"mbs.megaroticlive.com"; classtype:trojan-activity; priority:1;) alert tcp 207.66.130.101 any $HOME_NET any (msg:"mbs.megaroticlive.com"; classtype:trojan-activity; priority:1;) alert tcp 207.66.182.36 any $HOME_NET any (msg:"banners.videosz.com"; classtype:trojan-activity; priority:1;) alert tcp 207.67.0.117 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;) alert tcp 207.67.0.157 any $HOME_NET any (msg:"onenetworkdirect.com"; classtype:trojan-activity; priority:1;) alert tcp 207.67.0.2 any $HOME_NET any (msg:"affiliates.babylon.com"; classtype:trojan-activity; priority:1;) alert tcp 207.67.0.233 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;) alert tcp 207.67.0.69 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;) alert tcp 207.67.50.23 any $HOME_NET any (msg:"affiliates.digitalriver.com"; classtype:trojan-activity; priority:1;) alert tcp 207.67.50.30 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;) alert tcp 207.68.165.40 any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 207.68.178.119 any $HOME_NET any (msg:"ads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.68.178.12 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.68.178.123 any $HOME_NET any (msg:"ads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.68.178.237 any $HOME_NET any (msg:"ads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.68.178.251 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.68.178.61 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.68.179.220 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 207.8.198.5 any $HOME_NET any (msg:"hypertracker.com"; classtype:trojan-activity; priority:1;) alert tcp 207.8.198.8 any $HOME_NET any (msg:"hypertracker.com"; classtype:trojan-activity; priority:1;) alert tcp 207.96.133.40 any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;) alert tcp 207.96.160.181 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 207.96.160.182 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 207.96.160.66 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 207.96.160.67 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 207.97.204.179 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 208.100.1.161 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;) alert tcp 208.100.2.160 any $HOME_NET any (msg:"nitroclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 208.100.23.178 any $HOME_NET any (msg:"cjbmanagement.com"; classtype:trojan-activity; priority:1;) alert tcp 208.100.48.100 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;) alert tcp 208.101.52.101 any $HOME_NET any (msg:"e-planning.net"; classtype:trojan-activity; priority:1;) alert tcp 208.106.213.166 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.109.107.61 any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;) alert tcp 208.109.138.55 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.109.181.114 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.109.181.173 any $HOME_NET any (msg:"malwaredomains.com"; classtype:trojan-activity; priority:1;) alert tcp 208.109.181.201 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;) alert tcp 208.109.78.86 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.110.213.154 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 208.110.213.157 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 208.113.133.168 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;) alert tcp 208.113.180.250 any $HOME_NET any (msg:"oxen.hillcountrytexas.com"; classtype:trojan-activity; priority:1;) alert tcp 208.113.199.30 any $HOME_NET any (msg:"oxen.hillcountrytexas.com"; classtype:trojan-activity; priority:1;) alert tcp 208.115.111.151 any $HOME_NET any (msg:"banners.dine.com"; classtype:trojan-activity; priority:1;) alert tcp 208.115.111.152 any $HOME_NET any (msg:"banners.dine.com"; classtype:trojan-activity; priority:1;) alert tcp 208.115.111.153 any $HOME_NET any (msg:"banners.dine.com"; classtype:trojan-activity; priority:1;) alert tcp 208.122.50.176 any $HOME_NET any (msg:"projectwonderful.com"; classtype:trojan-activity; priority:1;) alert tcp 208.149.147.204 any $HOME_NET any (msg:"ads.allsites.com"; classtype:trojan-activity; priority:1;) alert tcp 208.156.32.230 any $HOME_NET any (msg:"www.postmasterbannernet.com"; classtype:trojan-activity; priority:1;) alert tcp 208.166.55.20 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.167.241.150 any $HOME_NET any (msg:"protraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 208.167.252.184 any $HOME_NET any (msg:"banners.videosz.com"; classtype:trojan-activity; priority:1;) alert tcp 208.176.250.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 208.178.167.254 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 208.178.203.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 208.178.235.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 208.178.29.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 208.179.133.69 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;) alert tcp 208.179.16.161 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;) alert tcp 208.179.9.135 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;) alert tcp 208.179.9.152 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;) alert tcp 208.179.9.48 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;) alert tcp 208.184.138.100 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 208.184.139.109 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.184.29.210 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 208.184.39.135 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 208.184.39.137 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.184.6.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 208.184.6.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 208.184.6.69 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 208.185.101.167 any $HOME_NET any (msg:"tribalfusion.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.101.168 any $HOME_NET any (msg:"a.tribalfusion.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.127.162 any $HOME_NET any (msg:"www.freestats.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.127.163 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.127.166 any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.127.180 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.127.185 any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.211.70 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.211.71 any $HOME_NET any (msg:"ezula.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.211.80 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.54.38 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.54.44 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.54.51 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 208.185.54.71 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 208.187.162.11 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;) alert tcp 208.197.4.115 any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;) alert tcp 208.197.94.28 any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;) alert tcp 208.202.9.29 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;) alert tcp 208.223.206.160 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 208.223.207.110 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;) alert tcp 208.234.169.72 any $HOME_NET any (msg:"ads.elitetrader.com"; classtype:trojan-activity; priority:1;) alert tcp 208.237.254.136 any $HOME_NET any (msg:"ads.websiteservices.com"; classtype:trojan-activity; priority:1;) alert tcp 208.237.254.40 any $HOME_NET any (msg:"7search.com"; classtype:trojan-activity; priority:1;) alert tcp 208.239.225.244 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;) alert tcp 208.253.9.126 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;) alert tcp 208.253.92.71 any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;) alert tcp 208.254.18.144 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.254.18.150 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 208.254.3.160 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 208.254.3.166 any $HOME_NET any (msg:"seeq.com"; classtype:trojan-activity; priority:1;) alert tcp 208.254.63.114 any $HOME_NET any (msg:"iwin.com"; classtype:trojan-activity; priority:1;) alert tcp 208.254.63.69 any $HOME_NET any (msg:"ad.iwin.com"; classtype:trojan-activity; priority:1;) alert tcp 208.254.63.86 any $HOME_NET any (msg:"trafficmp.com"; classtype:trojan-activity; priority:1;) alert tcp 208.254.75.139 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.255.131.199 any $HOME_NET any (msg:"newdata.box.sk"; classtype:trojan-activity; priority:1;) alert tcp 208.3.90.89 any $HOME_NET any (msg:"ads.eagletribune.com"; classtype:trojan-activity; priority:1;) alert tcp 208.37.177.42 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;) alert tcp 208.38.134.211 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;) alert tcp 208.38.59.181 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;) alert tcp 208.40.148.152 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 208.43.10.3 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.111.162 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.115.200 any $HOME_NET any (msg:"advertisingbox.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.117.131 any $HOME_NET any (msg:"admax.nexage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.121.150 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.211.232 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.215.131 any $HOME_NET any (msg:"gostats.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.220.250 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.220.251 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.239.180 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 208.43.65.206 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;) alert tcp 208.43.79.58 any $HOME_NET any (msg:"servedbyopenx.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.89.147 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.90.233 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;) alert tcp 208.43.92.159 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;) alert tcp 208.45.172.87 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 208.48.156.200 any $HOME_NET any (msg:"shoppingads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.48.156.201 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.48.156.211 any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.48.81.132 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 208.49.12.164 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 208.49.12.165 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 208.49.12.183 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 208.51.27.221 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;) alert tcp 208.51.99.82 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 208.51.99.83 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 208.51.99.84 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 208.51.99.85 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.161 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.168 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.176 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.217 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.218 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.219 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.240 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.244 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.64 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.53.158.65 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.62.62.102 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 208.64.124.162 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 208.64.44.65 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 208.64.44.74 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 208.65.130.26 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.65.130.27 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.65.130.28 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.65.130.29 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.65.130.30 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.65.201.194 any $HOME_NET any (msg:"ads.amdmb.com"; classtype:trojan-activity; priority:1;) alert tcp 208.65.201.196 any $HOME_NET any (msg:"ads.amdmb.com"; classtype:trojan-activity; priority:1;) alert tcp 208.66.204.153 any $HOME_NET any (msg:"clicktracks.com"; classtype:trojan-activity; priority:1;) alert tcp 208.66.66.114 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.66.99.155 any $HOME_NET any (msg:"peer39.com"; classtype:trojan-activity; priority:1;) alert tcp 208.67.183.100 any $HOME_NET any (msg:"cetrk.com"; classtype:trojan-activity; priority:1;) alert tcp 208.67.70.27 any $HOME_NET any (msg:"ad.media-servers.net"; classtype:trojan-activity; priority:1;) alert tcp 208.67.70.3 any $HOME_NET any (msg:"ad.media-servers.net"; classtype:trojan-activity; priority:1;) alert tcp 208.68.156.124 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.68.156.61 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.68.157.148 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.68.157.153 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.69.181.200 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;) alert tcp 208.69.181.201 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;) alert tcp 208.69.181.202 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;) alert tcp 208.7.160.124 any $HOME_NET any (msg:"adserver.nydailynews.com"; classtype:trojan-activity; priority:1;) alert tcp 208.70.72.204 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.70.73.143 any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;) alert tcp 208.70.79.137 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.104.181 any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.120.75 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.121.24 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.121.27 any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.121.3 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.121.30 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.121.6 any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.121.61 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.122.13 any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.122.24 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.122.3 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.122.30 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.122.61 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.122.75 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.122.77 any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.123.101 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.123.111 any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.123.66 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.123.72 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.123.81 any $HOME_NET any (msg:"ads.visitbritain.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.123.86 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.123.95 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.124.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.124.26 any $HOME_NET any (msg:"a.windowsitpro.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.124.75 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.125.101 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.125.66 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.125.72 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.125.81 any $HOME_NET any (msg:"ads.visitbritain.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.125.86 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;) alert tcp 208.71.125.95 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.192.133 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.2.178 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.2.179 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.2.18 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.2.180 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.2.186 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.2.187 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.2.19 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.72.2.20 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.102 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.128 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.155 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.171 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.200 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.201 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.202 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.203 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.204 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.205 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.206 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.208 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.216 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.76 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.210.84 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.165 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.173 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.179 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.184 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.187 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.189 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.192 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.193 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.197 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.198 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.230 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.233 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.234 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.247 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.249 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.69 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.211.70 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.214.9 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 208.73.51.100 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;) alert tcp 208.73.51.101 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;) alert tcp 208.75.170.1 any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;) alert tcp 208.75.170.35 any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;) alert tcp 208.75.250.50 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.75.252.106 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.75.252.107 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 208.75.252.108 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.75.252.109 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.77.165.232 any $HOME_NET any (msg:"optimost.com"; classtype:trojan-activity; priority:1;) alert tcp 208.78.169.231 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;) alert tcp 208.78.242.184 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.78.43.138 any $HOME_NET any (msg:"chitika.net"; classtype:trojan-activity; priority:1;) alert tcp 208.78.93.118 any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;) alert tcp 208.78.93.67 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;) alert tcp 208.78.93.68 any $HOME_NET any (msg:"hostedads.realitykings.com"; classtype:trojan-activity; priority:1;) alert tcp 208.78.94.100 any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;) alert tcp 208.78.94.101 any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;) alert tcp 208.78.94.73 any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;) alert tcp 208.78.94.96 any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;) alert tcp 208.79.78.230 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 208.80.4.106 any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;) alert tcp 208.81.201.12 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;) alert tcp 208.81.201.14 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;) alert tcp 208.81.233.74 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 208.81.233.75 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 208.81.233.77 any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 208.81.234.108 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 208.81.234.117 any $HOME_NET any (msg:"oas.repubblica.it"; classtype:trojan-activity; priority:1;) alert tcp 208.81.234.17 any $HOME_NET any (msg:"ads.trinitymirror.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 208.81.234.21 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 208.81.234.97 any $HOME_NET any (msg:"ads.trinitymirror.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 208.83.240.70 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 208.83.240.71 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;) alert tcp 208.83.241.15 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;) alert tcp 208.83.241.70 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 208.83.243.15 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;) alert tcp 208.83.243.215 any $HOME_NET any (msg:"ads.okcimg.com"; classtype:trojan-activity; priority:1;) alert tcp 208.83.243.71 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;) alert tcp 208.84.244.62 any $HOME_NET any (msg:"ads.ole.com"; classtype:trojan-activity; priority:1;) alert tcp 208.86.184.106 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.149.250 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.32.71 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.33.150 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.33.151 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.34.18 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.34.65 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.34.69 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.34.70 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.34.71 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.35.103 any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;) alert tcp 208.87.35.107 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.176.118 any $HOME_NET any (msg:"banners.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.176.7 any $HOME_NET any (msg:"geobanner.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.177.195 any $HOME_NET any (msg:"ad.bondage.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.180.129 any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.180.81 any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.180.89 any $HOME_NET any (msg:"medleyads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.180.90 any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.180.91 any $HOME_NET any (msg:"affiliates.streamray.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.180.96 any $HOME_NET any (msg:"ads.gradfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 208.88.182.248 any $HOME_NET any (msg:"pop6.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.196.123 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.196.19 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.196.4 any $HOME_NET any (msg:"cnomy.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.196.49 any $HOME_NET any (msg:"180searchassistant.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.196.6 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.196.81 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.132 any $HOME_NET any (msg:"affiliates.digitalriver.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.163 any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.19 any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.197 any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.198 any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.235 any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.239 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.46 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.49 any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.197.64 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 208.91.207.10 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;) alert tcp 208.93.154.82 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 208.93.170.12 any $HOME_NET any (msg:"as.webmd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.93.170.15 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;) alert tcp 208.94.146.70 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.94.146.71 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.94.146.80 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.94.146.81 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 208.94.147.64 any $HOME_NET any (msg:"bizographics.com"; classtype:trojan-activity; priority:1;) alert tcp 208.94.147.65 any $HOME_NET any (msg:"bizographics.com"; classtype:trojan-activity; priority:1;) alert tcp 208.94.234.219 any $HOME_NET any (msg:"cjlog.com"; classtype:trojan-activity; priority:1;) alert tcp 208.96.4.68 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;) alert tcp 208.96.56.194 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 208.97.171.74 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;) alert tcp 208.99.115.30 any $HOME_NET any (msg:"ads.kelbymediagroup.com"; classtype:trojan-activity; priority:1;) alert tcp 209.10.215.36 any $HOME_NET any (msg:"rightmedia.net"; classtype:trojan-activity; priority:1;) alert tcp 209.10.222.113 any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;) alert tcp 209.100.120.162 any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;) alert tcp 209.104.36.190 any $HOME_NET any (msg:"ads.as4x.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.39.100 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.45.249 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.52.75 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.53.100 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.53.200 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.54.75 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.58.249 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.60.21 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.63.100 any $HOME_NET any (msg:"ads.as4x.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.104.63.50 any $HOME_NET any (msg:"ads.as4x.tmcs.net"; classtype:trojan-activity; priority:1;) alert tcp 209.112.246.109 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.112.44.10 any $HOME_NET any (msg:"ac.rnm.ca"; classtype:trojan-activity; priority:1;) alert tcp 209.114.36.39 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;) alert tcp 209.12.183.116 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;) alert tcp 209.120.187.164 any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;) alert tcp 209.120.187.245 any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;) alert tcp 209.123.16.48 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 209.123.16.9 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 209.126.131.118 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 209.128.119.142 any $HOME_NET any (msg:"visistat.com"; classtype:trojan-activity; priority:1;) alert tcp 209.128.76.107 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.205.101 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.205.220 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.205.221 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.205.222 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.205.75 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.205.76 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.212.132 any $HOME_NET any (msg:"casalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.218.66 any $HOME_NET any (msg:"adserv.internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.218.69 any $HOME_NET any (msg:"nitrous.internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.218.74 any $HOME_NET any (msg:"exitfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.98.135 any $HOME_NET any (msg:"oas.uniontrib.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.98.141 any $HOME_NET any (msg:"oas.uniontrib.com"; classtype:trojan-activity; priority:1;) alert tcp 209.132.99.12 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;) alert tcp 209.134.81.168 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;) alert tcp 209.137.142.124 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;) alert tcp 209.143.236.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 209.143.236.22 any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;) alert tcp 209.143.243.200 any $HOME_NET any (msg:"ads.web21.com"; classtype:trojan-activity; priority:1;) alert tcp 209.144.102.30 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;) alert tcp 209.15.13.155 any $HOME_NET any (msg:"revstats.com"; classtype:trojan-activity; priority:1;) alert tcp 209.15.209.201 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 209.15.247.16 any $HOME_NET any (msg:"casinorewards.com"; classtype:trojan-activity; priority:1;) alert tcp 209.164.14.52 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.164.25.49 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;) alert tcp 209.170.120.39 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 209.170.120.40 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 209.170.120.42 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 209.172.48.247 any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;) alert tcp 209.185.12.38 any $HOME_NET any (msg:"banners.amigos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.185.12.42 any $HOME_NET any (msg:"banners.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 209.185.12.47 any $HOME_NET any (msg:"adserver.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 209.190.106.126 any $HOME_NET any (msg:"exelator.com"; classtype:trojan-activity; priority:1;) alert tcp 209.190.244.231 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 209.190.244.232 any $HOME_NET any (msg:"findcommerce.com"; classtype:trojan-activity; priority:1;) alert tcp 209.190.74.71 any $HOME_NET any (msg:"exelator.com"; classtype:trojan-activity; priority:1;) alert tcp 209.191.189.249 any $HOME_NET any (msg:"tracker.icerocket.com"; classtype:trojan-activity; priority:1;) alert tcp 209.196.28.153 any $HOME_NET any (msg:"scanscout.com"; classtype:trojan-activity; priority:1;) alert tcp 209.196.6.247 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 209.197.109.60 any $HOME_NET any (msg:"myhq.com"; classtype:trojan-activity; priority:1;) alert tcp 209.197.4.228 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 209.197.79.97 any $HOME_NET any (msg:"promote.pair.com"; classtype:trojan-activity; priority:1;) alert tcp 209.197.86.5 any $HOME_NET any (msg:"globalismedia.com"; classtype:trojan-activity; priority:1;) alert tcp 209.200.114.220 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;) alert tcp 209.200.15.203 any $HOME_NET any (msg:"blingbucks.com"; classtype:trojan-activity; priority:1;) alert tcp 209.200.153.152 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;) alert tcp 209.200.154.146 any $HOME_NET any (msg:"cashengines.com"; classtype:trojan-activity; priority:1;) alert tcp 209.200.154.207 any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;) alert tcp 209.200.154.23 any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;) alert tcp 209.200.154.30 any $HOME_NET any (msg:"cashengines.com"; classtype:trojan-activity; priority:1;) alert tcp 209.200.155.63 any $HOME_NET any (msg:"webtrackerplus.com"; classtype:trojan-activity; priority:1;) alert tcp 209.200.32.218 any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;) alert tcp 209.202.136.69 any $HOME_NET any (msg:"admarvel.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.192.30 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.196.215 any $HOME_NET any (msg:"ads.tripod.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.216.190 any $HOME_NET any (msg:"adbuyer3.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.216.25 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.216.27 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.226.100 any $HOME_NET any (msg:"sidebar.angelfire.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.229.100 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.229.190 any $HOME_NET any (msg:"ratings.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.230.30 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.238.23 any $HOME_NET any (msg:"pennyweb.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.240.210 any $HOME_NET any (msg:"sidebar.angelfire.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.248.101 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.248.105 any $HOME_NET any (msg:"adbuyer3.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.248.202 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.252.49 any $HOME_NET any (msg:"ads.tripod.lycos.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 209.202.252.50 any $HOME_NET any (msg:"sidebar.angelfire.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.254.12 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.202.254.14 any $HOME_NET any (msg:"hit.webcentre.lycos.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 209.202.254.61 any $HOME_NET any (msg:"ratings.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 209.207.213.228 any $HOME_NET any (msg:"shareasale.com"; classtype:trojan-activity; priority:1;) alert tcp 209.208.186.68 any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;) alert tcp 209.208.193.226 any $HOME_NET any (msg:"ad.yieldmanager.com"; classtype:trojan-activity; priority:1;) alert tcp 209.208.224.14 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;) alert tcp 209.208.224.46 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;) alert tcp 209.208.224.48 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;) alert tcp 209.208.224.54 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;) alert tcp 209.222.20.196 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 209.225.26.101 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;) alert tcp 209.225.31.222 any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;) alert tcp 209.225.6.77 any $HOME_NET any (msg:"bannerfarm.ace.advertising.com"; classtype:trojan-activity; priority:1;) alert tcp 209.234.225.12 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;) alert tcp 209.234.225.242 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;) alert tcp 209.234.225.243 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;) alert tcp 209.234.225.9 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;) alert tcp 209.234.234.12 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;) alert tcp 209.234.234.16 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;) alert tcp 209.236.69.209 any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 209.237.248.20 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;) alert tcp 209.237.248.22 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;) alert tcp 209.239.162.220 any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;) alert tcp 209.239.235.92 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 209.240.140.3 any $HOME_NET any (msg:"123banners.com"; classtype:trojan-activity; priority:1;) alert tcp 209.240.140.50 any $HOME_NET any (msg:"123banners.com"; classtype:trojan-activity; priority:1;) alert tcp 209.240.144.110 any $HOME_NET any (msg:"123banners.com"; classtype:trojan-activity; priority:1;) alert tcp 209.244.156.19 any $HOME_NET any (msg:"insightexpressai.com"; classtype:trojan-activity; priority:1;) alert tcp 209.244.156.20 any $HOME_NET any (msg:"insightexpress.com"; classtype:trojan-activity; priority:1;) alert tcp 209.249.20.150 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 209.249.222.13 any $HOME_NET any (msg:"cashcrate.com"; classtype:trojan-activity; priority:1;) alert tcp 209.249.222.15 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 209.25.170.74 any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;) alert tcp 209.25.203.42 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;) alert tcp 209.31.10.36 any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;) alert tcp 209.31.10.55 any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;) alert tcp 209.34.255.54 any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;) alert tcp 209.35.17.16 any $HOME_NET any (msg:"zeus.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 209.40.194.228 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.40.194.254 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.40.195.251 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.40.202.254 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.40.206.130 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.40.206.249 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.40.206.57 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.43.36.178 any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 209.43.95.155 any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 209.43.95.210 any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 209.47.15.100 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 209.47.169.170 any $HOME_NET any (msg:"textad.sexsearch.com"; classtype:trojan-activity; priority:1;) alert tcp 209.47.223.20 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 209.47.244.100 any $HOME_NET any (msg:"reliablebanners.com"; classtype:trojan-activity; priority:1;) alert tcp 209.47.46.153 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 209.47.46.171 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 209.50.243.20 any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;) alert tcp 209.51.178.50 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;) alert tcp 209.51.178.60 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;) alert tcp 209.51.178.70 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;) alert tcp 209.51.211.66 any $HOME_NET any (msg:"24log.com"; classtype:trojan-activity; priority:1;) alert tcp 209.58.234.202 any $HOME_NET any (msg:"hitslink.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.142.50 any $HOME_NET any (msg:"ads.justhungry.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.169.42 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;) alert tcp 209.59.169.43 any $HOME_NET any (msg:"tubemogul.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.174.254 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.194.182 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.194.20 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.194.229 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.195.20 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.206.58 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.207.239 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.209.212 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.59.209.213 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 209.61.129.10 any $HOME_NET any (msg:"topstats.com"; classtype:trojan-activity; priority:1;) alert tcp 209.61.194.46 any $HOME_NET any (msg:"adapt.tv"; classtype:trojan-activity; priority:1;) alert tcp 209.62.116.154 any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;) alert tcp 209.62.176.188 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 209.62.176.73 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 209.62.20.192 any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 209.62.20.238 any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;) alert tcp 209.62.21.204 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 209.62.58.226 any $HOME_NET any (msg:"topmmorpgsites.com"; classtype:trojan-activity; priority:1;) alert tcp 209.66.83.100 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;) alert tcp 209.66.88.60 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 209.67.1.131 any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;) alert tcp 209.73.203.226 any $HOME_NET any (msg:"rightmedia.net"; classtype:trojan-activity; priority:1;) alert tcp 209.80.46.10 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 209.80.46.30 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 209.80.46.90 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 209.81.12.144 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 209.81.12.145 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 209.81.82.112 any $HOME_NET any (msg:"linkstorms.com"; classtype:trojan-activity; priority:1;) alert tcp 209.81.83.165 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;) alert tcp 209.82.48.20 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 209.84.11.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 209.84.12.126 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 209.84.3.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 209.84.6.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 209.84.7.124 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 209.84.7.125 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 209.84.7.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.113.107 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 209.85.113.7 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 209.85.129.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.129.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.129.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.129.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.133.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.133.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.133.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.133.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.135.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.135.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.135.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.135.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.135.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.137.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.137.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.137.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.139.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.139.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.139.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.139.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.139.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.139.99 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.143.100 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.143.101 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.143.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.143.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.143.164 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.143.165 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.143.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.148 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.149 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.164 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.165 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.166 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.167 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.146.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.147.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.159.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.159.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.159.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.161.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.161.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.161.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.161.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.169.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.171.99 any $HOME_NET any (msg:"google-analytics.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.173.118 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.173.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.225.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.227.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.164 any $HOME_NET any (msg:"pagead.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.165 any $HOME_NET any (msg:"pagead.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.166 any $HOME_NET any (msg:"pagead.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.229.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.48.90 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.51.226 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.51.229 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 209.85.51.47 any $HOME_NET any (msg:"cnomy.com"; classtype:trojan-activity; priority:1;) alert tcp 209.87.178.183 any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;) alert tcp 209.87.178.246 any $HOME_NET any (msg:"ads.simtel.net"; classtype:trojan-activity; priority:1;) alert tcp 209.87.178.92 any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;) alert tcp 209.87.181.34 any $HOME_NET any (msg:"ad1.gamezone.com"; classtype:trojan-activity; priority:1;) alert tcp 209.94.144.214 any $HOME_NET any (msg:"jumptap.com"; classtype:trojan-activity; priority:1;) alert tcp 209.97.213.94 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;) alert tcp 209.97.46.7 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 209.97.50.10 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 209.97.50.34 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 209.97.61.49 any $HOME_NET any (msg:"ads.desmoinesregister.com"; classtype:trojan-activity; priority:1;) alert tcp 209.97.63.247 any $HOME_NET any (msg:"ads.infi.net"; classtype:trojan-activity; priority:1;) alert tcp 209.97.63.66 any $HOME_NET any (msg:"ads.desmoinesregister.com"; classtype:trojan-activity; priority:1;) alert tcp 209.99.96.15 any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;) alert tcp 210.109.98.11 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;) alert tcp 210.136.232.196 any $HOME_NET any (msg:"valuecommerce.com"; classtype:trojan-activity; priority:1;) alert tcp 210.153.88.114 any $HOME_NET any (msg:"xrea.com"; classtype:trojan-activity; priority:1;) alert tcp 210.155.159.25 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;) alert tcp 210.155.159.26 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;) alert tcp 210.155.159.27 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;) alert tcp 210.155.159.40 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;) alert tcp 210.155.159.41 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;) alert tcp 210.155.159.43 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;) alert tcp 210.157.1.211 any $HOME_NET any (msg:"adjustnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 210.160.201.29 any $HOME_NET any (msg:"ad.nttnavi.co.jp"; classtype:trojan-activity; priority:1;) alert tcp 210.173.168.41 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;) alert tcp 210.173.168.46 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;) alert tcp 210.173.168.49 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;) alert tcp 210.173.168.53 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;) alert tcp 210.188.206.225 any $HOME_NET any (msg:"clicktrack.ziyu.net"; classtype:trojan-activity; priority:1;) alert tcp 210.190.124.196 any $HOME_NET any (msg:"ad.nttnavi.co.jp"; classtype:trojan-activity; priority:1;) alert tcp 210.193.114.160 any $HOME_NET any (msg:"ad.nttnavi.co.jp"; classtype:trojan-activity; priority:1;) alert tcp 210.193.135.195 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.198.12.132 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;) alert tcp 210.245.164.145 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.1 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.11 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.12 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.13 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.16 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.17 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.2 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.21 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.26 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.27 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.28 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.29 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.6 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.7 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.247.196.8 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;) alert tcp 210.48.127.22 any $HOME_NET any (msg:"webads.co.nz"; classtype:trojan-activity; priority:1;) alert tcp 210.48.49.77 any $HOME_NET any (msg:"ads.nzcity.co.nz"; classtype:trojan-activity; priority:1;) alert tcp 210.59.224.178 any $HOME_NET any (msg:"hotrank.com.tw"; classtype:trojan-activity; priority:1;) alert tcp 210.73.210.155 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;) alert tcp 210.83.80.118 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;) alert tcp 211.115.216.227 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;) alert tcp 211.128.99.12 any $HOME_NET any (msg:"ba.afl.rakuten.co.jp"; classtype:trojan-activity; priority:1;) alert tcp 211.13.223.60 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;) alert tcp 212.0.126.131 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 212.0.126.132 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 212.100.224.141 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 212.100.224.98 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;) alert tcp 212.100.230.160 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 212.100.232.211 any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;) alert tcp 212.100.242.131 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 212.100.248.114 any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;) alert tcp 212.110.12.189 any $HOME_NET any (msg:"adv.hwupgrade.it"; classtype:trojan-activity; priority:1;) alert tcp 212.111.40.5 any $HOME_NET any (msg:"cpays.com"; classtype:trojan-activity; priority:1;) alert tcp 212.111.40.6 any $HOME_NET any (msg:"cpays.com"; classtype:trojan-activity; priority:1;) alert tcp 212.112.189.62 any $HOME_NET any (msg:"ads.nordichardware.se"; classtype:trojan-activity; priority:1;) alert tcp 212.112.231.112 any $HOME_NET any (msg:"ranking-charts.de"; classtype:trojan-activity; priority:1;) alert tcp 212.112.231.43 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;) alert tcp 212.112.51.22 any $HOME_NET any (msg:"a2.tp-media.se"; classtype:trojan-activity; priority:1;) alert tcp 212.112.53.9 any $HOME_NET any (msg:"a2.tp-media.se"; classtype:trojan-activity; priority:1;) alert tcp 212.113.31.51 any $HOME_NET any (msg:"oas.repubblica.it"; classtype:trojan-activity; priority:1;) alert tcp 212.113.31.55 any $HOME_NET any (msg:"pub.realmedia.fr"; classtype:trojan-activity; priority:1;) alert tcp 212.122.64.2 any $HOME_NET any (msg:"ads.5ci.lt"; classtype:trojan-activity; priority:1;) alert tcp 212.122.64.6 any $HOME_NET any (msg:"ads.5ci.lt"; classtype:trojan-activity; priority:1;) alert tcp 212.122.94.13 any $HOME_NET any (msg:"ads.5ci.lt"; classtype:trojan-activity; priority:1;) alert tcp 212.123.93.226 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;) alert tcp 212.123.93.230 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;) alert tcp 212.135.93.144 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 212.135.93.145 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 212.135.93.152 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 212.143.22.63 any $HOME_NET any (msg:"ads10.speedbit.com"; classtype:trojan-activity; priority:1;) alert tcp 212.147.135.170 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 212.158.163.252 any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;) alert tcp 212.160.67.149 any $HOME_NET any (msg:"stat.webmedia.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.160.67.252 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.160.67.4 any $HOME_NET any (msg:"stat.webmedia.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.160.67.5 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.161.99.150 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;) alert tcp 212.161.99.161 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;) alert tcp 212.162.1.201 any $HOME_NET any (msg:"stat.livejournal.com"; classtype:trojan-activity; priority:1;) alert tcp 212.176.41.3 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;) alert tcp 212.176.41.4 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;) alert tcp 212.176.41.5 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;) alert tcp 212.178.133.162 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;) alert tcp 212.178.133.163 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;) alert tcp 212.178.133.185 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;) alert tcp 212.179.38.71 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;) alert tcp 212.179.42.132 any $HOME_NET any (msg:"targetpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 212.187.153.203 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 212.187.153.37 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 212.187.163.235 any $HOME_NET any (msg:"profero.com"; classtype:trojan-activity; priority:1;) alert tcp 212.187.213.142 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 212.199.125.58 any $HOME_NET any (msg:"adonspot.com"; classtype:trojan-activity; priority:1;) alert tcp 212.203.28.217 any $HOME_NET any (msg:"ads.addesktop.com"; classtype:trojan-activity; priority:1;) alert tcp 212.209.91.203 any $HOME_NET any (msg:"tradedoubler.com"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.30 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.32 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.34 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.35 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.36 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.38 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.39 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.40 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.41 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.42 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.43 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.44 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.45 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.51.46 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.17 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.18 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.19 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.20 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.21 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.22 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.23 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.24 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.25 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.26 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.27 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.28 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.29 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.30 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.31 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.32 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.33 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.34 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.35 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.36 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.37 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.38 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.39 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.40 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.41 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.42 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.43 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.44 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.45 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.222.52.46 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 212.223.100.249 any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;) alert tcp 212.227.248.55 any $HOME_NET any (msg:"adrotate.de"; classtype:trojan-activity; priority:1;) alert tcp 212.227.253.147 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 212.227.57.148 any $HOME_NET any (msg:"muwmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 212.227.94.49 any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 212.23.166.76 any $HOME_NET any (msg:"mediaplazza.com"; classtype:trojan-activity; priority:1;) alert tcp 212.23.57.18 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 212.23.57.22 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 212.239.14.211 any $HOME_NET any (msg:"adserver.break-even.it"; classtype:trojan-activity; priority:1;) alert tcp 212.24.155.211 any $HOME_NET any (msg:"ads2.xnet.cz"; classtype:trojan-activity; priority:1;) alert tcp 212.242.252.93 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;) alert tcp 212.250.162.55 any $HOME_NET any (msg:"adserver.virginmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 212.254.206.50 any $HOME_NET any (msg:"banner.buempliz-online.ch"; classtype:trojan-activity; priority:1;) alert tcp 212.27.48.10 any $HOME_NET any (msg:"proxad.net"; classtype:trojan-activity; priority:1;) alert tcp 212.27.63.127 any $HOME_NET any (msg:"pub.chez.com"; classtype:trojan-activity; priority:1;) alert tcp 212.3.243.139 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 212.3.243.141 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 212.3.243.142 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 212.3.247.176 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 212.36.131.151 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;) alert tcp 212.36.57.170 any $HOME_NET any (msg:"grapeshot.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 212.37.4.242 any $HOME_NET any (msg:"reklam.rfsl.se"; classtype:trojan-activity; priority:1;) alert tcp 212.4.174.108 any $HOME_NET any (msg:"banners.webmasterplan.com"; classtype:trojan-activity; priority:1;) alert tcp 212.4.174.80 any $HOME_NET any (msg:"partners.webmasterplan.com"; classtype:trojan-activity; priority:1;) alert tcp 212.40.120.246 any $HOME_NET any (msg:"stat.dyna.ultraweb.hu"; classtype:trojan-activity; priority:1;) alert tcp 212.40.96.109 any $HOME_NET any (msg:"img.prohardver.hu"; classtype:trojan-activity; priority:1;) alert tcp 212.42.163.201 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;) alert tcp 212.43.196.30 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 212.43.218.207 any $HOME_NET any (msg:"pub.hardware.fr"; classtype:trojan-activity; priority:1;) alert tcp 212.43.221.21 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;) alert tcp 212.50.1.100 any $HOME_NET any (msg:"counter.search.bg"; classtype:trojan-activity; priority:1;) alert tcp 212.53.89.138 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;) alert tcp 212.53.95.124 any $HOME_NET any (msg:"adpepper.dk"; classtype:trojan-activity; priority:1;) alert tcp 212.61.16.196 any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;) alert tcp 212.62.19.199 any $HOME_NET any (msg:"ads.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 212.62.90.209 any $HOME_NET any (msg:"coupling-media.de"; classtype:trojan-activity; priority:1;) alert tcp 212.63.148.10 any $HOME_NET any (msg:"ranking-liste.de"; classtype:trojan-activity; priority:1;) alert tcp 212.63.205.177 any $HOME_NET any (msg:"advertising.se"; classtype:trojan-activity; priority:1;) alert tcp 212.64.134.185 any $HOME_NET any (msg:"au2m8.com"; classtype:trojan-activity; priority:1;) alert tcp 212.65.220.211 any $HOME_NET any (msg:"adrenaline.cz"; classtype:trojan-activity; priority:1;) alert tcp 212.66.15.204 any $HOME_NET any (msg:"banner.media-system.de"; classtype:trojan-activity; priority:1;) alert tcp 212.66.3.39 any $HOME_NET any (msg:"mediascale.de"; classtype:trojan-activity; priority:1;) alert tcp 212.67.190.137 any $HOME_NET any (msg:"banners.resultonline.com"; classtype:trojan-activity; priority:1;) alert tcp 212.67.202.17 any $HOME_NET any (msg:"hits4me.com"; classtype:trojan-activity; priority:1;) alert tcp 212.69.36.82 any $HOME_NET any (msg:"adsmin.net"; classtype:trojan-activity; priority:1;) alert tcp 212.69.36.85 any $HOME_NET any (msg:"adsmin.net"; classtype:trojan-activity; priority:1;) alert tcp 212.71.128.31 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 212.72.184.115 any $HOME_NET any (msg:"cash4popup.de"; classtype:trojan-activity; priority:1;) alert tcp 212.72.38.70 any $HOME_NET any (msg:"nedstatbasic.net"; classtype:trojan-activity; priority:1;) alert tcp 212.72.38.74 any $HOME_NET any (msg:"www.nedstat.nl"; classtype:trojan-activity; priority:1;) alert tcp 212.72.48.41 any $HOME_NET any (msg:"nedstatbasic.net"; classtype:trojan-activity; priority:1;) alert tcp 212.72.51.165 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;) alert tcp 212.72.51.170 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;) alert tcp 212.72.57.246 any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;) alert tcp 212.75.130.203 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;) alert tcp 212.75.96.241 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.75.96.242 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.77.100.127 any $HOME_NET any (msg:"adv.wp.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.77.226.32 any $HOME_NET any (msg:"ads.wwe.biz"; classtype:trojan-activity; priority:1;) alert tcp 212.77.99.8 any $HOME_NET any (msg:"adv.wp.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.78.204.110 any $HOME_NET any (msg:"ads.tripod.lycos.nl"; classtype:trojan-activity; priority:1;) alert tcp 212.78.206.117 any $HOME_NET any (msg:"hit.webcentre.lycos.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 212.80.128.26 any $HOME_NET any (msg:"ads.recoletos.es"; classtype:trojan-activity; priority:1;) alert tcp 212.80.177.160 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;) alert tcp 212.80.177.231 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;) alert tcp 212.80.70.76 any $HOME_NET any (msg:"ireklama.cz"; classtype:trojan-activity; priority:1;) alert tcp 212.80.76.154 any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;) alert tcp 212.80.76.58 any $HOME_NET any (msg:"1.im.cz"; classtype:trojan-activity; priority:1;) alert tcp 212.82.120.52 any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity; priority:1;) alert tcp 212.82.212.206 any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;) alert tcp 212.82.212.211 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;) alert tcp 212.83.144.135 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 212.83.144.21 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 212.85.117.210 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.85.120.147 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.85.126.24 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.85.33.17 any $HOME_NET any (msg:"adserver.barrapunto.com"; classtype:trojan-activity; priority:1;) alert tcp 212.85.34.51 any $HOME_NET any (msg:"adserver.barrapunto.com"; classtype:trojan-activity; priority:1;) alert tcp 212.85.34.52 any $HOME_NET any (msg:"adserver.barrapunto.com"; classtype:trojan-activity; priority:1;) alert tcp 212.87.11.134 any $HOME_NET any (msg:"hit.gemius.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.87.11.135 any $HOME_NET any (msg:"hit.gemius.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.87.11.153 any $HOME_NET any (msg:"hit.gemius.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.88.149.166 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;) alert tcp 212.91.6.58 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.91.7.33 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;) alert tcp 212.92.23.237 any $HOME_NET any (msg:"reklamcsere.hu"; classtype:trojan-activity; priority:1;) alert tcp 212.93.228.5 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 212.93.228.8 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;) alert tcp 212.95.67.18 any $HOME_NET any (msg:"mediaplazza.com"; classtype:trojan-activity; priority:1;) alert tcp 213.115.231.140 any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;) alert tcp 213.121.143.197 any $HOME_NET any (msg:"log.btopenworld.com"; classtype:trojan-activity; priority:1;) alert tcp 213.121.143.205 any $HOME_NET any (msg:"admanager.btopenworld.com"; classtype:trojan-activity; priority:1;) alert tcp 213.121.143.206 any $HOME_NET any (msg:"staticads.btopenworld.com"; classtype:trojan-activity; priority:1;) alert tcp 213.121.143.236 any $HOME_NET any (msg:"log.btopenworld.com"; classtype:trojan-activity; priority:1;) alert tcp 213.128.138.236 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;) alert tcp 213.13.145.12 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;) alert tcp 213.13.146.170 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;) alert tcp 213.13.65.100 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;) alert tcp 213.13.65.101 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;) alert tcp 213.130.46.221 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 213.130.63.232 any $HOME_NET any (msg:"adimages.been.com"; classtype:trojan-activity; priority:1;) alert tcp 213.130.63.233 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 213.130.63.235 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 213.131.245.218 any $HOME_NET any (msg:"ads5.virtual-nights.com"; classtype:trojan-activity; priority:1;) alert tcp 213.131.245.220 any $HOME_NET any (msg:"ads2.virtual-nights.com"; classtype:trojan-activity; priority:1;) alert tcp 213.131.245.221 any $HOME_NET any (msg:"ads.virtual-nights.com"; classtype:trojan-activity; priority:1;) alert tcp 213.131.245.222 any $HOME_NET any (msg:"ads.virtual-nights.com"; classtype:trojan-activity; priority:1;) alert tcp 213.131.252.240 any $HOME_NET any (msg:"ads.mmania.com"; classtype:trojan-activity; priority:1;) alert tcp 213.132.198.26 any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;) alert tcp 213.132.198.34 any $HOME_NET any (msg:"popupmoney.com"; classtype:trojan-activity; priority:1;) alert tcp 213.136.0.188 any $HOME_NET any (msg:"bannermarkt.nl"; classtype:trojan-activity; priority:1;) alert tcp 213.136.34.36 any $HOME_NET any (msg:"adext.inkclub.com"; classtype:trojan-activity; priority:1;) alert tcp 213.136.34.39 any $HOME_NET any (msg:"adext.inkclub.com"; classtype:trojan-activity; priority:1;) alert tcp 213.136.35.39 any $HOME_NET any (msg:"tailsweep.com"; classtype:trojan-activity; priority:1;) alert tcp 213.142.91.158 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;) alert tcp 213.143.91.141 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;) alert tcp 213.143.91.158 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;) alert tcp 213.147.97.248 any $HOME_NET any (msg:"webcounter.goweb.de"; classtype:trojan-activity; priority:1;) alert tcp 213.150.61.61 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;) alert tcp 213.152.246.10 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;) alert tcp 213.152.246.49 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;) alert tcp 213.152.246.50 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;) alert tcp 213.152.246.52 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.102 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.103 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.104 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.111 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.112 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.113 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.88 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.89 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.95 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 213.155.151.96 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.154.115 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.154.25 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.154.75 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.154.91 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.154.97 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.154.99 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.156.170 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.156.188 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;) alert tcp 213.155.156.189 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;) alert tcp 213.156.62.144 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;) alert tcp 213.156.62.167 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;) alert tcp 213.160.98.232 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 213.162.50.236 any $HOME_NET any (msg:"veille-referencement.com"; classtype:trojan-activity; priority:1;) alert tcp 213.165.94.88 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;) alert tcp 213.168.229.44 any $HOME_NET any (msg:"ota.cartrawler.com"; classtype:trojan-activity; priority:1;) alert tcp 213.174.148.228 any $HOME_NET any (msg:"ads.kinxxx.com"; classtype:trojan-activity; priority:1;) alert tcp 213.180.130.201 any $HOME_NET any (msg:"republika.onet.pl"; classtype:trojan-activity; priority:1;) alert tcp 213.180.132.66 any $HOME_NET any (msg:"republika.onet.pl"; classtype:trojan-activity; priority:1;) alert tcp 213.180.141.5 any $HOME_NET any (msg:"republika.onet.pl"; classtype:trojan-activity; priority:1;) alert tcp 213.180.193.90 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.180.194.113 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.180.204.190 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.180.204.7 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.180.204.8 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.180.204.90 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.180.204.92 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.180.214.31 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.186.40.138 any $HOME_NET any (msg:"geovisite.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.44.128 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.44.146 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.44.174 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.44.206 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.44.207 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.52.194 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.52.195 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.52.196 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.52.197 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.52.199 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;) alert tcp 213.186.57.159 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 213.189.203.88 any $HOME_NET any (msg:"reklamr.hitlist.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.191.147.162 any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;) alert tcp 213.193.0.48 any $HOME_NET any (msg:"ads.multimania.lycos.fr"; classtype:trojan-activity; priority:1;) alert tcp 213.193.4.14 any $HOME_NET any (msg:"ads.tripod.lycos.nl"; classtype:trojan-activity; priority:1;) alert tcp 213.199.148.196 any $HOME_NET any (msg:"ads.eu.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 213.199.154.22 any $HOME_NET any (msg:"ads.eu.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 213.199.202.88 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 213.200.112.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 213.202.100.12 any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;) alert tcp 213.202.100.8 any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;) alert tcp 213.202.225.23 any $HOME_NET any (msg:"media.funpic.de"; classtype:trojan-activity; priority:1;) alert tcp 213.202.240.124 any $HOME_NET any (msg:"ads2004.treiberupdate.de"; classtype:trojan-activity; priority:1;) alert tcp 213.202.244.192 any $HOME_NET any (msg:"ads2004.treiberupdate.de"; classtype:trojan-activity; priority:1;) alert tcp 213.203.200.2 any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;) alert tcp 213.203.200.3 any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;) alert tcp 213.203.222.26 any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;) alert tcp 213.205.137.165 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 213.205.137.166 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 213.205.36.33 any $HOME_NET any (msg:"ad.tiscali.com"; classtype:trojan-activity; priority:1;) alert tcp 213.206.254.75 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;) alert tcp 213.207.92.236 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;) alert tcp 213.209.100.206 any $HOME_NET any (msg:"mediavantage.de"; classtype:trojan-activity; priority:1;) alert tcp 213.215.116.33 any $HOME_NET any (msg:"mas.sector.sk"; classtype:trojan-activity; priority:1;) alert tcp 213.215.116.44 any $HOME_NET any (msg:"partner.pelikan.cz"; classtype:trojan-activity; priority:1;) alert tcp 213.218.116.147 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;) alert tcp 213.218.165.17 any $HOME_NET any (msg:"adaction.de"; classtype:trojan-activity; priority:1;) alert tcp 213.218.166.14 any $HOME_NET any (msg:"adaction.de"; classtype:trojan-activity; priority:1;) alert tcp 213.219.43.121 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 213.221.39.8 any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.221.39.9 any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.222.12.130 any $HOME_NET any (msg:"banners.resultonline.com"; classtype:trojan-activity; priority:1;) alert tcp 213.239.195.12 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;) alert tcp 213.239.225.74 any $HOME_NET any (msg:"witch-counter.de"; classtype:trojan-activity; priority:1;) alert tcp 213.242.96.4 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;) alert tcp 213.242.96.7 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.174.25 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.183.201 any $HOME_NET any (msg:"extreme-dm.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.12 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.16 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.17 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.19 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.21 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.24 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.26 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.28 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.29 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.30 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.31 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.32 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.37 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.38 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.39 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.40 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.46 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.49 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.5 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.51 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.53 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.55 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.56 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.57 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.58 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.59 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.6 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.60 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.66 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.69 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.71 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.185.8 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.188.8 any $HOME_NET any (msg:"cash4members.com"; classtype:trojan-activity; priority:1;) alert tcp 213.244.191.98 any $HOME_NET any (msg:"banners.babylon-x.com"; classtype:trojan-activity; priority:1;) alert tcp 213.246.55.165 any $HOME_NET any (msg:"popub.com"; classtype:trojan-activity; priority:1;) alert tcp 213.248.112.114 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;) alert tcp 213.248.112.115 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;) alert tcp 213.248.36.100 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 213.251.136.24 any $HOME_NET any (msg:"x-traceur.com"; classtype:trojan-activity; priority:1;) alert tcp 213.251.136.41 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 213.251.138.68 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 213.251.178.69 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 213.252.12.126 any $HOME_NET any (msg:"tfag.de"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.33 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.35 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.41 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.42 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.43 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.71 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.72 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.73 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 213.253.9.9 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 213.254.229.3 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 213.254.248.3 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 213.27.145.100 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 213.27.145.101 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 213.27.145.102 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 213.29.194.4 any $HOME_NET any (msg:"bm.annonce.cz"; classtype:trojan-activity; priority:1;) alert tcp 213.29.7.142 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;) alert tcp 213.29.7.251 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;) alert tcp 213.36.127.85 any $HOME_NET any (msg:"pub.chez.com"; classtype:trojan-activity; priority:1;) alert tcp 213.4.105.36 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 213.4.105.37 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 213.4.105.38 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 213.4.130.80 any $HOME_NET any (msg:"ads.ole.com"; classtype:trojan-activity; priority:1;) alert tcp 213.4.144.64 any $HOME_NET any (msg:"adserver.terra.es"; classtype:trojan-activity; priority:1;) alert tcp 213.41.76.72 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 213.41.76.73 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 213.42.1.108 any $HOME_NET any (msg:"ads.emirates.net.ae"; classtype:trojan-activity; priority:1;) alert tcp 213.52.134.126 any $HOME_NET any (msg:"au2m8.com"; classtype:trojan-activity; priority:1;) alert tcp 213.52.219.34 any $HOME_NET any (msg:"touchclarity.com"; classtype:trojan-activity; priority:1;) alert tcp 213.52.227.196 any $HOME_NET any (msg:"rightmedia.net"; classtype:trojan-activity; priority:1;) alert tcp 213.52.230.212 any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;) alert tcp 213.52.252.205 any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;) alert tcp 213.52.252.74 any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;) alert tcp 213.61.105.210 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 213.61.105.212 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 213.61.105.215 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 213.61.220.33 any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;) alert tcp 213.61.220.84 any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;) alert tcp 213.76.165.135 any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;) alert tcp 213.76.165.15 any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;) alert tcp 213.76.165.9 any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;) alert tcp 213.80.84.139 any $HOME_NET any (msg:"reklam.rfsl.se"; classtype:trojan-activity; priority:1;) alert tcp 213.86.246.22 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;) alert tcp 213.86.55.146 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;) alert tcp 213.86.55.161 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;) alert tcp 213.86.59.1 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 213.92.100.171 any $HOME_NET any (msg:"adserver.break-even.it"; classtype:trojan-activity; priority:1;) alert tcp 213.95.1.41 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;) alert tcp 213.95.1.55 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;) alert tcp 216.105.161.54 any $HOME_NET any (msg:"mediamgr.ugo.com"; classtype:trojan-activity; priority:1;) alert tcp 216.105.166.67 any $HOME_NET any (msg:"mediamgr.ugo.com"; classtype:trojan-activity; priority:1;) alert tcp 216.105.86.4 any $HOME_NET any (msg:"textad.sexsearch.com"; classtype:trojan-activity; priority:1;) alert tcp 216.105.94.65 any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;) alert tcp 216.105.94.81 any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;) alert tcp 216.109.213.232 any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;) alert tcp 216.115.239.51 any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;) alert tcp 216.12.133.68 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;) alert tcp 216.12.136.92 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;) alert tcp 216.12.136.93 any $HOME_NET any (msg:"bidclix.com"; classtype:trojan-activity; priority:1;) alert tcp 216.12.202.115 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;) alert tcp 216.12.213.206 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 216.12.39.100 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;) alert tcp 216.120.103.124 any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 216.120.27.21 any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;) alert tcp 216.120.60.183 any $HOME_NET any (msg:"ads.specificclick.com"; classtype:trojan-activity; priority:1;) alert tcp 216.121.97.66 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;) alert tcp 216.126.73.9 any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.32.74 any $HOME_NET any (msg:"porntrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.38.105 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.47.200 any $HOME_NET any (msg:"servedbyadbutler.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.47.205 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.52.241 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.52.242 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.52.249 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.52.250 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.62.29 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.62.30 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.86.119 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 216.127.94.117 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 216.127.94.127 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 216.130.163.21 any $HOME_NET any (msg:"xponsor.com"; classtype:trojan-activity; priority:1;) alert tcp 216.130.163.22 any $HOME_NET any (msg:"xponsor.com"; classtype:trojan-activity; priority:1;) alert tcp 216.130.197.236 any $HOME_NET any (msg:"banners.babylon-x.com"; classtype:trojan-activity; priority:1;) alert tcp 216.130.218.43 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 216.136.30.31 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;) alert tcp 216.137.45.11 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 216.137.45.155 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 216.137.45.171 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 216.137.45.179 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 216.137.45.235 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 216.137.45.247 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 216.137.45.3 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 216.137.45.95 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.1 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.10 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.100 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.101 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.103 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.104 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.105 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.106 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.107 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.108 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.109 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.11 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.110 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.111 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.113 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.114 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.115 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.116 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.117 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.119 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.12 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.120 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.121 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.123 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.124 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.125 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.126 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.128 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.129 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.13 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.130 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.131 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.132 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.133 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.135 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.136 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.137 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.138 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.139 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.14 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.140 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.141 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.142 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.145 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.146 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.147 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.148 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.149 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.15 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.150 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.151 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.152 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.154 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.155 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.156 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.157 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.158 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.159 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.16 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.160 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.161 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.162 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.163 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.165 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.166 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.167 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.169 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.17 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.170 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.171 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.172 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.173 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.176 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.177 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.178 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.18 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.181 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.182 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.185 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.186 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.187 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.188 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.19 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.190 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.191 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.192 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.193 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.194 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.197 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.198 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.199 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.2 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.201 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.202 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.204 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.205 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.206 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.207 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.208 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.209 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.21 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.210 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.211 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.212 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.213 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.214 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.215 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.216 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.217 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.218 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.219 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.22 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.220 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.221 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.222 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.223 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.224 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.225 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.226 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.227 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.228 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.229 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.23 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.230 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.232 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.233 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.234 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.235 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.236 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.237 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.238 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.239 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.24 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.240 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.241 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.243 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.244 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.245 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.246 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.249 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.25 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.250 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.251 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.252 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.253 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.254 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.26 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.27 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.29 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.30 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.31 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.32 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.33 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.34 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.35 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.36 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.37 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.39 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.4 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.40 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.41 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.42 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.43 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.45 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.46 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.48 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.49 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.5 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.51 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.52 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.53 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.55 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.56 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.57 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.59 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.6 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.60 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.61 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.62 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.63 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.65 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.66 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.68 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.69 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.70 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.73 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.75 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.77 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.78 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.8 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.81 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.82 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.85 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.86 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.89 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.9 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.90 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.91 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.93 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.95 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.97 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.57.98 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.119 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.127 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.129 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.154 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.167 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.170 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.186 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.194 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.200 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.21 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.22 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.227 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.230 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.246 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.248 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.249 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.254 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.4 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.50 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.53 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.57 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.62 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.63 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.64 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.69 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.71 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.78 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.81 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.87 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.88 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.89 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.90 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.93 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.59.94 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.1 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.10 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.100 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.101 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.102 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.103 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.104 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.105 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.106 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.107 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.108 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.109 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.11 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.110 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.111 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.112 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.114 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.115 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.116 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.117 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.118 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.119 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.12 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.120 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.121 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.122 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.123 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.124 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.125 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.126 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.127 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.128 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.129 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.13 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.130 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.131 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.132 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.133 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.135 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.136 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.137 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.138 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.139 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.14 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.140 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.141 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.142 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.144 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.146 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.147 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.148 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.149 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.15 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.150 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.151 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.152 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.153 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.154 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.155 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.156 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.157 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.158 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.159 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.16 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.160 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.161 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.162 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.163 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.164 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.165 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.166 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.167 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.168 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.169 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.17 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.170 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.171 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.172 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.173 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.174 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.175 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.176 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.177 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.178 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.18 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.181 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.182 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.183 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.184 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.185 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.186 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.187 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.19 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.190 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.192 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.193 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.194 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.195 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.196 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.197 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.198 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.199 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.2 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.20 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.200 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.201 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.202 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.204 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.205 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.206 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.207 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.208 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.21 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.210 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.211 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.212 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.213 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.215 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.216 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.217 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.218 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.219 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.22 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.220 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.221 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.222 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.223 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.224 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.225 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.226 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.227 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.228 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.229 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.23 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.230 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.231 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.232 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.233 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.234 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.235 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.236 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.237 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.238 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.239 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.24 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.240 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.241 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.242 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.243 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.244 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.245 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.246 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.247 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.248 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.25 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.250 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.251 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.252 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.253 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.254 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.26 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.27 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.28 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.29 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.3 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.30 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.31 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.32 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.33 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.34 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.35 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.36 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.37 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.38 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.39 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.4 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.40 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.41 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.42 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.43 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.44 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.45 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.46 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.48 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.49 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.5 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.50 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.51 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.52 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.53 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.54 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.55 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.56 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.57 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.58 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.6 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.60 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.61 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.62 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.64 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.65 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.66 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.67 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.68 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.69 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.70 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.71 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.72 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.73 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.74 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.75 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.76 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.77 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.78 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.8 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.80 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.81 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.82 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.83 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.84 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.85 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.86 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.87 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.89 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.90 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.91 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.92 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.93 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.94 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.95 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.96 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.97 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.98 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.137.63.99 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 216.138.240.196 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 216.138.240.197 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 216.139.206.21 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;) alert tcp 216.139.218.83 any $HOME_NET any (msg:"liverail.com"; classtype:trojan-activity; priority:1;) alert tcp 216.139.226.142 any $HOME_NET any (msg:"pepperjamnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 216.140.182.70 any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;) alert tcp 216.140.182.72 any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;) alert tcp 216.144.229.172 any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;) alert tcp 216.144.239.46 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 216.146.38.125 any $HOME_NET any (msg:"mopub.com"; classtype:trojan-activity; priority:1;) alert tcp 216.146.39.125 any $HOME_NET any (msg:"mopub.com"; classtype:trojan-activity; priority:1;) alert tcp 216.146.46.10 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;) alert tcp 216.146.46.11 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;) alert tcp 216.148.231.82 any $HOME_NET any (msg:"affiliates.allposters.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.144.105 any $HOME_NET any (msg:"ads.gamecity.net"; classtype:trojan-activity; priority:1;) alert tcp 216.15.144.108 any $HOME_NET any (msg:"ads4.gamecity.net"; classtype:trojan-activity; priority:1;) alert tcp 216.15.144.64 any $HOME_NET any (msg:"ads3.gamecity.net"; classtype:trojan-activity; priority:1;) alert tcp 216.15.211.80 any $HOME_NET any (msg:"ad1.gamezone.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.250.120 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.250.140 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.250.147 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.250.148 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.250.149 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.250.160 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.250.180 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.251.110 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.251.130 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.251.135 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.251.136 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.251.137 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.251.150 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.15.251.170 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.150.13.94 any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;) alert tcp 216.150.135.40 any $HOME_NET any (msg:"ads.wineenthusiast.com"; classtype:trojan-activity; priority:1;) alert tcp 216.150.15.88 any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;) alert tcp 216.150.21.62 any $HOME_NET any (msg:"vericlick.com"; classtype:trojan-activity; priority:1;) alert tcp 216.150.213.151 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;) alert tcp 216.150.214.58 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;) alert tcp 216.151.210.122 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 216.152.135.89 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.155.128.51 any $HOME_NET any (msg:"ads.kinxxx.com"; classtype:trojan-activity; priority:1;) alert tcp 216.155.130.246 any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;) alert tcp 216.155.133.68 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 216.155.137.146 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 216.155.137.147 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 216.155.141.164 any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;) alert tcp 216.155.141.165 any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;) alert tcp 216.155.143.86 any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;) alert tcp 216.156.244.187 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 216.157.25.98 any $HOME_NET any (msg:"advertserve.com"; classtype:trojan-activity; priority:1;) alert tcp 216.157.75.145 any $HOME_NET any (msg:"adbuyer.com"; classtype:trojan-activity; priority:1;) alert tcp 216.157.8.158 any $HOME_NET any (msg:"adbuyer.com"; classtype:trojan-activity; priority:1;) alert tcp 216.162.102.101 any $HOME_NET any (msg:"ads2.gamecity.net"; classtype:trojan-activity; priority:1;) alert tcp 216.162.102.150 any $HOME_NET any (msg:"ads7.gamecity.net"; classtype:trojan-activity; priority:1;) alert tcp 216.167.104.116 any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;) alert tcp 216.167.32.64 any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;) alert tcp 216.168.224.53 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;) alert tcp 216.168.224.64 any $HOME_NET any (msg:"bannermall.com"; classtype:trojan-activity; priority:1;) alert tcp 216.168.229.54 any $HOME_NET any (msg:"phoenix-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;) alert tcp 216.168.229.63 any $HOME_NET any (msg:"superstats.com"; classtype:trojan-activity; priority:1;) alert tcp 216.168.60.39 any $HOME_NET any (msg:"ads.neoseeker.com"; classtype:trojan-activity; priority:1;) alert tcp 216.17.193.108 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;) alert tcp 216.172.104.3 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;) alert tcp 216.174.98.1 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;) alert tcp 216.177.145.14 any $HOME_NET any (msg:"zeusclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 216.178.176.15 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 216.178.176.16 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;) alert tcp 216.178.38.123 any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;) alert tcp 216.178.41.162 any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;) alert tcp 216.178.41.26 any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;) alert tcp 216.178.47.61 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 216.179.149.163 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;) alert tcp 216.18.178.216 any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;) alert tcp 216.18.183.102 any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;) alert tcp 216.18.202.198 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;) alert tcp 216.18.227.124 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;) alert tcp 216.180.106.60 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.180.236.62 any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;) alert tcp 216.187.103.168 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;) alert tcp 216.187.103.169 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;) alert tcp 216.187.103.170 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;) alert tcp 216.187.79.35 any $HOME_NET any (msg:"hentaicounter.com"; classtype:trojan-activity; priority:1;) alert tcp 216.187.97.26 any $HOME_NET any (msg:"banner.noblepoker.com"; classtype:trojan-activity; priority:1;) alert tcp 216.189.0.240 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 216.193.201.138 any $HOME_NET any (msg:"affiliates.globat.com"; classtype:trojan-activity; priority:1;) alert tcp 216.193.201.162 any $HOME_NET any (msg:"affiliates.globat.com"; classtype:trojan-activity; priority:1;) alert tcp 216.193.215.146 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 216.194.70.2 any $HOME_NET any (msg:"cjbmanagement.com"; classtype:trojan-activity; priority:1;) alert tcp 216.195.33.114 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 216.195.78.39 any $HOME_NET any (msg:"ads.co.com"; classtype:trojan-activity; priority:1;) alert tcp 216.197.111.13 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;) alert tcp 216.197.111.198 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;) alert tcp 216.198.221.166 any $HOME_NET any (msg:"worldwide-cash.net"; classtype:trojan-activity; priority:1;) alert tcp 216.198.226.35 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;) alert tcp 216.200.145.8 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 216.200.199.35 any $HOME_NET any (msg:"ads20.bpath.com"; classtype:trojan-activity; priority:1;) alert tcp 216.200.199.38 any $HOME_NET any (msg:"ads18.bpath.com"; classtype:trojan-activity; priority:1;) alert tcp 216.200.199.56 any $HOME_NET any (msg:"hyperbanner.net"; classtype:trojan-activity; priority:1;) alert tcp 216.200.199.57 any $HOME_NET any (msg:"hyperbanner.net"; classtype:trojan-activity; priority:1;) alert tcp 216.201.83.161 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;) alert tcp 216.205.149.100 any $HOME_NET any (msg:"bluelithium.com"; classtype:trojan-activity; priority:1;) alert tcp 216.205.150.13 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;) alert tcp 216.21.222.7 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 216.218.185.148 any $HOME_NET any (msg:"ads.hitcents.com"; classtype:trojan-activity; priority:1;) alert tcp 216.218.211.56 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 216.218.211.57 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 216.218.223.227 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 216.22.45.38 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.22.45.39 any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.22.45.40 any $HOME_NET any (msg:"backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.22.45.47 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.22.45.48 any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.220.63.250 any $HOME_NET any (msg:"optmd.com"; classtype:trojan-activity; priority:1;) alert tcp 216.221.138.77 any $HOME_NET any (msg:"supertop100.com"; classtype:trojan-activity; priority:1;) alert tcp 216.224.121.130 any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.224.121.146 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.227.220.4 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 216.23.185.99 any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;) alert tcp 216.237.154.98 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.113.131 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.113.224 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.113.41 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.113.43 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.115.143 any $HOME_NET any (msg:"dw.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.116.160 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.116.49 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.116.50 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.116.64 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.116.65 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.120.226 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.120.248 any $HOME_NET any (msg:"ads.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.120.39 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.122.197 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.122.33 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.122.38 any $HOME_NET any (msg:"adimg.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.122.54 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.32.21 any $HOME_NET any (msg:"adgardener.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.35.119 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.37.100 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.37.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.37.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.37.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.39.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.39.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.51.119 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.51.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.57.100 any $HOME_NET any (msg:"pagead.googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.57.103 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.57.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.57.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.57.99 any $HOME_NET any (msg:"google-analytics.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 216.239.59.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 216.24.32.37 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 216.24.32.39 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 216.24.32.40 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 216.24.32.41 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 216.24.32.43 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 216.240.132.150 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;) alert tcp 216.240.187.143 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 216.240.187.144 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 216.240.187.148 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 216.240.187.153 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 216.240.187.158 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 216.240.187.175 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 216.240.187.208 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;) alert tcp 216.243.12.11 any $HOME_NET any (msg:"servedbyadbutler.com"; classtype:trojan-activity; priority:1;) alert tcp 216.243.12.14 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;) alert tcp 216.244.123.6 any $HOME_NET any (msg:"insightexpress.com"; classtype:trojan-activity; priority:1;) alert tcp 216.244.123.9 any $HOME_NET any (msg:"insightexpressai.com"; classtype:trojan-activity; priority:1;) alert tcp 216.246.14.17 any $HOME_NET any (msg:"wetrack.it"; classtype:trojan-activity; priority:1;) alert tcp 216.246.14.19 any $HOME_NET any (msg:"trackingsoft.com"; classtype:trojan-activity; priority:1;) alert tcp 216.246.45.17 any $HOME_NET any (msg:"clickfinders.com"; classtype:trojan-activity; priority:1;) alert tcp 216.246.7.174 any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.141.189 any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.141.190 any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.177.230 any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.177.233 any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.177.235 any $HOME_NET any (msg:"shoppingads.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.48.198 any $HOME_NET any (msg:"citi.bridgetrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.52.65 any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.59.111 any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.250.61.65 any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.251.126.246 any $HOME_NET any (msg:"affiliate.travelnow.com"; classtype:trojan-activity; priority:1;) alert tcp 216.27.89.28 any $HOME_NET any (msg:"searchmarketing.com"; classtype:trojan-activity; priority:1;) alert tcp 216.27.9.98 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.27.93.100 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.27.93.64 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.27.93.7 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.27.93.8 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.27.94.40 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.131.135 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.131.156 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.131.173 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.131.174 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.207.131 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.207.134 any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.207.135 any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.207.60 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.207.61 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.209.10 any $HOME_NET any (msg:"commission-junction.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.209.13 any $HOME_NET any (msg:"tkqlhce.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.209.14 any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.32.118 any $HOME_NET any (msg:"banners.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.32.124 any $HOME_NET any (msg:"banners.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.38.116 any $HOME_NET any (msg:"adserver.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.38.65 any $HOME_NET any (msg:"banners.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.38.81 any $HOME_NET any (msg:"adserver.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.38.92 any $HOME_NET any (msg:"banners.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.38.96 any $HOME_NET any (msg:"ads.gradfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.38.97 any $HOME_NET any (msg:"pop6.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.7.188 any $HOME_NET any (msg:"stats.blogger.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.77.66 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.77.90 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.88.111 any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.88.201 any $HOME_NET any (msg:"click.avenuea.com"; classtype:trojan-activity; priority:1;) alert tcp 216.34.88.202 any $HOME_NET any (msg:"click.avenuea.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.123.68 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.123.81 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.197.148 any $HOME_NET any (msg:"offerforge.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.197.40 any $HOME_NET any (msg:"offerforge.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.207.209 any $HOME_NET any (msg:"offerforge.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.71.105 any $HOME_NET any (msg:"ad.linksynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.71.113 any $HOME_NET any (msg:"click.linksynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.71.120 any $HOME_NET any (msg:"ad.linksynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.71.96 any $HOME_NET any (msg:"linksynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 216.35.79.46 any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;) alert tcp 216.36.248.128 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 216.37.13.152 any $HOME_NET any (msg:"radiate.com"; classtype:trojan-activity; priority:1;) alert tcp 216.38.192.53 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;) alert tcp 216.38.222.30 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;) alert tcp 216.38.58.11 any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;) alert tcp 216.38.58.23 any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.57.106 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.57.107 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.58.114 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.58.184 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.58.249 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.58.250 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.58.251 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.58.95 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 216.39.69.146 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.196.15 any $HOME_NET any (msg:"monsterpops.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.201.212 any $HOME_NET any (msg:"specificpop.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.226.220 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.247.45 any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.32.140 any $HOME_NET any (msg:"vs.tucows.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.32.38 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.32.39 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.32.40 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.32.50 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.32.60 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;) alert tcp 216.40.33.251 any $HOME_NET any (msg:"eadexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 216.49.88.130 any $HOME_NET any (msg:"ads.mcafee.com"; classtype:trojan-activity; priority:1;) alert tcp 216.49.88.68 any $HOME_NET any (msg:"ads.mcafee.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.121.177 any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;) alert tcp 216.52.167.130 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.17.110 any $HOME_NET any (msg:"superstats.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.17.111 any $HOME_NET any (msg:"media.superstats.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.17.120 any $HOME_NET any (msg:"media-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.17.122 any $HOME_NET any (msg:"phoenix-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.17.96 any $HOME_NET any (msg:"instadia.net"; classtype:trojan-activity; priority:1;) alert tcp 216.52.175.142 any $HOME_NET any (msg:"adgardener.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.175.144 any $HOME_NET any (msg:"adgardener.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.221.248 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.244.254 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;) alert tcp 216.52.245.20 any $HOME_NET any (msg:"ads.aceweb.net"; classtype:trojan-activity; priority:1;) alert tcp 216.52.245.7 any $HOME_NET any (msg:"ads.aceweb.net"; classtype:trojan-activity; priority:1;) alert tcp 216.52.252.1 any $HOME_NET any (msg:"adserver.matchcraft.com"; classtype:trojan-activity; priority:1;) alert tcp 216.53.188.52 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 216.54.194.5 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;) alert tcp 216.55.101.194 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;) alert tcp 216.55.101.197 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;) alert tcp 216.55.161.37 any $HOME_NET any (msg:"adtology.com"; classtype:trojan-activity; priority:1;) alert tcp 216.55.97.243 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;) alert tcp 216.55.97.68 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;) alert tcp 216.55.98.244 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;) alert tcp 216.59.38.122 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 216.65.1.254 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;) alert tcp 216.65.3.213 any $HOME_NET any (msg:"cashfiesta.com"; classtype:trojan-activity; priority:1;) alert tcp 216.65.86.38 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 216.67.228.67 any $HOME_NET any (msg:"ads.flooble.com"; classtype:trojan-activity; priority:1;) alert tcp 216.67.232.70 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 216.67.245.30 any $HOME_NET any (msg:"realtechnetwork.net"; classtype:trojan-activity; priority:1;) alert tcp 216.69.174.61 any $HOME_NET any (msg:"matchcraft.com"; classtype:trojan-activity; priority:1;) alert tcp 216.70.104.229 any $HOME_NET any (msg:"liveintent.com"; classtype:trojan-activity; priority:1;) alert tcp 216.70.114.126 any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;) alert tcp 216.73.115.130 any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 216.73.80.149 any $HOME_NET any (msg:"ads.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 216.73.80.160 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 216.73.85.29 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 216.73.86.13 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 216.73.86.188 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 216.73.86.58 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 216.73.87.13 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 216.73.87.188 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 216.73.87.58 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 216.73.92.112 any $HOME_NET any (msg:"doubleclick.de"; classtype:trojan-activity; priority:1;) alert tcp 216.73.92.126 any $HOME_NET any (msg:"tangozebra.com"; classtype:trojan-activity; priority:1;) alert tcp 216.73.93.169 any $HOME_NET any (msg:"ads.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 216.73.93.170 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 216.73.93.8 any $HOME_NET any (msg:"doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 216.74.133.195 any $HOME_NET any (msg:"tribalfusion.speedera.net"; classtype:trojan-activity; priority:1;) alert tcp 216.74.21.227 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;) alert tcp 216.74.21.229 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;) alert tcp 216.74.21.235 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;) alert tcp 216.74.32.80 any $HOME_NET any (msg:"rlcdn.com"; classtype:trojan-activity; priority:1;) alert tcp 216.74.41.5 any $HOME_NET any (msg:"flurry.com"; classtype:trojan-activity; priority:1;) alert tcp 216.74.57.38 any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;) alert tcp 216.8.179.26 any $HOME_NET any (msg:"ndparking.com"; classtype:trojan-activity; priority:1;) alert tcp 216.83.147.78 any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;) alert tcp 216.86.146.46 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;) alert tcp 216.87.174.29 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;) alert tcp 216.87.184.108 any $HOME_NET any (msg:"adultadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 216.9.35.50 any $HOME_NET any (msg:"ads.digitalpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 216.9.35.57 any $HOME_NET any (msg:"ads.digitalpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 216.9.35.58 any $HOME_NET any (msg:"geo.digitalpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 216.9.35.59 any $HOME_NET any (msg:"geo.digitalpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 216.9.35.60 any $HOME_NET any (msg:"ads.digitalpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 216.90.130.47 any $HOME_NET any (msg:"conversionruler.com"; classtype:trojan-activity; priority:1;) alert tcp 216.92.131.172 any $HOME_NET any (msg:"ads.simtel.net"; classtype:trojan-activity; priority:1;) alert tcp 216.92.187.245 any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;) alert tcp 216.92.210.177 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;) alert tcp 216.92.223.3 any $HOME_NET any (msg:"globalismedia.com"; classtype:trojan-activity; priority:1;) alert tcp 216.93.168.144 any $HOME_NET any (msg:"aim4media.com"; classtype:trojan-activity; priority:1;) alert tcp 216.93.177.101 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 216.93.179.77 any $HOME_NET any (msg:"trackalyzer.com"; classtype:trojan-activity; priority:1;) alert tcp 216.93.251.199 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 216.93.251.207 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 216.93.251.211 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 216.94.0.33 any $HOME_NET any (msg:"casinopays.com"; classtype:trojan-activity; priority:1;) alert tcp 216.98.141.250 any $HOME_NET any (msg:"chartbeat.net"; classtype:trojan-activity; priority:1;) alert tcp 216.98.225.3 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 217.10.42.13 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.107.216.13 any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.11.100.83 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;) alert tcp 217.11.235.108 any $HOME_NET any (msg:"ad1.kde.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.235.110 any $HOME_NET any (msg:"e.kde.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.235.117 any $HOME_NET any (msg:"ad1.kde.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.237.37 any $HOME_NET any (msg:"adv.yo.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.237.42 any $HOME_NET any (msg:"adv.yo.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.242.178 any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.242.179 any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.251.225 any $HOME_NET any (msg:"ads.cybersales.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.251.227 any $HOME_NET any (msg:"ads.cybersales.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.11.251.237 any $HOME_NET any (msg:"ads.cybersales.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.110.110.229 any $HOME_NET any (msg:"zanox-affiliate.de"; classtype:trojan-activity; priority:1;) alert tcp 217.110.110.231 any $HOME_NET any (msg:"ad.zanox.com"; classtype:trojan-activity; priority:1;) alert tcp 217.110.110.251 any $HOME_NET any (msg:"zanox.com"; classtype:trojan-activity; priority:1;) alert tcp 217.110.115.76 any $HOME_NET any (msg:"www.cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 217.110.119.145 any $HOME_NET any (msg:"www.megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.110.64.201 any $HOME_NET any (msg:"statistik.motorpresse.de"; classtype:trojan-activity; priority:1;) alert tcp 217.110.73.163 any $HOME_NET any (msg:"ranking-links.de"; classtype:trojan-activity; priority:1;) alert tcp 217.111.100.10 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.111.100.101 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.111.100.210 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.111.100.212 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.111.100.213 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.111.100.214 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.111.100.216 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.111.100.219 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 217.114.87.66 any $HOME_NET any (msg:"tradedoubler.com"; classtype:trojan-activity; priority:1;) alert tcp 217.115.142.110 any $HOME_NET any (msg:"180hits.de"; classtype:trojan-activity; priority:1;) alert tcp 217.115.205.106 any $HOME_NET any (msg:"stats4all.com"; classtype:trojan-activity; priority:1;) alert tcp 217.116.46.155 any $HOME_NET any (msg:"ads.deltha.hu"; classtype:trojan-activity; priority:1;) alert tcp 217.117.154.3 any $HOME_NET any (msg:"perf.weborama.fr"; classtype:trojan-activity; priority:1;) alert tcp 217.117.154.30 any $HOME_NET any (msg:"weborama.fr"; classtype:trojan-activity; priority:1;) alert tcp 217.144.113.67 any $HOME_NET any (msg:"ads.kompass.com"; classtype:trojan-activity; priority:1;) alert tcp 217.146.185.193 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 217.147.120.106 any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;) alert tcp 217.149.242.99 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;) alert tcp 217.149.36.50 any $HOME_NET any (msg:"ads.addesktop.com"; classtype:trojan-activity; priority:1;) alert tcp 217.15.42.28 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;) alert tcp 217.151.107.46 any $HOME_NET any (msg:"af-ad.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 217.154.105.226 any $HOME_NET any (msg:"zencudo.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 217.156.103.15 any $HOME_NET any (msg:"trafic.ro"; classtype:trojan-activity; priority:1;) alert tcp 217.156.103.51 any $HOME_NET any (msg:"a.boom.ro"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.139 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.146 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.152 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.161 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.162 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.163 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.176 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.178 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.184 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.186 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.195 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.203 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.208 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.210 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 217.156.169.211 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 217.157.7.11 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;) alert tcp 217.157.7.12 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;) alert tcp 217.157.7.26 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;) alert tcp 217.16.16.110 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.16.16.130 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.16.16.143 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.16.16.153 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.16.19.225 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.16.19.235 any $HOME_NET any (msg:"ad.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.16.19.237 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.16.19.245 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.16.20.81 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.160.126.13 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;) alert tcp 217.160.175.94 any $HOME_NET any (msg:"spezialreporte.de"; classtype:trojan-activity; priority:1;) alert tcp 217.160.176.55 any $HOME_NET any (msg:"adrotate.de"; classtype:trojan-activity; priority:1;) alert tcp 217.160.215.86 any $HOME_NET any (msg:"layer-ad.de"; classtype:trojan-activity; priority:1;) alert tcp 217.160.31.64 any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 217.160.51.160 any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 217.160.78.175 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;) alert tcp 217.160.95.137 any $HOME_NET any (msg:"visitbox.de"; classtype:trojan-activity; priority:1;) alert tcp 217.160.95.94 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 217.17.139.174 any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;) alert tcp 217.17.35.146 any $HOME_NET any (msg:"hit.gemius.pl"; classtype:trojan-activity; priority:1;) alert tcp 217.17.36.162 any $HOME_NET any (msg:"stat24.com"; classtype:trojan-activity; priority:1;) alert tcp 217.17.36.200 any $HOME_NET any (msg:"stat24.com"; classtype:trojan-activity; priority:1;) alert tcp 217.17.36.236 any $HOME_NET any (msg:"stat.pl"; classtype:trojan-activity; priority:1;) alert tcp 217.170.3.140 any $HOME_NET any (msg:"m4n.nl"; classtype:trojan-activity; priority:1;) alert tcp 217.170.3.96 any $HOME_NET any (msg:"m4n.nl"; classtype:trojan-activity; priority:1;) alert tcp 217.172.160.232 any $HOME_NET any (msg:"spezialreporte.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.180.33 any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;) alert tcp 217.172.181.14 any $HOME_NET any (msg:"www.bannerads.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.185.188 any $HOME_NET any (msg:"targad.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.44.13 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.44.138 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.44.145 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.44.15 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.44.70 any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.49.66 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 217.172.49.72 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 217.173.137.4 any $HOME_NET any (msg:"banner.titan-dsl.de"; classtype:trojan-activity; priority:1;) alert tcp 217.173.149.64 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;) alert tcp 217.19.248.132 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 217.19.248.133 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 217.194.102.5 any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;) alert tcp 217.197.114.32 any $HOME_NET any (msg:"click.kmindex.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.197.114.33 any $HOME_NET any (msg:"counting.kmindex.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.197.114.8 any $HOME_NET any (msg:"counting.kmindex.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.197.152.188 any $HOME_NET any (msg:"ad.nwt.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.10 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.101 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.102 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.11 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.12 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.14 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.15 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.16 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.3 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.4 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.5 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.6 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.8 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.199.217.9 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 217.20.130.17 any $HOME_NET any (msg:"sher.index.hu"; classtype:trojan-activity; priority:1;) alert tcp 217.20.131.7 any $HOME_NET any (msg:"sher.index.hu"; classtype:trojan-activity; priority:1;) alert tcp 217.20.17.70 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;) alert tcp 217.206.223.62 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;) alert tcp 217.21.132.24 any $HOME_NET any (msg:"travis.bosscasinos.com"; classtype:trojan-activity; priority:1;) alert tcp 217.22.65.24 any $HOME_NET any (msg:"onestat.com"; classtype:trojan-activity; priority:1;) alert tcp 217.237.190.224 any $HOME_NET any (msg:"ads.quoka.de"; classtype:trojan-activity; priority:1;) alert tcp 217.237.190.46 any $HOME_NET any (msg:"ads.quoka.de"; classtype:trojan-activity; priority:1;) alert tcp 217.237.190.47 any $HOME_NET any (msg:"ads.quoka.de"; classtype:trojan-activity; priority:1;) alert tcp 217.29.32.152 any $HOME_NET any (msg:"ecircle-ag.com"; classtype:trojan-activity; priority:1;) alert tcp 217.29.42.23 any $HOME_NET any (msg:"ecircle-ag.com"; classtype:trojan-activity; priority:1;) alert tcp 217.30.188.12 any $HOME_NET any (msg:"snoobi.com"; classtype:trojan-activity; priority:1;) alert tcp 217.31.57.86 any $HOME_NET any (msg:"ad.hyena.cz"; classtype:trojan-activity; priority:1;) alert tcp 217.65.6.5 any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;) alert tcp 217.68.21.37 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 217.68.23.221 any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.144 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.145 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.146 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.147 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.148 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.149 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.46 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.47 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.48 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.133.49 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.134.212 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.135.1 any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.135.129 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.135.131 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.136.176 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.69.136.185 any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;) alert tcp 217.71.160.16 any $HOME_NET any (msg:"advertmedia.de"; classtype:trojan-activity; priority:1;) alert tcp 217.72.195.151 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 217.72.195.152 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 217.72.195.84 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 217.72.195.85 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 217.72.199.180 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 217.72.200.153 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 217.72.240.204 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 217.72.66.239 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;) alert tcp 217.73.201.37 any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;) alert tcp 217.73.3.70 any $HOME_NET any (msg:"travis.bosscasinos.com"; classtype:trojan-activity; priority:1;) alert tcp 217.77.34.216 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;) alert tcp 217.78.34.225 any $HOME_NET any (msg:"ads.nordichardware.se"; classtype:trojan-activity; priority:1;) alert tcp 217.79.177.14 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;) alert tcp 217.79.177.197 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;) alert tcp 217.79.177.27 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;) alert tcp 217.79.187.93 any $HOME_NET any (msg:"advolution.de"; classtype:trojan-activity; priority:1;) alert tcp 217.79.188.6 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;) alert tcp 217.97.243.217 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.105 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.11 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.12 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.129 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.14 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.141 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.142 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.155 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.167 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.18 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.19 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.74 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.75 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.76 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.145.28.82 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 218.191.97.98 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 218.233.240.143 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;) alert tcp 218.233.240.148 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;) alert tcp 218.29.177.19 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 218.76.201.231 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 218.76.201.238 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 218.76.201.241 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 218.76.78.8 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.130 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.132 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.133 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.134 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.135 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.136 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.139 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.141 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.142 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.143 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.144 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.145 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.147 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.148 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.174 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.186 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.187 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.241.192 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.10 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.24 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.3 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.38 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.39 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.4 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.42 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.45 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.5 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.55 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.56 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.6 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.7 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.8 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.88 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.232.243.9 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.238.238.245 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 219.240.39.67 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;) alert tcp 219.240.39.71 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;) alert tcp 219.240.39.95 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;) alert tcp 219.94.225.104 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;) alert tcp 220.170.143.151 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 220.181.78.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 220.226.195.22 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 220.226.198.20 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 221.116.73.99 any $HOME_NET any (msg:"tatsumi-sys.jp"; classtype:trojan-activity; priority:1;) alert tcp 221.126.92.237 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.1.227 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.10.15 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.10.161 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.10.179 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.13.242 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.14.229 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.15.204 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.48.103 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.48.201 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.48.66 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.49.12 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.49.18 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.50.1 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.50.248 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.50.96 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.51.106 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.51.153 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.51.207 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.51.40 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.52.216 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.52.63 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.52.82 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.53.254 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.53.50 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.53.95 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.54.137 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.54.79 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.55.0 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.76.116 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.76.63 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.76.99 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.77.122 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.77.208 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.77.235 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.77.246 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.77.251 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.77.57 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.77.98 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.78.174 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.78.65 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.78.75 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.79.249 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.79.76 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.79.79 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.9.102 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.96.148 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.96.72 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.96.93 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.97.196 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.98.22 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.98.36 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.98.4 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.98.8 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.127.99.197 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;) alert tcp 221.13.128.164 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 221.13.128.166 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 221.13.128.167 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 221.13.128.173 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 221.13.128.174 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 221.13.128.190 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 222.122.209.102 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;) alert tcp 222.187.221.28 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 222.236.44.131 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;) alert tcp 222.73.205.6 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 222.88.95.2 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 222.88.95.5 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 222.89.164.11 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 23.21.105.103 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.105.51 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.109.1 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.109.41 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.114.7 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.118.41 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.121.47 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.124.212 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.131.103 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 23.21.137.147 any $HOME_NET any (msg:"servedbyopenx.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.142.221 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.145.197 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.164.157 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 23.21.171.3 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.182.206 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.182.46 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.195.13 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.213.197 any $HOME_NET any (msg:"adapt.tv"; classtype:trojan-activity; priority:1;) alert tcp 23.21.222.53 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.223.100 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.229.219 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.231.58 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.238.203 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 23.21.242.35 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.242.94 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.249.214 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.251.245 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.73.157 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 23.21.75.33 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.76.157 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.78.9 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.80.205 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.89.135 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.90.188 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.90.220 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.90.222 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.90.80 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.90.87 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.92.173 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.93.59 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 23.21.95.94 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.100.157 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.101.121 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.103.48 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.110.58 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.110.81 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.115.199 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.116.187 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.121.42 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.122.198 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.129.32 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.131.158 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 23.23.136.102 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.137.168 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.137.192 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.139.12 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.139.214 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.139.249 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.141.52 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.141.62 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.142.198 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.146.11 any $HOME_NET any (msg:"extreme-dm.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.149.214 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.159.252 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.172.134 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.174.168 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 23.23.204.128 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.210.22 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.217.72 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.236.93 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.249.2 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.254.86 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.88.230 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.92.97 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 23.23.97.186 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 23.38.101.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 23.38.3.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 23.43.99.93 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;) alert tcp 23.61.251.99 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 23.61.255.217 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 23.61.255.240 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 23.62.53.67 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 23.62.53.73 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 23.62.53.98 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 23.74.118.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 23.74.120.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 23.74.125.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 24.138.22.101 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 24.152.163.130 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;) alert tcp 24.152.163.157 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;) alert tcp 24.152.170.36 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;) alert tcp 24.152.191.10 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;) alert tcp 24.152.191.9 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;) alert tcp 24.168.156.120 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;) alert tcp 24.19.185.244 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 24.19.187.214 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 24.196.79.133 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 24.196.79.142 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 24.222.75.238 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 24.244.141.248 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 24.249.226.22 any $HOME_NET any (msg:"spywarelabs.com"; classtype:trojan-activity; priority:1;) alert tcp 24.43.169.7 any $HOME_NET any (msg:"ads.aceweb.net"; classtype:trojan-activity; priority:1;) alert tcp 24.75.17.150 any $HOME_NET any (msg:"kanoodle.com"; classtype:trojan-activity; priority:1;) alert tcp 31.192.112.192 any $HOME_NET any (msg:"cash4members.com"; classtype:trojan-activity; priority:1;) alert tcp 31.222.181.117 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;) alert tcp 31.24.80.120 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 32.107.37.11 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 32.107.45.11 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 32.107.56.11 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 37.157.6.226 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;) alert tcp 37.157.6.227 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;) alert tcp 37.17.224.8 any $HOME_NET any (msg:"top-casting-termine.de"; classtype:trojan-activity; priority:1;) alert tcp 37.221.192.47 any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.1 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.104 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.106 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.11 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.128 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.132 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.162 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.163 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.168 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.206 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.212 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.3 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.46 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.49 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.5 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.56 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.60 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.70 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.71 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.86 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.88 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.89 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.9 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.252.162.97 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 37.59.49.39 any $HOME_NET any (msg:"popub.com"; classtype:trojan-activity; priority:1;) alert tcp 38.100.208.18 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 38.100.208.8 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 38.101.169.38 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 38.102.137.128 any $HOME_NET any (msg:"as5000.com"; classtype:trojan-activity; priority:1;) alert tcp 38.102.228.27 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;) alert tcp 38.102.228.56 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;) alert tcp 38.106.67.11 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;) alert tcp 38.106.67.7 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;) alert tcp 38.107.128.88 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 38.107.129.2 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 38.107.129.3 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 38.108.74.201 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;) alert tcp 38.108.74.238 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;) alert tcp 38.114.159.35 any $HOME_NET any (msg:"ads.financialcontent.com"; classtype:trojan-activity; priority:1;) alert tcp 38.114.159.36 any $HOME_NET any (msg:"ads.financialcontent.com"; classtype:trojan-activity; priority:1;) alert tcp 38.114.159.37 any $HOME_NET any (msg:"ads.financialcontent.com"; classtype:trojan-activity; priority:1;) alert tcp 38.114.16.250 any $HOME_NET any (msg:"ad.choiceradio.com"; classtype:trojan-activity; priority:1;) alert tcp 38.117.74.204 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 38.117.74.205 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 38.117.90.29 any $HOME_NET any (msg:"reduxmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 38.118.144.180 any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;) alert tcp 38.118.147.41 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;) alert tcp 38.118.195.117 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 38.118.199.152 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 38.118.69.130 any $HOME_NET any (msg:"ad.choiceradio.com"; classtype:trojan-activity; priority:1;) alert tcp 38.118.85.23 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 38.119.130.60 any $HOME_NET any (msg:"ads.newgrounds.com"; classtype:trojan-activity; priority:1;) alert tcp 38.126.9.134 any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 38.73.66.104 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;) alert tcp 38.91.109.5 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 38.91.110.74 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 38.97.225.135 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 38.99.105.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 38.99.105.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 38.99.105.55 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 38.99.115.242 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;) alert tcp 38.99.133.20 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 38.99.186.205 any $HOME_NET any (msg:"yesadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 4.23.43.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 4.23.43.254 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 4.23.49.126 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 4.23.50.252 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 4.23.53.254 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.226.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.227.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 4.26.227.253 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.228.254 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 4.26.229.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.230.125 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.231.254 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 4.26.232.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.232.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.232.254 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 4.26.233.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.233.254 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.234.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 4.26.235.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.236.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.236.253 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.237.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.242.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 4.26.244.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.102 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.103 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.104 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.105 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.106 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.107 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.108 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.109 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.110 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.111 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.112 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.113 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.114 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.115 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.71.22.116 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;) alert tcp 4.78.20.11 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 4.78.243.21 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 4.78.243.22 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 4.78.243.26 any $HOME_NET any (msg:"quantcast.com"; classtype:trojan-activity; priority:1;) alert tcp 4.78.243.32 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 4.78.243.33 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 4.78.243.34 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 42.120.219.6 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.120.59.19 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.120.59.20 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.120.59.21 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.120.59.22 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.120.59.24 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.120.59.26 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.121.103.168 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.121.103.235 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 42.156.140.11 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.101.198 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.101.49 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.101.95 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.105.115 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.105.185 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.107.225 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.117.148 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.117.151 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.122.100 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.125.51 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.156.168 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.156.219 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.191.37 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.219.168 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.222.11 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.253.156 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.6.200 any $HOME_NET any (msg:"casinopays.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.72.151 any $HOME_NET any (msg:"casinopays.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.72.85 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.73.49 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.78.16 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.78.84 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.79.230 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.83.15 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.84.205 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.87.207 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.88.167 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.91.187 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.93.113 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.95.113 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.96.197 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.96.57 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.137.99.147 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.149.113.131 any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 46.149.113.145 any $HOME_NET any (msg:"add.newmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 46.182.85.54 any $HOME_NET any (msg:"hit.ua"; classtype:trojan-activity; priority:1;) alert tcp 46.188.23.8 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;) alert tcp 46.20.32.41 any $HOME_NET any (msg:"yieldlab.net"; classtype:trojan-activity; priority:1;) alert tcp 46.22.70.12 any $HOME_NET any (msg:"payserve.com"; classtype:trojan-activity; priority:1;) alert tcp 46.22.70.50 any $HOME_NET any (msg:"banners.clubseventeen.com"; classtype:trojan-activity; priority:1;) alert tcp 46.22.70.90 any $HOME_NET any (msg:"banners.clubseventeen.com"; classtype:trojan-activity; priority:1;) alert tcp 46.236.13.145 any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;) alert tcp 46.248.162.115 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 46.252.178.23 any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;) alert tcp 46.252.178.29 any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;) alert tcp 46.252.178.30 any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;) alert tcp 46.255.224.67 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;) alert tcp 46.255.225.114 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;) alert tcp 46.28.107.134 any $HOME_NET any (msg:"imprese.cz"; classtype:trojan-activity; priority:1;) alert tcp 46.38.178.127 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;) alert tcp 46.38.226.12 any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;) alert tcp 46.4.100.213 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 46.4.132.207 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 46.4.212.152 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;) alert tcp 46.4.212.29 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;) alert tcp 46.4.4.5 any $HOME_NET any (msg:"adcell.de"; classtype:trojan-activity; priority:1;) alert tcp 46.4.44.157 any $HOME_NET any (msg:"hits.europuls.eu"; classtype:trojan-activity; priority:1;) alert tcp 46.4.77.42 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 46.4.80.238 any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;) alert tcp 46.4.86.222 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 46.51.168.31 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.51.170.198 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.51.171.64 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.51.174.228 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.51.175.57 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.51.177.155 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.51.179.59 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.51.181.243 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 46.51.184.149 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 5.100.225.198 any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;) alert tcp 5.35.248.18 any $HOME_NET any (msg:"express-submit.de"; classtype:trojan-activity; priority:1;) alert tcp 5.63.148.140 any $HOME_NET any (msg:"zeusclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 5.79.39.140 any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;) alert tcp 5.79.58.175 any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;) alert tcp 5.9.138.168 any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;) alert tcp 5.9.42.218 any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 5.9.90.81 any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;) alert tcp 5.9.90.85 any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;) alert tcp 5.9.97.114 any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;) alert tcp 50.116.49.145 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 50.116.53.176 any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;) alert tcp 50.116.6.162 any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;) alert tcp 50.116.73.22 any $HOME_NET any (msg:"adtology.com"; classtype:trojan-activity; priority:1;) alert tcp 50.135.6.184 any $HOME_NET any (msg:"ads.cheapflights.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.125.86 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 50.16.187.45 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.196.189 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.197.64 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.203.102 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.210.6 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.211.251 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.220.203 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.222.156 any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.222.246 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.226.43 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.242.194 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.242.223 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.242.86 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.245.26 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.39.84 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;) alert tcp 50.16.67.67 any $HOME_NET any (msg:"krxd.net"; classtype:trojan-activity; priority:1;) alert tcp 50.17.168.26 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.183.23 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.184.173 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.199.173 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.199.228 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.200.93 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 50.17.204.139 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.214.103 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.214.118 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.215.47 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.218.235 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.218.42 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.221.240 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.221.248 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.224.79 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.226.222 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.235.66 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.237.150 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.246.206 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 50.17.251.180 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 50.18.106.4 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 50.18.120.116 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;) alert tcp 50.18.120.45 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;) alert tcp 50.18.125.132 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;) alert tcp 50.18.50.209 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 50.18.53.253 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.102.80 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.104.123 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.2.70 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.209.45 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.210.143 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.210.205 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.211.89 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.229.39 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.234.112 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.244.1 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.247.24 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.250.227 any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.43.39 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;) alert tcp 50.19.84.135 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 50.22.192.15 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;) alert tcp 50.22.200.242 any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;) alert tcp 50.22.200.243 any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;) alert tcp 50.22.224.67 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;) alert tcp 50.22.230.132 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;) alert tcp 50.22.55.114 any $HOME_NET any (msg:"adreactor.com"; classtype:trojan-activity; priority:1;) alert tcp 50.23.151.122 any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;) alert tcp 50.23.200.230 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;) alert tcp 50.23.200.238 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;) alert tcp 50.23.235.6 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;) alert tcp 50.23.249.68 any $HOME_NET any (msg:"ads.uncrate.com"; classtype:trojan-activity; priority:1;) alert tcp 50.23.28.130 any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;) alert tcp 50.23.72.4 any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;) alert tcp 50.28.35.167 any $HOME_NET any (msg:"dealdotcom.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.111.173 any $HOME_NET any (msg:"at-adserver.alltop.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.122.129 any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.166.184 any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.183.225 any $HOME_NET any (msg:"theadhost.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.2.223 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.212.61 any $HOME_NET any (msg:"ads.gplusmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.233.134 any $HOME_NET any (msg:"rubiconproject.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.244.236 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.48.64 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.49.130 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.56.56.8 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 50.57.201.228 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;) alert tcp 50.57.27.26 any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;) alert tcp 50.57.31.71 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;) alert tcp 50.57.97.175 any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.10.222 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.197.206 any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.127 any $HOME_NET any (msg:"images-pw.secureserver.net"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.3 any $HOME_NET any (msg:"adserverplus.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.38 any $HOME_NET any (msg:"7bpeople.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.39 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.4 any $HOME_NET any (msg:"percentmobile.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.40 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.51 any $HOME_NET any (msg:"realcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.72 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.80 any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.82 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.87 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.202.89 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 50.63.72.1 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 50.77.15.165 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;) alert tcp 50.97.139.218 any $HOME_NET any (msg:"liverail.com"; classtype:trojan-activity; priority:1;) alert tcp 50.97.247.210 any $HOME_NET any (msg:"top-site-list.com"; classtype:trojan-activity; priority:1;) alert tcp 50.97.37.201 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;) alert tcp 50.97.37.203 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;) alert tcp 54.194.131.241 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;) alert tcp 54.204.26.237 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 54.208.99.166 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;) alert tcp 54.213.145.14 any $HOME_NET any (msg:"hitslink.com"; classtype:trojan-activity; priority:1;) alert tcp 54.213.189.1 any $HOME_NET any (msg:"pheedo.com"; classtype:trojan-activity; priority:1;) alert tcp 54.215.185.33 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;) alert tcp 54.217.216.165 any $HOME_NET any (msg:"partnercash.de"; classtype:trojan-activity; priority:1;) alert tcp 54.217.241.197 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.217.241.239 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.217.241.255 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.217.242.2 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.224.152.221 any $HOME_NET any (msg:"lucidmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 54.225.136.74 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 54.225.159.253 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 54.225.169.193 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 54.225.200.71 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 54.225.204.38 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 54.225.209.204 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;) alert tcp 54.225.239.173 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;) alert tcp 54.225.243.191 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 54.228.202.78 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 54.228.211.193 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.228.211.198 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.228.234.222 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;) alert tcp 54.229.22.95 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;) alert tcp 54.230.1.246 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.102 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.114 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.115 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.125 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.127 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.13 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.132 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.137 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.140 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.141 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.144 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.156 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.161 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.165 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.183 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.196 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.199 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.20 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.204 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.211 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.216 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.220 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.232 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.245 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.249 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.250 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.3 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.35 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.41 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.46 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.48 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.5 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.51 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.54 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.56 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.57 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.6 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.63 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.64 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.68 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.69 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.75 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.80 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.83 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.86 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.10.93 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.106 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.109 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.121 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.123 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.128 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.13 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.136 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.137 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.148 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.159 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.16 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.168 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.17 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.175 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.177 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.190 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.193 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.197 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.21 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.210 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.215 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.222 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.225 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.226 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.236 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.24 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.25 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.250 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.31 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.37 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.42 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.56 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.57 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.61 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.65 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.71 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.76 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.11.77 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.2.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.2.53 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.3.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.3.240 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.3.241 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.3.5 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.3.86 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.101 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.103 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.104 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.106 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.109 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.111 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.114 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.123 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.124 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.125 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.126 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.127 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.130 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.131 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.134 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.135 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.138 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.139 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.140 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.142 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.149 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.151 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.153 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.16 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.166 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.167 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.171 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.173 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.178 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.181 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.192 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.197 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.2 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.201 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.202 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.206 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.207 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.213 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.217 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.227 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.238 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.24 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.240 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.244 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.253 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.254 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.28 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.36 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.52 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.61 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.64 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.66 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.68 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.8 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.88 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.90 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.95 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.8.99 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.108 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.11 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.113 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.120 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.121 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.124 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.142 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.148 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.161 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.168 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.177 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.183 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.187 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.19 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.194 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.196 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.200 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.209 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.21 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.210 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.216 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.231 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.234 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.238 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.32 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.49 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.51 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.58 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.63 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.66 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.7 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.8 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.83 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.89 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.9 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.230.9.94 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.235.145.185 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.235.187.238 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 54.235.198.123 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.235.88.170 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 54.238.184.140 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 54.238.248.55 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.103 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.107 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.11 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.111 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.115 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.123 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.127 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.131 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.135 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.139 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.15 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.151 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.155 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.159 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.163 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.183 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.187 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.19 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.195 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.207 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.211 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.219 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.223 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.227 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.231 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.235 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.239 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.247 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.25 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.251 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.3 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.35 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.39 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.43 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.59 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.7 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.71 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.75 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.79 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.83 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.91 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.95 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.240.166.99 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 54.242.14.80 any $HOME_NET any (msg:"adzerk.net"; classtype:trojan-activity; priority:1;) alert tcp 54.243.105.88 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.106.253 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.107.53 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.116.121 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.126.7 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.128.92 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.138.158 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.145.78 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.150.2 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.150.40 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.151.220 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.175.52 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.185.58 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;) alert tcp 54.243.192.207 any $HOME_NET any (msg:"adminder.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.206.51 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.230.67 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.252.123 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 54.243.252.249 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.255.164 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.49.231 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;) alert tcp 54.243.58.183 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.58.194 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.75.78 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.81.191 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.86.240 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.90.185 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.92.121 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.243.99.220 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 54.246.105.116 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.246.105.136 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.246.113.255 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 54.246.82.130 any $HOME_NET any (msg:"ad.wavu.hu"; classtype:trojan-activity; priority:1;) alert tcp 54.247.171.12 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.171.42 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.171.52 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.186.197 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.186.212 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.186.217 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.186.236 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.186.40 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.187.243 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.187.69 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.187.70 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.188.6 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.82.36 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.82.49 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.247.82.52 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 54.249.100.171 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 54.249.93.126 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 54.251.127.128 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;) alert tcp 59.106.65.72 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 59.106.92.168 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;) alert tcp 60.12.231.36 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 61.129.52.198 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;) alert tcp 61.135.162.26 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;) alert tcp 61.135.163.221 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;) alert tcp 61.139.126.56 any $HOME_NET any (msg:"count.west263.com"; classtype:trojan-activity; priority:1;) alert tcp 61.155.199.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 61.155.199.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;) alert tcp 61.187.235.110 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;) alert tcp 61.213.12.16 any $HOME_NET any (msg:"x6.yakiuchi.com"; classtype:trojan-activity; priority:1;) alert tcp 61.213.167.185 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 62.1.1.114 any $HOME_NET any (msg:"bannergrabber.internet.gr"; classtype:trojan-activity; priority:1;) alert tcp 62.1.43.178 any $HOME_NET any (msg:"interactive.forthnet.gr"; classtype:trojan-activity; priority:1;) alert tcp 62.1.43.180 any $HOME_NET any (msg:"interactive.forthnet.gr"; classtype:trojan-activity; priority:1;) alert tcp 62.101.68.209 any $HOME_NET any (msg:"ilbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 62.103.124.14 any $HOME_NET any (msg:"adman.gr"; classtype:trojan-activity; priority:1;) alert tcp 62.103.124.7 any $HOME_NET any (msg:"adman.gr"; classtype:trojan-activity; priority:1;) alert tcp 62.109.129.29 any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;) alert tcp 62.113.203.2 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;) alert tcp 62.113.203.242 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;) alert tcp 62.113.203.66 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.130.8 any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.10 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.12 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.13 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.15 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.16 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.17 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.18 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.19 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.143.21 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.116.181.27 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;) alert tcp 62.118.240.27 any $HOME_NET any (msg:"supertop.ru"; classtype:trojan-activity; priority:1;) alert tcp 62.118.240.36 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 62.118.248.72 any $HOME_NET any (msg:"supertop.ru"; classtype:trojan-activity; priority:1;) alert tcp 62.118.249.30 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 62.118.249.35 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 62.121.6.136 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 62.121.6.137 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 62.121.6.138 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 62.128.39.101 any $HOME_NET any (msg:"adonspot.com"; classtype:trojan-activity; priority:1;) alert tcp 62.129.129.17 any $HOME_NET any (msg:"payserve.com"; classtype:trojan-activity; priority:1;) alert tcp 62.129.129.27 any $HOME_NET any (msg:"payserve.com"; classtype:trojan-activity; priority:1;) alert tcp 62.129.129.41 any $HOME_NET any (msg:"banners.clubseventeen.com"; classtype:trojan-activity; priority:1;) alert tcp 62.129.141.3 any $HOME_NET any (msg:"totemcash.com"; classtype:trojan-activity; priority:1;) alert tcp 62.129.243.50 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;) alert tcp 62.133.211.163 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;) alert tcp 62.138.114.35 any $HOME_NET any (msg:"adscale.de"; classtype:trojan-activity; priority:1;) alert tcp 62.140.213.218 any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;) alert tcp 62.140.213.243 any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;) alert tcp 62.141.44.24 any $HOME_NET any (msg:"adbroker.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.112.122 any $HOME_NET any (msg:"rankingscout.com"; classtype:trojan-activity; priority:1;) alert tcp 62.146.124.101 any $HOME_NET any (msg:"adpepper.dk"; classtype:trojan-activity; priority:1;) alert tcp 62.146.13.247 any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.13.253 any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.14.6 any $HOME_NET any (msg:"adserver01.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.141.29 any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;) alert tcp 62.146.198.130 any $HOME_NET any (msg:"adserver01.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.198.133 any $HOME_NET any (msg:"adserver01.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.219.156 any $HOME_NET any (msg:"ranking-charts.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.223.8 any $HOME_NET any (msg:"advertmedia.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.24.132 any $HOME_NET any (msg:"interreklame.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.24.133 any $HOME_NET any (msg:"ad.interreklame.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.24.134 any $HOME_NET any (msg:"interreklame.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.31.200 any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;) alert tcp 62.146.88.103 any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;) alert tcp 62.146.88.105 any $HOME_NET any (msg:"ilead.itrack.it"; classtype:trojan-activity; priority:1;) alert tcp 62.146.88.110 any $HOME_NET any (msg:"static.itrack.it"; classtype:trojan-activity; priority:1;) alert tcp 62.146.88.111 any $HOME_NET any (msg:"static.itrack.it"; classtype:trojan-activity; priority:1;) alert tcp 62.146.88.122 any $HOME_NET any (msg:"m1.webstats4u.com"; classtype:trojan-activity; priority:1;) alert tcp 62.146.88.88 any $HOME_NET any (msg:"ads.krawall.de"; classtype:trojan-activity; priority:1;) alert tcp 62.146.91.26 any $HOME_NET any (msg:"superclix.de"; classtype:trojan-activity; priority:1;) alert tcp 62.149.0.215 any $HOME_NET any (msg:"mycounter.ua"; classtype:trojan-activity; priority:1;) alert tcp 62.149.128.40 any $HOME_NET any (msg:"scambiobanner.aruba.it"; classtype:trojan-activity; priority:1;) alert tcp 62.149.13.65 any $HOME_NET any (msg:"top.proext.com"; classtype:trojan-activity; priority:1;) alert tcp 62.149.198.69 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;) alert tcp 62.149.26.52 any $HOME_NET any (msg:"top.proext.com"; classtype:trojan-activity; priority:1;) alert tcp 62.151.2.150 any $HOME_NET any (msg:"advertpro.ya.com"; classtype:trojan-activity; priority:1;) alert tcp 62.161.94.10 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 62.161.94.11 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 62.161.94.117 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 62.168.116.101 any $HOME_NET any (msg:"mas.sector.sk"; classtype:trojan-activity; priority:1;) alert tcp 62.168.62.4 any $HOME_NET any (msg:"webcounter.cz"; classtype:trojan-activity; priority:1;) alert tcp 62.169.0.50 any $HOME_NET any (msg:"zanox.com"; classtype:trojan-activity; priority:1;) alert tcp 62.190.153.21 any $HOME_NET any (msg:"ads.contactmusic.com"; classtype:trojan-activity; priority:1;) alert tcp 62.190.8.171 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;) alert tcp 62.201.170.65 any $HOME_NET any (msg:"hit.webcentre.lycos.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.205.10.76 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;) alert tcp 62.209.196.111 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 62.209.220.7 any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 62.210.148.2 any $HOME_NET any (msg:"gold.weborama.fr"; classtype:trojan-activity; priority:1;) alert tcp 62.210.175.4 any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 62.212.74.30 any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;) alert tcp 62.212.84.35 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 62.212.84.50 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 62.212.84.73 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 62.213.240.131 any $HOME_NET any (msg:"belstat.nl"; classtype:trojan-activity; priority:1;) alert tcp 62.214.98.26 any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;) alert tcp 62.216.237.122 any $HOME_NET any (msg:"affiliatewindow.com"; classtype:trojan-activity; priority:1;) alert tcp 62.216.237.124 any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;) alert tcp 62.216.239.139 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;) alert tcp 62.219.199.210 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;) alert tcp 62.219.199.213 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;) alert tcp 62.219.199.215 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;) alert tcp 62.219.199.218 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;) alert tcp 62.219.199.219 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;) alert tcp 62.219.78.105 any $HOME_NET any (msg:"all4spy.com"; classtype:trojan-activity; priority:1;) alert tcp 62.219.78.118 any $HOME_NET any (msg:"all4spy.com"; classtype:trojan-activity; priority:1;) alert tcp 62.23.10.253 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 62.23.26.150 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 62.23.30.168 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 62.233.114.106 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.233.114.107 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.233.114.109 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.233.114.110 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.233.114.118 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.233.114.121 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.233.114.165 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.233.114.166 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.233.121.4 any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;) alert tcp 62.24.64.42 any $HOME_NET any (msg:"ads.nyx.cz"; classtype:trojan-activity; priority:1;) alert tcp 62.241.34.234 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;) alert tcp 62.241.34.236 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;) alert tcp 62.243.72.6 any $HOME_NET any (msg:"ads.dk"; classtype:trojan-activity; priority:1;) alert tcp 62.245.139.30 any $HOME_NET any (msg:"quisma.com"; classtype:trojan-activity; priority:1;) alert tcp 62.26.68.51 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 62.32.97.9 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 62.39.11.20 any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;) alert tcp 62.39.11.50 any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;) alert tcp 62.4.66.20 any $HOME_NET any (msg:"popularix.com"; classtype:trojan-activity; priority:1;) alert tcp 62.4.66.222 any $HOME_NET any (msg:"popularix.com"; classtype:trojan-activity; priority:1;) alert tcp 62.4.85.251 any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;) alert tcp 62.40.85.155 any $HOME_NET any (msg:"itop.cz"; classtype:trojan-activity; priority:1;) alert tcp 62.41.85.40 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 62.41.85.80 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 62.41.85.81 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 62.41.85.82 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 62.44.69.219 any $HOME_NET any (msg:"stats.mirrorfootball.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 62.50.134.100 any $HOME_NET any (msg:"oxado.com"; classtype:trojan-activity; priority:1;) alert tcp 62.50.134.105 any $HOME_NET any (msg:"oxado.com"; classtype:trojan-activity; priority:1;) alert tcp 62.50.134.106 any $HOME_NET any (msg:"oxado.com"; classtype:trojan-activity; priority:1;) alert tcp 62.61.159.24 any $HOME_NET any (msg:"flexbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 62.61.159.73 any $HOME_NET any (msg:"flexbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 62.65.11.160 any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;) alert tcp 62.67.200.221 any $HOME_NET any (msg:"ad.domainfactory.de"; classtype:trojan-activity; priority:1;) alert tcp 62.70.15.11 any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.131 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.132 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.133 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.134 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.135 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.136 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.137 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.138 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.139 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.140 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.141 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.142 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.143 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.144 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.145 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.146 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.148 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.149 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.184.150 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 62.73.185.77 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 62.75.140.4 any $HOME_NET any (msg:"adbroker.de"; classtype:trojan-activity; priority:1;) alert tcp 62.75.181.40 any $HOME_NET any (msg:"adbroker.de"; classtype:trojan-activity; priority:1;) alert tcp 62.75.193.32 any $HOME_NET any (msg:"auto-bannertausch.de"; classtype:trojan-activity; priority:1;) alert tcp 62.75.216.20 any $HOME_NET any (msg:"layer-ad.de"; classtype:trojan-activity; priority:1;) alert tcp 62.75.216.68 any $HOME_NET any (msg:"surfmusik-adserver.de"; classtype:trojan-activity; priority:1;) alert tcp 62.75.222.99 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;) alert tcp 62.75.224.150 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 62.78.223.176 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 62.78.223.178 any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 62.80.178.140 any $HOME_NET any (msg:"hit.ua"; classtype:trojan-activity; priority:1;) alert tcp 62.80.2.70 any $HOME_NET any (msg:"sedotracker.com"; classtype:trojan-activity; priority:1;) alert tcp 62.84.129.156 any $HOME_NET any (msg:"ad.lupa.cz"; classtype:trojan-activity; priority:1;) alert tcp 62.84.131.44 any $HOME_NET any (msg:"banner.inyourpocket.com"; classtype:trojan-activity; priority:1;) alert tcp 62.84.209.151 any $HOME_NET any (msg:"au.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 62.94.110.143 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;) alert tcp 63.105.72.34 any $HOME_NET any (msg:"galaxien.com"; classtype:trojan-activity; priority:1;) alert tcp 63.108.181.204 any $HOME_NET any (msg:"ads.antionline.com"; classtype:trojan-activity; priority:1;) alert tcp 63.111.24.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 63.111.24.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 63.111.24.75 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 63.111.69.12 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 63.111.69.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 63.111.69.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 63.111.74.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 63.111.74.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 63.116.135.245 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;) alert tcp 63.117.23.30 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;) alert tcp 63.117.23.90 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;) alert tcp 63.119.44.197 any $HOME_NET any (msg:"seeq.com"; classtype:trojan-activity; priority:1;) alert tcp 63.121.29.55 any $HOME_NET any (msg:"adserver.monster.com"; classtype:trojan-activity; priority:1;) alert tcp 63.123.248.11 any $HOME_NET any (msg:"click.linksynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 63.123.248.7 any $HOME_NET any (msg:"ad.linksynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 63.123.248.8 any $HOME_NET any (msg:"ad.linksynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 63.135.80.61 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 63.138.120.113 any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;) alert tcp 63.141.223.2 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 63.144.24.164 any $HOME_NET any (msg:"microticker.com"; classtype:trojan-activity; priority:1;) alert tcp 63.146.120.73 any $HOME_NET any (msg:"ad.musicmatch.com"; classtype:trojan-activity; priority:1;) alert tcp 63.149.176.12 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 63.156.206.202 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;) alert tcp 63.163.102.100 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 63.163.102.203 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 63.163.102.248 any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;) alert tcp 63.171.166.66 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;) alert tcp 63.171.166.75 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;) alert tcp 63.208.196.110 any $HOME_NET any (msg:"gigya.com"; classtype:trojan-activity; priority:1;) alert tcp 63.208.235.31 any $HOME_NET any (msg:"ads.addynamix.com"; classtype:trojan-activity; priority:1;) alert tcp 63.208.235.8 any $HOME_NET any (msg:"pennyweb.com"; classtype:trojan-activity; priority:1;) alert tcp 63.209.24.195 any $HOME_NET any (msg:"ad.bondage.com"; classtype:trojan-activity; priority:1;) alert tcp 63.209.69.119 any $HOME_NET any (msg:"advertise.com"; classtype:trojan-activity; priority:1;) alert tcp 63.211.238.133 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 63.214.164.86 any $HOME_NET any (msg:"newnudecash.com"; classtype:trojan-activity; priority:1;) alert tcp 63.214.247.170 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;) alert tcp 63.214.247.180 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;) alert tcp 63.215.143.207 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;) alert tcp 63.215.202.146 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;) alert tcp 63.215.202.147 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;) alert tcp 63.215.202.73 any $HOME_NET any (msg:"commission-junction.com"; classtype:trojan-activity; priority:1;) alert tcp 63.215.202.74 any $HOME_NET any (msg:"tkqlhce.com"; classtype:trojan-activity; priority:1;) alert tcp 63.215.202.9 any $HOME_NET any (msg:"fastclick.com"; classtype:trojan-activity; priority:1;) alert tcp 63.215.75.48 any $HOME_NET any (msg:"ads7.gamecity.net"; classtype:trojan-activity; priority:1;) alert tcp 63.215.75.51 any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;) alert tcp 63.218.129.146 any $HOME_NET any (msg:"protraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 63.218.13.196 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 63.218.65.10 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 63.219.151.20 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 63.219.179.142 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 63.231.252.74 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 63.236.14.11 any $HOME_NET any (msg:"ad.musicmatch.com"; classtype:trojan-activity; priority:1;) alert tcp 63.236.72.243 any $HOME_NET any (msg:"thecounter.com"; classtype:trojan-activity; priority:1;) alert tcp 63.236.73.247 any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;) alert tcp 63.240.110.130 any $HOME_NET any (msg:"pepperjamnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 63.240.133.55 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 63.240.133.77 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;) alert tcp 63.240.137.107 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 63.240.173.34 any $HOME_NET any (msg:"a.mktw.net"; classtype:trojan-activity; priority:1;) alert tcp 63.240.26.34 any $HOME_NET any (msg:"a.mktw.net"; classtype:trojan-activity; priority:1;) alert tcp 63.240.4.10 any $HOME_NET any (msg:"ads.forbes.net"; classtype:trojan-activity; priority:1;) alert tcp 63.240.54.138 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 63.240.86.114 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;) alert tcp 63.240.86.143 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;) alert tcp 63.240.86.20 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;) alert tcp 63.241.10.45 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 63.241.205.207 any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;) alert tcp 63.241.243.28 any $HOME_NET any (msg:"affiliate.travelnow.com"; classtype:trojan-activity; priority:1;) alert tcp 63.241.7.24 any $HOME_NET any (msg:"therapistla.com"; classtype:trojan-activity; priority:1;) alert tcp 63.243.188.108 any $HOME_NET any (msg:"cashengines.com"; classtype:trojan-activity; priority:1;) alert tcp 63.249.223.127 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.133.40 any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.163.109 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.163.112 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.171.80 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.171.81 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.183.201 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.183.212 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.211.131 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.211.148 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.211.70 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.216.9 any $HOME_NET any (msg:"ads.powweb.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.23.20 any $HOME_NET any (msg:"insightexpress.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.249.49 any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;) alert tcp 63.251.51.247 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.57.198 any $HOME_NET any (msg:"ad.bondage.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.83.53 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 63.251.92.195 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 63.68.54.90 any $HOME_NET any (msg:"precisionclick.com"; classtype:trojan-activity; priority:1;) alert tcp 63.68.55.124 any $HOME_NET any (msg:"precisionclick.com"; classtype:trojan-activity; priority:1;) alert tcp 63.68.55.221 any $HOME_NET any (msg:"precisionclick.com"; classtype:trojan-activity; priority:1;) alert tcp 63.74.35.22 any $HOME_NET any (msg:"ads.scifi.com"; classtype:trojan-activity; priority:1;) alert tcp 63.77.84.10 any $HOME_NET any (msg:"secure.webconnect.net"; classtype:trojan-activity; priority:1;) alert tcp 63.87.171.167 any $HOME_NET any (msg:"adserver.nydailynews.com"; classtype:trojan-activity; priority:1;) alert tcp 63.87.171.184 any $HOME_NET any (msg:"adserver.nydailynews.com"; classtype:trojan-activity; priority:1;) alert tcp 63.88.212.82 any $HOME_NET any (msg:"statse.webtrendslive.com"; classtype:trojan-activity; priority:1;) alert tcp 63.88.212.91 any $HOME_NET any (msg:"wtlive.com"; classtype:trojan-activity; priority:1;) alert tcp 63.99.210.223 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 64.0.50.75 any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;) alert tcp 64.106.133.31 any $HOME_NET any (msg:"banners.sys-con.com"; classtype:trojan-activity; priority:1;) alert tcp 64.106.154.189 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 64.106.190.145 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;) alert tcp 64.106.190.146 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;) alert tcp 64.106.198.75 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;) alert tcp 64.106.207.143 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 64.111.123.92 any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.111.199.221 any $HOME_NET any (msg:"exoclick.com"; classtype:trojan-activity; priority:1;) alert tcp 64.111.199.222 any $HOME_NET any (msg:"exoclick.com"; classtype:trojan-activity; priority:1;) alert tcp 64.111.214.2 any $HOME_NET any (msg:"trafficholder.com"; classtype:trojan-activity; priority:1;) alert tcp 64.111.217.178 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 64.119.182.121 any $HOME_NET any (msg:"adserver.sciflicks.com"; classtype:trojan-activity; priority:1;) alert tcp 64.119.182.90 any $HOME_NET any (msg:"adserver.sciflicks.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.174.121 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.174.153 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.174.185 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.174.249 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.174.57 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.184.121 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.184.25 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.184.57 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.184.89 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.46.10 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.46.11 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.46.23 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;) alert tcp 64.12.46.24 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;) alert tcp 64.124.109.203 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 64.124.125.2 any $HOME_NET any (msg:"bannerspace.com"; classtype:trojan-activity; priority:1;) alert tcp 64.124.130.139 any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;) alert tcp 64.124.194.24 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 64.124.65.24 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;) alert tcp 64.124.65.44 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;) alert tcp 64.124.65.47 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;) alert tcp 64.125.250.252 any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;) alert tcp 64.125.250.26 any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;) alert tcp 64.127.109.133 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;) alert tcp 64.127.126.24 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;) alert tcp 64.128.87.130 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 64.128.87.137 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 64.128.87.144 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 64.128.87.145 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 64.13.249.148 any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;) alert tcp 64.130.13.57 any $HOME_NET any (msg:"scanscout.com"; classtype:trojan-activity; priority:1;) alert tcp 64.131.69.251 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.131.69.252 any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.131.69.253 any $HOME_NET any (msg:"bullseye.backbeatmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.131.74.171 any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;) alert tcp 64.131.84.198 any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.20.37 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.20.58 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.20.60 any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.21.199 any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.24.162 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.24.185 any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.25.165 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.25.171 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.25.172 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.25.180 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.25.191 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.29.191 any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.45.45 any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;) alert tcp 64.136.53.45 any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.122.251 any $HOME_NET any (msg:"ads.bluemountain.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.173.202 any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.42.111 any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.42.201 any $HOME_NET any (msg:"click.avenuea.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.44.124 any $HOME_NET any (msg:"www.targetshop.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.56.11 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.56.13 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.81.141 any $HOME_NET any (msg:"s0b.bluestreak.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.86.82 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.86.87 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.86.88 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.14.87.35 any $HOME_NET any (msg:"chitika.net"; classtype:trojan-activity; priority:1;) alert tcp 64.141.2.216 any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;) alert tcp 64.141.3.40 any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.66.163 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.94.18 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.94.19 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.94.201 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.94.203 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.94.204 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.94.205 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.94.206 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 64.145.94.207 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 64.146.132.15 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 64.146.132.19 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 64.146.132.20 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 64.146.132.25 any $HOME_NET any (msg:"ads.exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 64.146.132.45 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 64.146.132.46 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 64.146.132.47 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.103 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.132 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.139 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.145 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.155 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.180 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.182 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.183 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.202 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.231 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.232 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.233 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.235 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.236 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.240 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.241 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.205.97 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.229.66 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.251.199 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 64.15.251.216 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 64.151.102.165 any $HOME_NET any (msg:"trackalyzer.com"; classtype:trojan-activity; priority:1;) alert tcp 64.151.102.68 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 64.151.119.129 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 64.151.74.209 any $HOME_NET any (msg:"aim4media.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.128.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.35.231 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.59.132 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.59.162 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.59.163 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.145 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.150 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.177 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.182 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.183 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.209 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.214 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.241 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 64.152.73.246 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;) alert tcp 64.154.80.72 any $HOME_NET any (msg:"hitbox.com"; classtype:trojan-activity; priority:1;) alert tcp 64.154.86.13 any $HOME_NET any (msg:"hitbox.com"; classtype:trojan-activity; priority:1;) alert tcp 64.156.11.200 any $HOME_NET any (msg:"pheedo.com"; classtype:trojan-activity; priority:1;) alert tcp 64.156.13.20 any $HOME_NET any (msg:"pgpartner.com"; classtype:trojan-activity; priority:1;) alert tcp 64.156.13.50 any $HOME_NET any (msg:"pgpartner.com"; classtype:trojan-activity; priority:1;) alert tcp 64.156.167.84 any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.156.167.85 any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;) alert tcp 64.156.167.86 any $HOME_NET any (msg:"valueclickmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.156.240.38 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 64.156.26.74 any $HOME_NET any (msg:"adultadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 64.157.165.145 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 64.157.165.150 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.157.165.177 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 64.157.165.182 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.157.165.209 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 64.157.165.214 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.157.165.241 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 64.157.165.246 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.159.68.71 any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;) alert tcp 64.159.93.205 any $HOME_NET any (msg:"oxcash.com"; classtype:trojan-activity; priority:1;) alert tcp 64.177.234.168 any $HOME_NET any (msg:"www.alladvantage.com"; classtype:trojan-activity; priority:1;) alert tcp 64.185.226.100 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;) alert tcp 64.185.226.101 any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;) alert tcp 64.185.237.17 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 64.187.43.14 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.187.43.31 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.187.43.36 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.188.53.21 any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;) alert tcp 64.188.59.165 any $HOME_NET any (msg:"blingbucks.com"; classtype:trojan-activity; priority:1;) alert tcp 64.191.218.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 64.191.218.26 any $HOME_NET any (msg:"a.windowsitpro.com"; classtype:trojan-activity; priority:1;) alert tcp 64.194.241.4 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.194.241.98 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.20.33.115 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 64.20.33.131 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 64.20.33.3 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;) alert tcp 64.20.33.4 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 64.20.43.107 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 64.20.49.210 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 64.20.60.106 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;) alert tcp 64.20.60.98 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 64.20.60.99 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;) alert tcp 64.20.62.35 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 64.202.167.128 any $HOME_NET any (msg:"images-pw.secureserver.net"; classtype:trojan-activity; priority:1;) alert tcp 64.202.167.192 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;) alert tcp 64.202.167.3 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.202.189.110 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;) alert tcp 64.202.189.170 any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;) alert tcp 64.208.178.22 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;) alert tcp 64.208.42.55 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 64.208.42.56 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 64.209.232.100 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 64.209.232.207 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;) alert tcp 64.209.232.248 any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;) alert tcp 64.21.150.123 any $HOME_NET any (msg:"www.photo-ads.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 64.21.174.250 any $HOME_NET any (msg:"crawlability.com"; classtype:trojan-activity; priority:1;) alert tcp 64.21.178.154 any $HOME_NET any (msg:"crazypopups.com"; classtype:trojan-activity; priority:1;) alert tcp 64.215.202.21 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 64.215.202.22 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 64.215.202.23 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 64.22.121.100 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;) alert tcp 64.225.154.175 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.161.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.161.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.161.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.161.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.165.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.165.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.165.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.167.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.167.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.167.99 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.169.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.169.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.169.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.169.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.169.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.169.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.171.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.171.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.171.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.179.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.179.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.179.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.179.99 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.183.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.183.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.183.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.183.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.183.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 64.233.187.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 64.235.234.138 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 64.235.246.143 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 64.236.115.203 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;) alert tcp 64.236.124.138 any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;) alert tcp 64.236.124.21 any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;) alert tcp 64.236.88.203 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;) alert tcp 64.236.92.59 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;) alert tcp 64.236.92.67 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;) alert tcp 64.237.101.92 any $HOME_NET any (msg:"ads.raasnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.237.103.62 any $HOME_NET any (msg:"adjuggler.com"; classtype:trojan-activity; priority:1;) alert tcp 64.237.108.209 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;) alert tcp 64.237.99.81 any $HOME_NET any (msg:"adjuggler.com"; classtype:trojan-activity; priority:1;) alert tcp 64.239.183.120 any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;) alert tcp 64.239.249.140 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;) alert tcp 64.239.32.32 any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;) alert tcp 64.241.74.201 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;) alert tcp 64.243.175.108 any $HOME_NET any (msg:"as5000.com"; classtype:trojan-activity; priority:1;) alert tcp 64.243.175.128 any $HOME_NET any (msg:"as5000.com"; classtype:trojan-activity; priority:1;) alert tcp 64.244.29.120 any $HOME_NET any (msg:"ads.oneplace.com"; classtype:trojan-activity; priority:1;) alert tcp 64.246.24.68 any $HOME_NET any (msg:"publishers.adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 64.246.26.16 any $HOME_NET any (msg:"rampidads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.246.44.60 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;) alert tcp 64.246.46.107 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 64.251.19.50 any $HOME_NET any (msg:"ads.vgchartz.com"; classtype:trojan-activity; priority:1;) alert tcp 64.255.164.20 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;) alert tcp 64.255.172.197 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 64.255.172.50 any $HOME_NET any (msg:"cluster.adultworld.com"; classtype:trojan-activity; priority:1;) alert tcp 64.27.100.199 any $HOME_NET any (msg:"adblade.com"; classtype:trojan-activity; priority:1;) alert tcp 64.27.100.214 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;) alert tcp 64.27.17.227 any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;) alert tcp 64.27.90.240 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;) alert tcp 64.28.86.230 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 64.29.137.108 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 64.29.138.105 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 64.29.211.69 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;) alert tcp 64.29.223.153 any $HOME_NET any (msg:"affiliates.match.com"; classtype:trojan-activity; priority:1;) alert tcp 64.29.223.70 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;) alert tcp 64.29.29.36 any $HOME_NET any (msg:"top20free.com"; classtype:trojan-activity; priority:1;) alert tcp 64.30.224.111 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;) alert tcp 64.30.224.114 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;) alert tcp 64.30.224.117 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.103.228 any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.110.179 any $HOME_NET any (msg:"ads.pof.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.165.238 any $HOME_NET any (msg:"adv.cooperhosting.net"; classtype:trojan-activity; priority:1;) alert tcp 64.34.173.229 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.174.26 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.182.22 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.182.23 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.184.26 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.194.75 any $HOME_NET any (msg:"ad1.emule-project.org"; classtype:trojan-activity; priority:1;) alert tcp 64.34.33.202 any $HOME_NET any (msg:"servedbyadbutler.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.33.205 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.56.60 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.10 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.11 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.12 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.18 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.19 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.20 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.21 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.23 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.24 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.27 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.7 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.8 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.34.8.9 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 64.37.114.86 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 64.37.199.107 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 64.38.20.21 any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;) alert tcp 64.38.202.49 any $HOME_NET any (msg:"newnudecash.com"; classtype:trojan-activity; priority:1;) alert tcp 64.38.232.180 any $HOME_NET any (msg:"newt1.adultworld.com"; classtype:trojan-activity; priority:1;) alert tcp 64.38.29.126 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;) alert tcp 64.38.31.201 any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;) alert tcp 64.38.31.203 any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;) alert tcp 64.4.62.121 any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;) alert tcp 64.40.100.150 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;) alert tcp 64.40.101.40 any $HOME_NET any (msg:"affiliates.thrixxx.com"; classtype:trojan-activity; priority:1;) alert tcp 64.40.102.41 any $HOME_NET any (msg:"exit76.com"; classtype:trojan-activity; priority:1;) alert tcp 64.40.105.186 any $HOME_NET any (msg:"bidclix.com"; classtype:trojan-activity; priority:1;) alert tcp 64.40.105.187 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;) alert tcp 64.40.108.17 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;) alert tcp 64.40.111.23 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;) alert tcp 64.40.114.128 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 64.40.118.59 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;) alert tcp 64.41.191.100 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;) alert tcp 64.41.197.38 any $HOME_NET any (msg:"zedo.com"; classtype:trojan-activity; priority:1;) alert tcp 64.41.197.44 any $HOME_NET any (msg:"zedo.com"; classtype:trojan-activity; priority:1;) alert tcp 64.41.197.46 any $HOME_NET any (msg:"zedo.com"; classtype:trojan-activity; priority:1;) alert tcp 64.49.214.42 any $HOME_NET any (msg:"spywarelabs.com"; classtype:trojan-activity; priority:1;) alert tcp 64.49.252.22 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;) alert tcp 64.55.182.100 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;) alert tcp 64.56.194.84 any $HOME_NET any (msg:"top20.travelzoo.com"; classtype:trojan-activity; priority:1;) alert tcp 64.56.205.73 any $HOME_NET any (msg:"affiliates.streamray.com"; classtype:trojan-activity; priority:1;) alert tcp 64.56.205.97 any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 64.57.84.181 any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;) alert tcp 64.58.229.165 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 64.58.229.170 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 64.58.229.184 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 64.58.80.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;) alert tcp 64.58.80.26 any $HOME_NET any (msg:"a.windowsitpro.com"; classtype:trojan-activity; priority:1;) alert tcp 64.58.80.28 any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;) alert tcp 64.58.81.178 any $HOME_NET any (msg:"ads.rivals.net"; classtype:trojan-activity; priority:1;) alert tcp 64.6.17.5 any $HOME_NET any (msg:"partners.priceline.com"; classtype:trojan-activity; priority:1;) alert tcp 64.6.18.5 any $HOME_NET any (msg:"partners.priceline.com"; classtype:trojan-activity; priority:1;) alert tcp 64.6.28.5 any $HOME_NET any (msg:"partners.priceline.com"; classtype:trojan-activity; priority:1;) alert tcp 64.61.134.8 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;) alert tcp 64.62.232.32 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;) alert tcp 64.69.216.107 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 64.69.219.119 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 64.69.219.123 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 64.69.38.79 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 64.69.47.65 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 64.69.78.73 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;) alert tcp 64.69.79.206 any $HOME_NET any (msg:"ad-space.net"; classtype:trojan-activity; priority:1;) alert tcp 64.69.82.197 any $HOME_NET any (msg:"exitfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 64.7.201.1 any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;) alert tcp 64.7.203.60 any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;) alert tcp 64.7.203.69 any $HOME_NET any (msg:"hostedads.realitykings.com"; classtype:trojan-activity; priority:1;) alert tcp 64.7.203.70 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;) alert tcp 64.7.207.114 any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;) alert tcp 64.70.54.202 any $HOME_NET any (msg:"valueclick.com"; classtype:trojan-activity; priority:1;) alert tcp 64.70.54.44 any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.70.54.53 any $HOME_NET any (msg:"valueclickmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.70.54.71 any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.70.54.78 any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;) alert tcp 64.70.61.129 any $HOME_NET any (msg:"ads.ipowerweb.com"; classtype:trojan-activity; priority:1;) alert tcp 64.71.165.130 any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;) alert tcp 64.71.165.157 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;) alert tcp 64.71.187.181 any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;) alert tcp 64.72.112.122 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;) alert tcp 64.72.115.130 any $HOME_NET any (msg:"ads.kaktuz.net"; classtype:trojan-activity; priority:1;) alert tcp 64.74.108.71 any $HOME_NET any (msg:"mrskincash.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.134.11 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.134.14 any $HOME_NET any (msg:"ads.vnumedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.134.61 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.134.64 any $HOME_NET any (msg:"ads.vnumedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.172.33 any $HOME_NET any (msg:"admedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.193.108 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 64.74.193.63 any $HOME_NET any (msg:"ads.itv.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.197.108 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 64.74.197.124 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 64.74.197.217 any $HOME_NET any (msg:"adsrv.bankrate.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.197.236 any $HOME_NET any (msg:"ads.cheapflights.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.197.63 any $HOME_NET any (msg:"ads.itv.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.223.10 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.223.103 any $HOME_NET any (msg:"onlinecash.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.223.11 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.223.33 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.223.38 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.223.39 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.223.7 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 64.74.223.9 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;) alert tcp 64.77.50.10 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.161.69 any $HOME_NET any (msg:"specificpop.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.194.252 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.197.217 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.197.250 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.199.243 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.205.247 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.205.8 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.206.242 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.206.251 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.209.254 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.210.246 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.210.251 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.213.251 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.213.254 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.214.118 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.218.102 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.218.9 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.219.102 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.79.219.118 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 64.8.127.97 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 64.8.20.47 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;) alert tcp 64.8.21.48 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;) alert tcp 64.85.73.80 any $HOME_NET any (msg:"revenuedirect.com"; classtype:trojan-activity; priority:1;) alert tcp 64.87.9.107 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.247.114 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.249.50 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.249.51 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.250.156 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.250.157 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.250.173 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.250.37 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.251.39 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.158 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.160 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.163 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.165 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.166 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.167 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.168 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.169 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.178 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.179 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.181 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.217 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.252.227 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 64.88.254.18 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.254.53 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.254.54 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.88.254.55 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.89.19.145 any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;) alert tcp 64.89.23.131 any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;) alert tcp 64.90.175.199 any $HOME_NET any (msg:"marketing.nyi.net"; classtype:trojan-activity; priority:1;) alert tcp 64.90.175.2 any $HOME_NET any (msg:"marketing.nyi.net"; classtype:trojan-activity; priority:1;) alert tcp 64.90.175.200 any $HOME_NET any (msg:"ads.nyi.net"; classtype:trojan-activity; priority:1;) alert tcp 64.90.175.250 any $HOME_NET any (msg:"ads.nyi.net"; classtype:trojan-activity; priority:1;) alert tcp 64.90.186.67 any $HOME_NET any (msg:"ads.nyi.net"; classtype:trojan-activity; priority:1;) alert tcp 64.93.77.223 any $HOME_NET any (msg:"content.ad"; classtype:trojan-activity; priority:1;) alert tcp 64.93.77.226 any $HOME_NET any (msg:"content.ad"; classtype:trojan-activity; priority:1;) alert tcp 64.93.79.195 any $HOME_NET any (msg:"matchcraft.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.11 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.12 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.13 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.14 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.15 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.16 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.17 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.18 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.19 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.20 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.21 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.22 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.23 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.24 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.25 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.26 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.27 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.28 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.29 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.30 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.31 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.32 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.33 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.34 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.35 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.36 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.37 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.38 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.39 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.40 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.41 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.42 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.43 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.44 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.45 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.46 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.47 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.48 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.49 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.50 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.51 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.52 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.53 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.54 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.55 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.56 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.57 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.58 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.59 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.60 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.61 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.62 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.63 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.64 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.65 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.107.66 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.137.52 any $HOME_NET any (msg:"180searchassistant.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.137.63 any $HOME_NET any (msg:"180searchassistant.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.191.172 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.191.174 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.26.104 any $HOME_NET any (msg:"ads.fool.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.26.113 any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.29.11 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.29.14 any $HOME_NET any (msg:"ads.vnumedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.29.61 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.29.64 any $HOME_NET any (msg:"casalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 64.94.89.201 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.25.200 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.25.208 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.189 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.190 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.191 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.194 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.195 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.197 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.198 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.218 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.219 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 64.95.64.223 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 65.105.124.118 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 65.105.124.60 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;) alert tcp 65.110.169.132 any $HOME_NET any (msg:"optmd.com"; classtype:trojan-activity; priority:1;) alert tcp 65.110.6.8 any $HOME_NET any (msg:"ad-space.net"; classtype:trojan-activity; priority:1;) alert tcp 65.111.164.30 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 65.111.186.138 any $HOME_NET any (msg:"ads.vgchartz.com"; classtype:trojan-activity; priority:1;) alert tcp 65.113.112.23 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 65.118.76.5 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;) alert tcp 65.119.213.35 any $HOME_NET any (msg:"tribalfusion.speedera.net"; classtype:trojan-activity; priority:1;) alert tcp 65.119.213.36 any $HOME_NET any (msg:"tribalfusion.speedera.net"; classtype:trojan-activity; priority:1;) alert tcp 65.121.237.200 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;) alert tcp 65.124.207.42 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;) alert tcp 65.126.3.40 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;) alert tcp 65.161.177.67 any $HOME_NET any (msg:"the-counter.net"; classtype:trojan-activity; priority:1;) alert tcp 65.165.64.131 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;) alert tcp 65.167.65.100 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 65.167.65.49 any $HOME_NET any (msg:"ads.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 65.169.109.12 any $HOME_NET any (msg:"kanoodle.com"; classtype:trojan-activity; priority:1;) alert tcp 65.169.109.22 any $HOME_NET any (msg:"kanoodle.com"; classtype:trojan-activity; priority:1;) alert tcp 65.169.109.23 any $HOME_NET any (msg:"partner1.kanoodle.com"; classtype:trojan-activity; priority:1;) alert tcp 65.17.196.170 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;) alert tcp 65.17.236.38 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 65.18.168.214 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;) alert tcp 65.18.170.82 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;) alert tcp 65.18.173.137 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 65.18.173.139 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 65.18.173.141 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;) alert tcp 65.18.192.49 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 65.198.115.19 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;) alert tcp 65.199.10.123 any $HOME_NET any (msg:"adtegrity.thruport.com"; classtype:trojan-activity; priority:1;) alert tcp 65.203.229.118 any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;) alert tcp 65.203.229.212 any $HOME_NET any (msg:"ads.apn.co.nz"; classtype:trojan-activity; priority:1;) alert tcp 65.203.229.225 any $HOME_NET any (msg:"adsrv.bankrate.com"; classtype:trojan-activity; priority:1;) alert tcp 65.203.229.90 any $HOME_NET any (msg:"bidclix.com"; classtype:trojan-activity; priority:1;) alert tcp 65.203.232.12 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 65.203.232.9 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 65.203.241.137 any $HOME_NET any (msg:"ads.cheapflights.com"; classtype:trojan-activity; priority:1;) alert tcp 65.205.8.13 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 65.205.8.188 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 65.207.183.11 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.207.183.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.207.183.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.209.3.232 any $HOME_NET any (msg:"partner1.kanoodle.com"; classtype:trojan-activity; priority:1;) alert tcp 65.212.118.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.212.118.21 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.212.118.22 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.212.121.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.212.121.21 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.212.121.22 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 65.216.123.160 any $HOME_NET any (msg:"trafficmp.com"; classtype:trojan-activity; priority:1;) alert tcp 65.241.50.20 any $HOME_NET any (msg:"pgpartner.com"; classtype:trojan-activity; priority:1;) alert tcp 65.242.27.119 any $HOME_NET any (msg:"ads.cheapflights.com"; classtype:trojan-activity; priority:1;) alert tcp 65.242.27.138 any $HOME_NET any (msg:"adsrv.bankrate.com"; classtype:trojan-activity; priority:1;) alert tcp 65.242.27.40 any $HOME_NET any (msg:"atdmt.com"; classtype:trojan-activity; priority:1;) alert tcp 65.245.193.28 any $HOME_NET any (msg:"trafficstrategies.com"; classtype:trojan-activity; priority:1;) alert tcp 65.248.62.160 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;) alert tcp 65.254.229.220 any $HOME_NET any (msg:"affiliates.globat.com"; classtype:trojan-activity; priority:1;) alert tcp 65.254.248.135 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 65.254.37.222 any $HOME_NET any (msg:"easyhits4u.com"; classtype:trojan-activity; priority:1;) alert tcp 65.254.39.234 any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;) alert tcp 65.255.32.5 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;) alert tcp 65.36.152.16 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;) alert tcp 65.38.107.197 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;) alert tcp 65.38.113.13 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;) alert tcp 65.38.167.206 any $HOME_NET any (msg:"mypowermall.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.148.42 any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.148.43 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.148.50 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.176.100 any $HOME_NET any (msg:"bravenet.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.176.37 any $HOME_NET any (msg:"adserv2.bravenet.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.205.54 any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.205.61 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.211.106 any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;) alert tcp 65.39.243.210 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 65.49.35.141 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;) alert tcp 65.49.35.158 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;) alert tcp 65.50.210.132 any $HOME_NET any (msg:"ads.electrocelt.com"; classtype:trojan-activity; priority:1;) alert tcp 65.52.100.46 any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.52.107.149 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;) alert tcp 65.54.192.248 any $HOME_NET any (msg:"popup.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.54.194.102 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.54.194.117 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.54.194.118 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.54.195.185 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.54.195.187 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.121.231 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.15.123 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.15.124 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.15.243 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.175.254 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.197.114 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.197.115 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.197.125 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.197.254 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.249.222 any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.249.67 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.249.68 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.33.38 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.35.15 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.36.21 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.55.39.12 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;) alert tcp 65.55.5.233 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 65.59.207.13 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 65.60.52.90 any $HOME_NET any (msg:"all4spy.com"; classtype:trojan-activity; priority:1;) alert tcp 65.61.146.199 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 65.61.156.42 any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;) alert tcp 65.61.156.44 any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;) alert tcp 65.61.157.55 any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;) alert tcp 65.61.166.78 any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;) alert tcp 65.74.135.110 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;) alert tcp 65.74.156.180 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;) alert tcp 65.75.162.56 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 65.75.172.215 any $HOME_NET any (msg:""; classtype:trojan-activity; priority:1;) alert tcp 65.98.53.169 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;) alert tcp 65.99.207.66 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 65.99.253.170 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 65.99.253.174 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 66.101.153.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.1.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.1.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.1.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.1.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.11.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.11.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.11.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.11.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.13.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.13.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.13.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.13.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.13.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.13.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.13.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.15.106 any $HOME_NET any (msg:"stats.blogger.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.102.9.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.103.147.146 any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;) alert tcp 66.103.154.100 any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;) alert tcp 66.11.114.254 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 66.11.12.154 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;) alert tcp 66.11.225.247 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 66.111.40.193 any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;) alert tcp 66.113.130.167 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.113.130.222 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;) alert tcp 66.114.252.218 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;) alert tcp 66.114.252.228 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;) alert tcp 66.114.48.50 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 66.114.49.157 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 66.114.49.165 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 66.115.130.28 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;) alert tcp 66.115.133.96 any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.115.138.120 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;) alert tcp 66.115.153.193 any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.115.173.14 any $HOME_NET any (msg:"spacash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.115.173.83 any $HOME_NET any (msg:"spacash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.115.189.227 any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.101 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.103 any $HOME_NET any (msg:"adimages.been.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.109 any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.16 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.29 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.35 any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.36 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.39 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.41 any $HOME_NET any (msg:"actionsplash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.44 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.50 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.53 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.56 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.60 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.62 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.63 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.109.70 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.112 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.121 any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.156 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.170 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.219 any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.225 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.228 any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.230 any $HOME_NET any (msg:"adimages.been.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.46 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.47 any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.55 any $HOME_NET any (msg:"actionsplash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.116.125.90 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.117.3.14 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 66.117.3.20 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 66.117.3.40 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 66.118.145.47 any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;) alert tcp 66.118.157.192 any $HOME_NET any (msg:"adultadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 66.118.182.112 any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;) alert tcp 66.118.182.73 any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;) alert tcp 66.119.14.145 any $HOME_NET any (msg:"affiliate.travelnow.com"; classtype:trojan-activity; priority:1;) alert tcp 66.119.14.240 any $HOME_NET any (msg:"openad.travelnow.com"; classtype:trojan-activity; priority:1;) alert tcp 66.119.140.211 any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;) alert tcp 66.119.142.95 any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;) alert tcp 66.119.39.133 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;) alert tcp 66.128.155.138 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;) alert tcp 66.129.67.103 any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;) alert tcp 66.129.68.152 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;) alert tcp 66.129.71.126 any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;) alert tcp 66.132.173.16 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;) alert tcp 66.132.216.164 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;) alert tcp 66.132.236.189 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.132.240.18 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;) alert tcp 66.135.32.7 any $HOME_NET any (msg:"supertop100.com"; classtype:trojan-activity; priority:1;) alert tcp 66.135.34.13 any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;) alert tcp 66.135.39.135 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 66.139.79.94 any $HOME_NET any (msg:"supertop100.com"; classtype:trojan-activity; priority:1;) alert tcp 66.148.73.74 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 66.148.87.153 any $HOME_NET any (msg:"advertmedia.de"; classtype:trojan-activity; priority:1;) alert tcp 66.15.159.242 any $HOME_NET any (msg:"adcycle.com"; classtype:trojan-activity; priority:1;) alert tcp 66.15.30.41 any $HOME_NET any (msg:"adcycle.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.14.21 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.14.22 any $HOME_NET any (msg:"zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.14.49 any $HOME_NET any (msg:"zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.14.58 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.14.60 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.14.61 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.161.140 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.161.141 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 66.150.161.44 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 66.150.192.202 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.148.193 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.179.147 any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.181.32 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.181.33 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.183.102 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.183.43 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.183.66 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.183.67 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;) alert tcp 66.151.61.53 any $HOME_NET any (msg:"rubiconproject.com"; classtype:trojan-activity; priority:1;) alert tcp 66.152.78.141 any $HOME_NET any (msg:"adxpansion.com"; classtype:trojan-activity; priority:1;) alert tcp 66.152.78.246 any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.152.88.186 any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.152.88.200 any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.152.93.130 any $HOME_NET any (msg:"mediatext.com"; classtype:trojan-activity; priority:1;) alert tcp 66.152.97.130 any $HOME_NET any (msg:"ads.powweb.com"; classtype:trojan-activity; priority:1;) alert tcp 66.154.16.118 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;) alert tcp 66.155.11.250 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 66.155.9.250 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 66.159.17.64 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 66.161.20.33 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;) alert tcp 66.161.36.111 any $HOME_NET any (msg:"hitslink.com"; classtype:trojan-activity; priority:1;) alert tcp 66.165.186.100 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;) alert tcp 66.171.184.34 any $HOME_NET any (msg:"www.photo-ads.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 66.172.61.202 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 66.175.211.95 any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.107.37 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.107.41 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.107.44 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.152.120 any $HOME_NET any (msg:"ads.oneplace.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.152.121 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.152.184 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.17.187 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.188.1 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.188.61 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.48.110 any $HOME_NET any (msg:"spinbox.versiontracker.com"; classtype:trojan-activity; priority:1;) alert tcp 66.179.5.44 any $HOME_NET any (msg:"coremetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 66.180.204.130 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 66.180.230.100 any $HOME_NET any (msg:"bravenet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.180.230.37 any $HOME_NET any (msg:"linktrack.bravenet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.181.160.131 any $HOME_NET any (msg:"sexcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.181.168.114 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;) alert tcp 66.181.168.117 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;) alert tcp 66.181.171.66 any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;) alert tcp 66.192.130.249 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 66.192.130.250 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 66.192.130.252 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 66.194.37.33 any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;) alert tcp 66.194.38.206 any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;) alert tcp 66.194.38.28 any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;) alert tcp 66.196.65.174 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 66.196.65.188 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 66.197.77.191 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 66.199.141.53 any $HOME_NET any (msg:"casalemedia.com"; classtype:trojan-activity; priority:1;) alert tcp 66.199.180.175 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 66.199.187.168 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;) alert tcp 66.199.187.181 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;) alert tcp 66.199.187.182 any $HOME_NET any (msg:"exitfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 66.201.203.154 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.201.42.4 any $HOME_NET any (msg:"ads.electrocelt.com"; classtype:trojan-activity; priority:1;) alert tcp 66.207.130.76 any $HOME_NET any (msg:"barnesandnoble.bfast.com"; classtype:trojan-activity; priority:1;) alert tcp 66.212.235.221 any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.212.242.247 any $HOME_NET any (msg:"banner.goldenpalace.com"; classtype:trojan-activity; priority:1;) alert tcp 66.216.103.189 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;) alert tcp 66.216.104.184 any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;) alert tcp 66.216.74.57 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.216.74.58 any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;) alert tcp 66.216.84.115 any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;) alert tcp 66.216.92.136 any $HOME_NET any (msg:"exit76.com"; classtype:trojan-activity; priority:1;) alert tcp 66.216.94.73 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;) alert tcp 66.216.97.175 any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;) alert tcp 66.218.65.230 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.218.65.231 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.220.2.20 any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;) alert tcp 66.220.2.7 any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;) alert tcp 66.223.110.65 any $HOME_NET any (msg:"revstats.com"; classtype:trojan-activity; priority:1;) alert tcp 66.226.8.150 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 66.227.96.173 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;) alert tcp 66.228.45.75 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;) alert tcp 66.228.48.28 any $HOME_NET any (msg:"advertise.com"; classtype:trojan-activity; priority:1;) alert tcp 66.23.226.207 any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.135.58 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.153.150 any $HOME_NET any (msg:"ads180.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.158.246 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.158.38 any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.168.14 any $HOME_NET any (msg:"oxcash.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.169.2 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.173.244 any $HOME_NET any (msg:"realcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.173.254 any $HOME_NET any (msg:"realcastmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.192.41 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;) alert tcp 66.230.226.27 any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;) alert tcp 66.230.239.174 any $HOME_NET any (msg:"zeus.developershed.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.132.118 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.132.121 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.132.152 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.132.188 any $HOME_NET any (msg:"offermatica.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.132.232 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.132.91 any $HOME_NET any (msg:"touchclarity.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.133.1 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.133.11 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.133.14 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.133.33 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.133.52 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.133.62 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.133.8 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.134.160 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.1 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.18 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.19 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.192 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.193 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.194 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.195 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.2 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.224 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.225 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.226 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.3 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.44 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.138.59 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.110 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.118 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.121 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.152 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.153 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.166 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.180 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.204 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.205 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.206 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.207 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.54 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.62 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.139.70 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.148.88 any $HOME_NET any (msg:"ad.auditude.com"; classtype:trojan-activity; priority:1;) alert tcp 66.235.160.74 any $HOME_NET any (msg:"affiliates.thinkhost.net"; classtype:trojan-activity; priority:1;) alert tcp 66.235.214.252 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;) alert tcp 66.236.129.73 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 66.240.165.115 any $HOME_NET any (msg:"affiliates.ultrahosting.com"; classtype:trojan-activity; priority:1;) alert tcp 66.240.173.8 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.244.151.241 any $HOME_NET any (msg:"juicyads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.246.235.131 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.246.235.44 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.246.235.59 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.17.46 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.4.125 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.4.198 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.4.207 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.4.244 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.8.122 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.8.29 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.8.30 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.8.6 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.8.7 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.91.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.93.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.93.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.93.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.249.93.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 66.250.64.24 any $HOME_NET any (msg:"ad.choiceradio.com"; classtype:trojan-activity; priority:1;) alert tcp 66.252.159.51 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 66.252.159.52 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 66.252.2.27 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 66.254.100.195 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;) alert tcp 66.254.100.198 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;) alert tcp 66.28.104.24 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.104.28 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.107.34 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.139.100 any $HOME_NET any (msg:"ientrymail.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.237.138 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.237.15 any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.32.118 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.32.70 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.60.100 any $HOME_NET any (msg:"ads.newgrounds.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.60.104 any $HOME_NET any (msg:"ads.newgrounds.com"; classtype:trojan-activity; priority:1;) alert tcp 66.28.69.150 any $HOME_NET any (msg:"as5000.com"; classtype:trojan-activity; priority:1;) alert tcp 66.29.43.7 any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;) alert tcp 66.33.193.195 any $HOME_NET any (msg:"counter.dreamhost.com"; classtype:trojan-activity; priority:1;) alert tcp 66.33.216.70 any $HOME_NET any (msg:"counter.dreamhost.com"; classtype:trojan-activity; priority:1;) alert tcp 66.33.255.75 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;) alert tcp 66.35.229.145 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 66.35.229.177 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;) alert tcp 66.40.56.64 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.45.104.150 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;) alert tcp 66.45.123.238 any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;) alert tcp 66.45.232.66 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 66.45.232.75 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 66.45.237.187 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 66.45.239.146 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 66.45.240.180 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 66.45.247.158 any $HOME_NET any (msg:"rampidads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.45.252.236 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 66.45.252.237 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 66.45.254.244 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 66.45.254.245 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;) alert tcp 66.46.150.29 any $HOME_NET any (msg:"ac.rnm.ca"; classtype:trojan-activity; priority:1;) alert tcp 66.48.78.201 any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;) alert tcp 66.48.78.249 any $HOME_NET any (msg:"yesads.com"; classtype:trojan-activity; priority:1;) alert tcp 66.51.97.131 any $HOME_NET any (msg:"investopedia.com"; classtype:trojan-activity; priority:1;) alert tcp 66.54.16.42 any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;) alert tcp 66.54.16.45 any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;) alert tcp 66.54.32.235 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 66.54.32.244 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;) alert tcp 66.54.33.109 any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;) alert tcp 66.54.5.97 any $HOME_NET any (msg:"advert.bayarea.com"; classtype:trojan-activity; priority:1;) alert tcp 66.55.129.226 any $HOME_NET any (msg:"sexcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.55.134.194 any $HOME_NET any (msg:"proton-tm.com"; classtype:trojan-activity; priority:1;) alert tcp 66.55.135.184 any $HOME_NET any (msg:"banners.videosz.com"; classtype:trojan-activity; priority:1;) alert tcp 66.55.147.179 any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;) alert tcp 66.59.66.6 any $HOME_NET any (msg:"ads.okcimg.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.10 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.13 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.14 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.146 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.147 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.148 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.149 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.15 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.150 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.158 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.159 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.16 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.17 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.18 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.21 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.22 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.23 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.237 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.238 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.239 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.24 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.25 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.26 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.27 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.28 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.29 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.30 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.31 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.40 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.41 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.42 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.43 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.44 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.45 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.46 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.49 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.51 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.53 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.54 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.56 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.57 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.60 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.62 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.67 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.68 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.69 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.70 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.71 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.72 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.74 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.75 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.76 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.78 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.79 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.8 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.80 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.18.9 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.19.21 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.19.22 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.19.29 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.19.41 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.19.42 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.20.240 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.20.241 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.20.243 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.21.76 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.21.77 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.21.78 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.21.79 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.21.80 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.6.21.81 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;) alert tcp 66.7.159.242 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.7.179.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.119.205 any $HOME_NET any (msg:"eurekster.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.16.150 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.20.60 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.21.80 any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.45.190 any $HOME_NET any (msg:"clicktracks.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.55.200 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.55.201 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.68.147 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;) alert tcp 66.70.91.44 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;) alert tcp 66.71.247.134 any $HOME_NET any (msg:"adsystem.simplemachines.org"; classtype:trojan-activity; priority:1;) alert tcp 66.71.247.135 any $HOME_NET any (msg:"adsystem.simplemachines.org"; classtype:trojan-activity; priority:1;) alert tcp 66.77.141.20 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.77.24.11 any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.77.24.4 any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;) alert tcp 66.77.3.50 any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;) alert tcp 66.77.93.20 any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;) alert tcp 66.77.93.21 any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;) alert tcp 66.77.93.40 any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;) alert tcp 66.78.30.146 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 66.79.165.40 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 66.79.165.49 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 66.79.166.101 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 66.79.177.160 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 66.79.180.50 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 66.79.189.134 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;) alert tcp 66.79.191.231 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 66.9.53.130 any $HOME_NET any (msg:"ad.uk.tangozebra.com"; classtype:trojan-activity; priority:1;) alert tcp 66.90.102.153 any $HOME_NET any (msg:"ads.goyk.com"; classtype:trojan-activity; priority:1;) alert tcp 66.90.102.32 any $HOME_NET any (msg:"ads.goyk.com"; classtype:trojan-activity; priority:1;) alert tcp 66.90.102.33 any $HOME_NET any (msg:"ads.goyk.com"; classtype:trojan-activity; priority:1;) alert tcp 66.96.130.201 any $HOME_NET any (msg:"ads.ipowerweb.com"; classtype:trojan-activity; priority:1;) alert tcp 66.98.134.100 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.98.164.58 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 66.98.176.64 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 66.98.186.36 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 66.98.208.60 any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;) alert tcp 66.98.246.45 any $HOME_NET any (msg:"topmmorpgsites.com"; classtype:trojan-activity; priority:1;) alert tcp 67.121.212.61 any $HOME_NET any (msg:"adjix.com"; classtype:trojan-activity; priority:1;) alert tcp 67.139.254.130 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 67.139.254.131 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 67.139.254.137 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 67.15.149.163 any $HOME_NET any (msg:"gostats.com"; classtype:trojan-activity; priority:1;) alert tcp 67.15.18.186 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 67.15.18.36 any $HOME_NET any (msg:"advertising.se"; classtype:trojan-activity; priority:1;) alert tcp 67.15.18.6 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 67.15.221.147 any $HOME_NET any (msg:"histats.com"; classtype:trojan-activity; priority:1;) alert tcp 67.15.35.179 any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 67.15.36.33 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;) alert tcp 67.15.52.51 any $HOME_NET any (msg:"banners.sys-con.com"; classtype:trojan-activity; priority:1;) alert tcp 67.15.56.137 any $HOME_NET any (msg:"chitika.net"; classtype:trojan-activity; priority:1;) alert tcp 67.15.58.29 any $HOME_NET any (msg:"gamesites100.net"; classtype:trojan-activity; priority:1;) alert tcp 67.15.68.51 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;) alert tcp 67.15.76.201 any $HOME_NET any (msg:"bannerserver.com"; classtype:trojan-activity; priority:1;) alert tcp 67.15.77.192 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;) alert tcp 67.15.94.25 any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;) alert tcp 67.170.82.122 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 67.170.83.157 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 67.18.19.178 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;) alert tcp 67.18.216.114 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 67.18.247.122 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;) alert tcp 67.18.31.86 any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 67.18.81.178 any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;) alert tcp 67.18.90.133 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 67.19.124.187 any $HOME_NET any (msg:"e-planning.net"; classtype:trojan-activity; priority:1;) alert tcp 67.19.146.35 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 67.19.19.130 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;) alert tcp 67.19.212.250 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;) alert tcp 67.19.248.186 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.11.92 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.11.95 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.42.19 any $HOME_NET any (msg:"adv-adserver.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.42.23 any $HOME_NET any (msg:"adv-adserver.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.42.28 any $HOME_NET any (msg:"adv-adserver.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.6.217 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.6.223 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.87.123 any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;) alert tcp 67.192.92.227 any $HOME_NET any (msg:"ad.auditude.com"; classtype:trojan-activity; priority:1;) alert tcp 67.199.128.19 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 67.199.128.43 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 67.199.128.44 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 67.199.128.48 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 67.20.57.39 any $HOME_NET any (msg:"caniamedia.com"; classtype:trojan-activity; priority:1;) alert tcp 67.201.14.126 any $HOME_NET any (msg:"caniamedia.com"; classtype:trojan-activity; priority:1;) alert tcp 67.201.36.205 any $HOME_NET any (msg:"therapistla.com"; classtype:trojan-activity; priority:1;) alert tcp 67.201.52.101 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;) alert tcp 67.201.52.148 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;) alert tcp 67.201.52.201 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;) alert tcp 67.202.31.193 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 67.202.94.71 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;) alert tcp 67.202.94.86 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;) alert tcp 67.202.94.87 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;) alert tcp 67.202.94.93 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;) alert tcp 67.202.94.94 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;) alert tcp 67.203.22.40 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;) alert tcp 67.205.1.8 any $HOME_NET any (msg:"ultramercial.com"; classtype:trojan-activity; priority:1;) alert tcp 67.205.54.21 any $HOME_NET any (msg:"adnetwork.net"; classtype:trojan-activity; priority:1;) alert tcp 67.205.63.30 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;) alert tcp 67.207.222.205 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;) alert tcp 67.211.111.169 any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;) alert tcp 67.212.92.251 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 67.214.159.118 any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;) alert tcp 67.214.159.120 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;) alert tcp 67.214.159.86 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;) alert tcp 67.215.173.231 any $HOME_NET any (msg:"zantracker.com"; classtype:trojan-activity; priority:1;) alert tcp 67.215.174.121 any $HOME_NET any (msg:"zantracker.com"; classtype:trojan-activity; priority:1;) alert tcp 67.215.246.202 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;) alert tcp 67.215.253.138 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 67.215.6.84 any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;) alert tcp 67.216.179.138 any $HOME_NET any (msg:"robotreplay.com"; classtype:trojan-activity; priority:1;) alert tcp 67.221.235.201 any $HOME_NET any (msg:"apture.com"; classtype:trojan-activity; priority:1;) alert tcp 67.222.103.233 any $HOME_NET any (msg:"performancing.com"; classtype:trojan-activity; priority:1;) alert tcp 67.222.158.75 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 67.223.225.253 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 67.223.226.253 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 67.223.229.28 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 67.223.229.29 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 67.225.184.114 any $HOME_NET any (msg:"dealdotcom.com"; classtype:trojan-activity; priority:1;) alert tcp 67.225.190.36 any $HOME_NET any (msg:"bluewhaleweb.com"; classtype:trojan-activity; priority:1;) alert tcp 67.227.236.73 any $HOME_NET any (msg:"adcash.com"; classtype:trojan-activity; priority:1;) alert tcp 67.227.236.89 any $HOME_NET any (msg:"adcash.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.151.66 any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.151.67 any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.151.68 any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.151.69 any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.163.216 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 67.228.17.235 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.183.35 any $HOME_NET any (msg:"clustrmaps.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.186.42 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.186.43 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.22.210 any $HOME_NET any (msg:"hits.informer.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.226.99 any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;) alert tcp 67.228.235.91 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 67.23.12.128 any $HOME_NET any (msg:"ads2.net-communities.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 67.23.33.102 any $HOME_NET any (msg:"fusionads.net"; classtype:trojan-activity; priority:1;) alert tcp 67.23.7.65 any $HOME_NET any (msg:"netcommunities.com"; classtype:trojan-activity; priority:1;) alert tcp 67.55.121.4 any $HOME_NET any (msg:"privatecash.com"; classtype:trojan-activity; priority:1;) alert tcp 67.63.55.53 any $HOME_NET any (msg:"ads.web21.com"; classtype:trojan-activity; priority:1;) alert tcp 67.88.220.26 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;) alert tcp 67.98.249.181 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;) alert tcp 67.99.176.30 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 68.142.234.44 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;) alert tcp 68.142.234.45 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;) alert tcp 68.142.234.46 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;) alert tcp 68.142.234.47 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;) alert tcp 68.142.234.78 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;) alert tcp 68.142.234.88 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;) alert tcp 68.167.223.148 any $HOME_NET any (msg:"overpeer.com"; classtype:trojan-activity; priority:1;) alert tcp 68.168.112.22 any $HOME_NET any (msg:"affiliation-france.com"; classtype:trojan-activity; priority:1;) alert tcp 68.168.112.4 any $HOME_NET any (msg:"affiliation-france.com"; classtype:trojan-activity; priority:1;) alert tcp 68.169.72.178 any $HOME_NET any (msg:"whaleads.com"; classtype:trojan-activity; priority:1;) alert tcp 68.169.73.54 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 68.169.80.103 any $HOME_NET any (msg:"whaleads.com"; classtype:trojan-activity; priority:1;) alert tcp 68.169.85.226 any $HOME_NET any (msg:"craktraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 68.178.146.133 any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;) alert tcp 68.178.211.30 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;) alert tcp 68.178.232.143 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;) alert tcp 68.178.232.44 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 68.178.232.60 any $HOME_NET any (msg:"theadhost.com"; classtype:trojan-activity; priority:1;) alert tcp 68.178.254.122 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;) alert tcp 68.178.254.198 any $HOME_NET any (msg:"lucidmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 68.180.195.71 any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;) alert tcp 68.180.206.184 any $HOME_NET any (msg:"yieldmanager.net"; classtype:trojan-activity; priority:1;) alert tcp 68.232.188.164 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 68.232.35.119 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;) alert tcp 68.232.35.169 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 68.233.244.176 any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;) alert tcp 68.67.130.13 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 68.67.170.143 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.135 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.136 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.137 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.140 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.141 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.146 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.149 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.151 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.155 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.157 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.158 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.159 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.160 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.203 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.205 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.206 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.207 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.210 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.216 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.218 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.221 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.225 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.244 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.248 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.249 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.179.252 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.146 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.147 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.151 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.172 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.175 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.176 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.183 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.185 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.187 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.189 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.190 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.193 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.194 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.199 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.207 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.219 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.221 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.224 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.247 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.250 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.67.185.251 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;) alert tcp 68.68.107.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.107.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.107.69 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 68.68.30.100 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.30.105 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.30.110 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.30.115 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.30.80 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.30.85 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.30.90 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 68.68.30.95 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;) alert tcp 68.71.209.57 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;) alert tcp 68.71.220.155 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;) alert tcp 69.0.137.154 any $HOME_NET any (msg:"advertserve.com"; classtype:trojan-activity; priority:1;) alert tcp 69.0.147.100 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 69.0.219.109 any $HOME_NET any (msg:"vericlick.com"; classtype:trojan-activity; priority:1;) alert tcp 69.0.247.52 any $HOME_NET any (msg:"advertserve.com"; classtype:trojan-activity; priority:1;) alert tcp 69.10.224.247 any $HOME_NET any (msg:"affiliates.ultrahosting.com"; classtype:trojan-activity; priority:1;) alert tcp 69.10.233.37 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;) alert tcp 69.10.24.246 any $HOME_NET any (msg:"mediamgr.ugo.com"; classtype:trojan-activity; priority:1;) alert tcp 69.10.24.70 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;) alert tcp 69.10.24.93 any $HOME_NET any (msg:"adcontent.gamespy.com"; classtype:trojan-activity; priority:1;) alert tcp 69.10.25.46 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;) alert tcp 69.12.31.26 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 69.147.76.121 any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;) alert tcp 69.147.76.65 any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;) alert tcp 69.16.243.73 any $HOME_NET any (msg:"infiniteadds.org"; classtype:trojan-activity; priority:1;) alert tcp 69.16.250.220 any $HOME_NET any (msg:"dealdotcom.com"; classtype:trojan-activity; priority:1;) alert tcp 69.162.133.171 any $HOME_NET any (msg:"infiniteadds.org"; classtype:trojan-activity; priority:1;) alert tcp 69.162.154.23 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;) alert tcp 69.163.254.5 any $HOME_NET any (msg:"counter.dreamhost.com"; classtype:trojan-activity; priority:1;) alert tcp 69.164.206.55 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 69.166.132.246 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;) alert tcp 69.170.135.92 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;) alert tcp 69.172.200.114 any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;) alert tcp 69.174.242.183 any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 69.174.247.169 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 69.174.247.170 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 69.194.143.52 any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;) alert tcp 69.194.143.64 any $HOME_NET any (msg:"rubiconproject.com"; classtype:trojan-activity; priority:1;) alert tcp 69.194.230.11 any $HOME_NET any (msg:"microticker.com"; classtype:trojan-activity; priority:1;) alert tcp 69.194.244.11 any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;) alert tcp 69.194.245.5 any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;) alert tcp 69.195.77.90 any $HOME_NET any (msg:"peer39.com"; classtype:trojan-activity; priority:1;) alert tcp 69.197.22.76 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;) alert tcp 69.197.23.175 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 69.2.101.13 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;) alert tcp 69.2.101.36 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;) alert tcp 69.2.103.13 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;) alert tcp 69.2.103.57 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;) alert tcp 69.2.38.68 any $HOME_NET any (msg:"ads.casinocity.com"; classtype:trojan-activity; priority:1;) alert tcp 69.20.17.30 any $HOME_NET any (msg:"offermatica.com"; classtype:trojan-activity; priority:1;) alert tcp 69.20.24.247 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;) alert tcp 69.20.34.91 any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;) alert tcp 69.20.35.142 any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;) alert tcp 69.20.36.8 any $HOME_NET any (msg:"eadexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 69.20.49.240 any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;) alert tcp 69.20.53.191 any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.11 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.12 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.13 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.14 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.16 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.17 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.3 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.4 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.5 any $HOME_NET any (msg:"dmtracker.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.142.9 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.178.136 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.190.10 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.190.30 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.190.36 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.27.170 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.27.173 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;) alert tcp 69.25.47.166 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 69.25.47.62 any $HOME_NET any (msg:"quantcast.com"; classtype:trojan-activity; priority:1;) alert tcp 69.28.181.47 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 69.28.197.155 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 69.28.74.175 any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;) alert tcp 69.31.16.88 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;) alert tcp 69.36.40.52 any $HOME_NET any (msg:"decknetwork.net"; classtype:trojan-activity; priority:1;) alert tcp 69.39.236.36 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 69.39.239.7 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 69.41.174.168 any $HOME_NET any (msg:"statisfy.net"; classtype:trojan-activity; priority:1;) alert tcp 69.42.67.234 any $HOME_NET any (msg:"topsites.com.br"; classtype:trojan-activity; priority:1;) alert tcp 69.42.67.236 any $HOME_NET any (msg:"topsites.com.br"; classtype:trojan-activity; priority:1;) alert tcp 69.42.73.10 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;) alert tcp 69.42.73.50 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;) alert tcp 69.42.73.55 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;) alert tcp 69.42.73.60 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;) alert tcp 69.42.82.196 any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.160.144 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.160.146 any $HOME_NET any (msg:"ads2.rne.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.160.151 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.160.153 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.160.158 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.160.172 any $HOME_NET any (msg:"ads2.rne.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.160.208 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.160.210 any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.161.132 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 69.43.161.152 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.161.162 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.161.177 any $HOME_NET any (msg:"zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.161.197 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.161.210 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 69.43.161.4 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;) alert tcp 69.44.155.114 any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;) alert tcp 69.44.60.99 any $HOME_NET any (msg:"ad1.emule-project.org"; classtype:trojan-activity; priority:1;) alert tcp 69.46.20.65 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 69.46.21.14 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.226.141 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.226.163 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.226.167 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.160 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.169 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.171 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.175 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.177 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.181 any $HOME_NET any (msg:"ads2.rne.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.37 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.39 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.228.57 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 69.46.28.42 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 69.46.28.87 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 69.46.28.90 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 69.46.28.92 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 69.46.36.6 any $HOME_NET any (msg:"feedjit.com"; classtype:trojan-activity; priority:1;) alert tcp 69.48.248.50 any $HOME_NET any (msg:"shoppingads.com"; classtype:trojan-activity; priority:1;) alert tcp 69.48.248.51 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 69.48.248.61 any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;) alert tcp 69.5.11.164 any $HOME_NET any (msg:"microticker.com"; classtype:trojan-activity; priority:1;) alert tcp 69.50.131.221 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;) alert tcp 69.50.131.237 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;) alert tcp 69.50.135.82 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;) alert tcp 69.50.137.28 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;) alert tcp 69.50.138.146 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;) alert tcp 69.50.193.1 any $HOME_NET any (msg:"bannertesting.com"; classtype:trojan-activity; priority:1;) alert tcp 69.50.219.148 any $HOME_NET any (msg:"adsynergy.com"; classtype:trojan-activity; priority:1;) alert tcp 69.51.17.129 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;) alert tcp 69.51.8.31 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 69.51.8.33 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 69.51.8.39 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 69.51.8.4 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.226.116 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;) alert tcp 69.55.231.165 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;) alert tcp 69.55.231.250 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.136 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.137 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.142 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.145 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.163 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.164 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.168 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.169 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.48.238 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.114 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.150 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.199 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.200 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.209 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.211 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.226 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.25 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.45 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.46 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.5 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.74 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.75 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.76 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.52.93 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.60.182 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.60.206 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.60.6 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.61.160 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.62.114 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.62.118 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.62.122 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.62.66 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.62.90 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.63.16 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.63.3 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.63.31 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.63.55 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.55.63.56 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;) alert tcp 69.56.136.30 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 69.56.152.78 any $HOME_NET any (msg:"herbalaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 69.56.171.54 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;) alert tcp 69.56.194.122 any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;) alert tcp 69.56.235.196 any $HOME_NET any (msg:"relmaxtop.com"; classtype:trojan-activity; priority:1;) alert tcp 69.57.155.105 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;) alert tcp 69.57.155.11 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;) alert tcp 69.59.148.68 any $HOME_NET any (msg:"directaclick.com"; classtype:trojan-activity; priority:1;) alert tcp 69.59.161.242 any $HOME_NET any (msg:"trackalyzer.com"; classtype:trojan-activity; priority:1;) alert tcp 69.59.170.246 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 69.59.175.208 any $HOME_NET any (msg:"fusionquest.com"; classtype:trojan-activity; priority:1;) alert tcp 69.59.181.11 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 69.59.181.9 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;) alert tcp 69.59.195.11 any $HOME_NET any (msg:"textads.biz"; classtype:trojan-activity; priority:1;) alert tcp 69.59.195.38 any $HOME_NET any (msg:"textads.biz"; classtype:trojan-activity; priority:1;) alert tcp 69.59.28.209 any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;) alert tcp 69.6.2.106 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;) alert tcp 69.6.2.68 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;) alert tcp 69.6.2.98 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;) alert tcp 69.6.21.113 any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;) alert tcp 69.6.21.21 any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;) alert tcp 69.6.27.100 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;) alert tcp 69.6.27.3 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;) alert tcp 69.6.33.3 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;) alert tcp 69.60.114.117 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;) alert tcp 69.60.115.201 any $HOME_NET any (msg:"textads.biz"; classtype:trojan-activity; priority:1;) alert tcp 69.60.120.198 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 69.60.122.105 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;) alert tcp 69.63.218.249 any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 69.63.219.250 any $HOME_NET any (msg:"valuead.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.147.176 any $HOME_NET any (msg:"nuseek.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.147.21 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.147.216 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.147.248 any $HOME_NET any (msg:"onlinecash.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.153.126 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.153.135 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.153.171 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.154.198 any $HOME_NET any (msg:"dmtracker.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.155.130 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.155.136 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.155.137 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.155.144 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.155.4 any $HOME_NET any (msg:"nuseek.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.240.47 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.34.153 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;) alert tcp 69.64.59.218 any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;) alert tcp 69.65.38.224 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 69.65.39.23 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;) alert tcp 69.65.43.176 any $HOME_NET any (msg:"amazingcounters.com"; classtype:trojan-activity; priority:1;) alert tcp 69.72.142.98 any $HOME_NET any (msg:"chartbeat.net"; classtype:trojan-activity; priority:1;) alert tcp 69.72.168.234 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 69.73.177.6 any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;) alert tcp 69.8.219.192 any $HOME_NET any (msg:"trafficstrategies.com"; classtype:trojan-activity; priority:1;) alert tcp 69.80.225.24 any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;) alert tcp 69.88.139.49 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 69.88.139.50 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 69.88.139.55 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;) alert tcp 69.88.145.11 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;) alert tcp 69.89.74.113 any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;) alert tcp 69.9.161.98 any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;) alert tcp 69.9.170.150 any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;) alert tcp 69.90.152.224 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;) alert tcp 69.90.152.225 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;) alert tcp 69.90.152.226 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;) alert tcp 69.90.204.170 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;) alert tcp 69.90.204.171 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;) alert tcp 69.90.24.158 any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;) alert tcp 69.90.31.112 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;) alert tcp 69.93.15.21 any $HOME_NET any (msg:"herbalaffiliateprogram.com"; classtype:trojan-activity; priority:1;) alert tcp 69.93.171.85 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 69.93.193.202 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;) alert tcp 69.93.2.12 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;) alert tcp 69.93.220.38 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 69.93.73.21 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;) alert tcp 69.94.138.192 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 69.94.14.95 any $HOME_NET any (msg:"specificpop.com"; classtype:trojan-activity; priority:1;) alert tcp 69.94.25.146 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;) alert tcp 69.94.73.65 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 70.165.44.241 any $HOME_NET any (msg:"neudesicmediagroup.com"; classtype:trojan-activity; priority:1;) alert tcp 70.182.179.196 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;) alert tcp 70.32.146.212 any $HOME_NET any (msg:"doubleclick.net"; classtype:trojan-activity; priority:1;) alert tcp 70.42.129.172 any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.129.173 any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.129.197 any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.129.220 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.138.14 any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.22.65 any $HOME_NET any (msg:"quinst.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.23.11 any $HOME_NET any (msg:"qnsr.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.23.116 any $HOME_NET any (msg:"thecounter.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.23.121 any $HOME_NET any (msg:"thecounter.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.23.243 any $HOME_NET any (msg:"quinst.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.254.174 any $HOME_NET any (msg:"eurekster.com"; classtype:trojan-activity; priority:1;) alert tcp 70.42.33.241 any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;) alert tcp 70.42.34.254 any $HOME_NET any (msg:"quantcast.com"; classtype:trojan-activity; priority:1;) alert tcp 70.84.111.82 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 70.84.114.142 any $HOME_NET any (msg:"easyhits4u.com"; classtype:trojan-activity; priority:1;) alert tcp 70.84.189.210 any $HOME_NET any (msg:"adreactor.com"; classtype:trojan-activity; priority:1;) alert tcp 70.84.236.226 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 70.84.44.103 any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;) alert tcp 70.84.52.18 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;) alert tcp 70.84.96.2 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 70.85.113.2 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 70.85.160.244 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;) alert tcp 70.85.166.243 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 70.85.22.227 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;) alert tcp 70.85.251.170 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 70.85.53.210 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;) alert tcp 70.85.96.106 any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;) alert tcp 70.86.108.254 any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 70.86.170.162 any $HOME_NET any (msg:"ads.flooble.com"; classtype:trojan-activity; priority:1;) alert tcp 70.86.189.194 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;) alert tcp 70.87.197.26 any $HOME_NET any (msg:"toplistcity.com"; classtype:trojan-activity; priority:1;) alert tcp 70.87.21.179 any $HOME_NET any (msg:"opienetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 70.87.239.82 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 70.87.3.233 any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;) alert tcp 70.87.32.82 any $HOME_NET any (msg:"top-site-list.com"; classtype:trojan-activity; priority:1;) alert tcp 71.184.92.53 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 71.184.92.55 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;) alert tcp 71.197.217.87 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 71.4.175.98 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;) alert tcp 71.40.76.138 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 71.5.65.70 any $HOME_NET any (msg:"overpeer.com"; classtype:trojan-activity; priority:1;) alert tcp 71.6.193.126 any $HOME_NET any (msg:"exchange-it.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.162.20 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 72.14.162.241 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 72.14.162.242 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 72.14.162.40 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 72.14.162.69 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 72.14.162.70 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;) alert tcp 72.14.203.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.203.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.205.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.207.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.207.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.209.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.217.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.217.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.217.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.217.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.221.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.221.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.221.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.221.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.221.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.247.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.247.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.247.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;) alert tcp 72.14.253.99 any $HOME_NET any (msg:"google-analytics.com"; classtype:trojan-activity; priority:1;) alert tcp 72.166.185.151 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 72.167.131.162 any $HOME_NET any (msg:"malwaredomains.com"; classtype:trojan-activity; priority:1;) alert tcp 72.167.131.188 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;) alert tcp 72.167.131.38 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 72.167.141.42 any $HOME_NET any (msg:"trafficspaces.net"; classtype:trojan-activity; priority:1;) alert tcp 72.167.232.146 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;) alert tcp 72.167.232.20 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 72.167.248.70 any $HOME_NET any (msg:"matchcraft.com"; classtype:trojan-activity; priority:1;) alert tcp 72.167.26.138 any $HOME_NET any (msg:"trafficmp.com"; classtype:trojan-activity; priority:1;) alert tcp 72.172.67.24 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;) alert tcp 72.172.84.148 any $HOME_NET any (msg:"adminder.com"; classtype:trojan-activity; priority:1;) alert tcp 72.2.114.172 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 72.2.6.81 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 72.2.6.91 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;) alert tcp 72.2.7.31 any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;) alert tcp 72.20.110.8 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 72.20.40.27 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 72.20.40.28 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 72.20.40.29 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.194.140 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.194.16 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.194.20 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 72.21.194.23 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.194.29 any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.194.32 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.195.15 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.195.34 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.195.66 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.195.72 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 72.21.195.98 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.114 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.131 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.134 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.153 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.165 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.194 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.39 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.71 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.202.96 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.203.132 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.203.133 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.203.149 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.203.159 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 72.21.206.84 any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.102 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.114 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.134 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.137 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.153 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.165 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.195 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.212 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.226 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.241 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.207.246 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.210.210 any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.210.7 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.102 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.131 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.137 any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.146 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.147 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.153 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.163 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.165 any $HOME_NET any (msg:"ads.psd2html.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.168 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.171 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.188 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.197 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.200 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.214 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.228 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.211.247 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.214.144 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.214.160 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.214.200 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.214.42 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.215.101 any $HOME_NET any (msg:"adzerk.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.215.107 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 72.21.215.133 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.215.197 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.21.215.90 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;) alert tcp 72.232.101.40 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.232.101.41 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.232.101.42 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.232.101.43 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.232.153.251 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.232.153.253 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.232.247.106 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 72.232.6.21 any $HOME_NET any (msg:"advertisingbox.com"; classtype:trojan-activity; priority:1;) alert tcp 72.233.104.123 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.233.107.124 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 72.233.107.125 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 72.233.111.159 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.233.119.199 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.233.127.217 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.233.24.22 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 72.233.24.24 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;) alert tcp 72.249.61.70 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 72.251.206.98 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 72.3.139.203 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 72.3.221.161 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;) alert tcp 72.3.221.162 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;) alert tcp 72.3.232.32 any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;) alert tcp 72.30.190.80 any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity; priority:1;) alert tcp 72.30.33.199 any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity; priority:1;) alert tcp 72.32.102.179 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;) alert tcp 72.32.120.19 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 72.32.153.180 any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;) alert tcp 72.32.167.183 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;) alert tcp 72.32.168.198 any $HOME_NET any (msg:"crwdcntrl.net"; classtype:trojan-activity; priority:1;) alert tcp 72.32.185.150 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;) alert tcp 72.32.2.231 any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;) alert tcp 72.32.22.216 any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;) alert tcp 72.32.242.253 any $HOME_NET any (msg:"srwww1.com"; classtype:trojan-activity; priority:1;) alert tcp 72.32.47.229 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;) alert tcp 72.34.50.138 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 72.34.56.26 any $HOME_NET any (msg:"performancing.com"; classtype:trojan-activity; priority:1;) alert tcp 72.34.57.44 any $HOME_NET any (msg:"performancing.com"; classtype:trojan-activity; priority:1;) alert tcp 72.34.57.49 any $HOME_NET any (msg:"performancing.com"; classtype:trojan-activity; priority:1;) alert tcp 72.35.236.76 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 72.35.236.77 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 72.35.236.83 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 72.35.236.92 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;) alert tcp 72.36.147.46 any $HOME_NET any (msg:"www.photo-ads.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 72.36.166.222 any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;) alert tcp 72.36.210.242 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;) alert tcp 72.37.157.36 any $HOME_NET any (msg:"rightmedia.net"; classtype:trojan-activity; priority:1;) alert tcp 72.44.46.155 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;) alert tcp 72.44.58.57 any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;) alert tcp 72.44.67.7 any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;) alert tcp 72.44.67.8 any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;) alert tcp 72.47.214.97 any $HOME_NET any (msg:"visualrevenue.com"; classtype:trojan-activity; priority:1;) alert tcp 72.47.255.39 any $HOME_NET any (msg:"yoggrt.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.124.59 any $HOME_NET any (msg:"ads.sun.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.164.100 any $HOME_NET any (msg:"iwin.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.169.70 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;) alert tcp 72.5.169.8 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;) alert tcp 72.5.175.89 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.175.90 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.175.97 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.240.101 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.240.201 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.62.8 any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;) alert tcp 72.5.63.139 any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;) alert tcp 72.51.27.51 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 72.51.27.60 any $HOME_NET any (msg:"exit76.com"; classtype:trojan-activity; priority:1;) alert tcp 72.51.33.79 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;) alert tcp 72.51.43.164 any $HOME_NET any (msg:"robotreplay.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.147.186 any $HOME_NET any (msg:"bluewhaleweb.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.164.45 any $HOME_NET any (msg:"cashcrate.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.175.114 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;) alert tcp 72.52.178.205 any $HOME_NET any (msg:"adcash.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.178.206 any $HOME_NET any (msg:"adcash.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.201.190 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.210.12 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;) alert tcp 72.52.210.200 any $HOME_NET any (msg:"wlmarketing.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.210.216 any $HOME_NET any (msg:"wlmarketing.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.210.65 any $HOME_NET any (msg:"wlmarketing.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.240.152 any $HOME_NET any (msg:"prchecker.info"; classtype:trojan-activity; priority:1;) alert tcp 72.52.253.146 any $HOME_NET any (msg:"infiniteadds.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.4.244 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 72.52.4.245 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 72.52.4.90 any $HOME_NET any (msg:"therapistla.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.5.29 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;) alert tcp 72.52.7.87 any $HOME_NET any (msg:"ads.themovienation.com"; classtype:trojan-activity; priority:1;) alert tcp 72.55.137.10 any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;) alert tcp 72.55.137.14 any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;) alert tcp 72.8.141.90 any $HOME_NET any (msg:"directaclick.com"; classtype:trojan-activity; priority:1;) alert tcp 72.8.167.249 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 72.9.145.149 any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;) alert tcp 74.114.28.100 any $HOME_NET any (msg:"mmismm.com"; classtype:trojan-activity; priority:1;) alert tcp 74.114.88.120 any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;) alert tcp 74.115.0.34 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.0.35 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.0.51 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.0.7 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.1.10 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.1.11 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.1.12 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.1.13 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.6.10 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.6.11 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.6.56 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.115.6.57 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.117.116.81 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;) alert tcp 74.117.116.82 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;) alert tcp 74.117.116.98 any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;) alert tcp 74.117.221.11 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 74.117.221.204 any $HOME_NET any (msg:"mypowermall.com"; classtype:trojan-activity; priority:1;) alert tcp 74.117.221.21 any $HOME_NET any (msg:"mypowermall.com"; classtype:trojan-activity; priority:1;) alert tcp 74.120.142.177 any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;) alert tcp 74.120.188.125 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 74.120.188.5 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 74.120.189.21 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;) alert tcp 74.121.132.128 any $HOME_NET any (msg:"coremetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 74.121.28.139 any $HOME_NET any (msg:"iesnare.com"; classtype:trojan-activity; priority:1;) alert tcp 74.122.168.139 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;) alert tcp 74.123.6.41 any $HOME_NET any (msg:"affiliates.allposters.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.113.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.127.118 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.127.133 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.127.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.132 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.148 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.149 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.155 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.156 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.157 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.132.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.136.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.136.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.136.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.136.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.136.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.136.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.138.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.138.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.138.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.138.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.138.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.138.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.159.118 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.159.133 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.195.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.105 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.106 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.107 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.108 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.109 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.110 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.111 any $HOME_NET any (msg:"doubleclick.de"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.112 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.113 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.114 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.115 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.116 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.121 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.122 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.123 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.124 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.128 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.129 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.130 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.131 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.132 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.133 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.134 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.135 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.136 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.137 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.138 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.139 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.140 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.141 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.142 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.143 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.153 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.155 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.156 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.96 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.97 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.98 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.230.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.32 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.33 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.34 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.35 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.36 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.37 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.38 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.39 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.40 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.41 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.239.46 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.24.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.24.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.24.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.24.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.24.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.24.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.39.100 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.39.101 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.39.102 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.39.113 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.39.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.39.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.39.138 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.39.139 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.43.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.43.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.43.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.43.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.43.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.43.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.43.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.45.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.45.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.45.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.45.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.45.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.47.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.47.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.47.118 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.47.133 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.47.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.47.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.77.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.79.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.79.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.79.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.79.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.79.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.79.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.79.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.125.79.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;) alert tcp 74.143.65.80 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 74.143.65.83 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.241.122 any $HOME_NET any (msg:"malwaredomainlist.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.243.251 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.243.253 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.244.59 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.244.61 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.246.110 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.247.187 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.247.59 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 74.200.247.61 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 74.201.86.229 any $HOME_NET any (msg:"adap.tv"; classtype:trojan-activity; priority:1;) alert tcp 74.205.85.46 any $HOME_NET any (msg:"blogherads.com"; classtype:trojan-activity; priority:1;) alert tcp 74.205.94.96 any $HOME_NET any (msg:"demandbase.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.114.73 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.125.247 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.13.137 any $HOME_NET any (msg:"adapt.tv"; classtype:trojan-activity; priority:1;) alert tcp 74.208.15.2 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.170.185 any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.185.83 any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.213.135 any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.45.212 any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.7.95 any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;) alert tcp 74.208.9.95 any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;) alert tcp 74.213.176.3 any $HOME_NET any (msg:"affiliates.ultrahosting.com"; classtype:trojan-activity; priority:1;) alert tcp 74.217.185.35 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;) alert tcp 74.217.185.60 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;) alert tcp 74.217.185.64 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;) alert tcp 74.217.50.11 any $HOME_NET any (msg:"mmismm.com"; classtype:trojan-activity; priority:1;) alert tcp 74.217.78.151 any $HOME_NET any (msg:"adap.tv"; classtype:trojan-activity; priority:1;) alert tcp 74.217.78.165 any $HOME_NET any (msg:"adap.tv"; classtype:trojan-activity; priority:1;) alert tcp 74.217.85.23 any $HOME_NET any (msg:"crwdcntrl.net"; classtype:trojan-activity; priority:1;) alert tcp 74.217.85.27 any $HOME_NET any (msg:"crwdcntrl.net"; classtype:trojan-activity; priority:1;) alert tcp 74.50.119.95 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 74.50.119.96 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 74.50.119.97 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 74.50.119.98 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 74.50.119.99 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 74.50.120.166 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 74.52.103.148 any $HOME_NET any (msg:"funklicks.com"; classtype:trojan-activity; priority:1;) alert tcp 74.52.160.50 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 74.52.185.18 any $HOME_NET any (msg:"srwww1.com"; classtype:trojan-activity; priority:1;) alert tcp 74.52.2.109 any $HOME_NET any (msg:"srwww1.com"; classtype:trojan-activity; priority:1;) alert tcp 74.52.250.82 any $HOME_NET any (msg:"malwaredomainlist.com"; classtype:trojan-activity; priority:1;) alert tcp 74.53.105.186 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;) alert tcp 74.53.160.18 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;) alert tcp 74.53.180.8 any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;) alert tcp 74.53.21.34 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;) alert tcp 74.53.47.157 any $HOME_NET any (msg:"amazingcounters.com"; classtype:trojan-activity; priority:1;) alert tcp 74.54.152.18 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;) alert tcp 74.54.156.143 any $HOME_NET any (msg:"directaclick.com"; classtype:trojan-activity; priority:1;) alert tcp 74.54.162.54 any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;) alert tcp 74.54.183.210 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 74.54.202.34 any $HOME_NET any (msg:"topsite.lv"; classtype:trojan-activity; priority:1;) alert tcp 74.54.27.178 any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;) alert tcp 74.54.77.23 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;) alert tcp 74.54.82.224 any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 74.54.86.200 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;) alert tcp 74.55.114.194 any $HOME_NET any (msg:"blogtoplist.se"; classtype:trojan-activity; priority:1;) alert tcp 74.55.126.82 any $HOME_NET any (msg:"topmmorpgsites.com"; classtype:trojan-activity; priority:1;) alert tcp 74.55.201.106 any $HOME_NET any (msg:"malwaredomainlist.com"; classtype:trojan-activity; priority:1;) alert tcp 74.55.34.178 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;) alert tcp 74.55.37.226 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;) alert tcp 74.6.155.203 any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;) alert tcp 74.63.153.32 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 74.63.153.33 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 74.63.153.58 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;) alert tcp 74.63.153.59 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;) alert tcp 74.63.153.98 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;) alert tcp 74.63.153.99 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;) alert tcp 74.63.51.103 any $HOME_NET any (msg:"projectwonderful.com"; classtype:trojan-activity; priority:1;) alert tcp 74.80.208.56 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;) alert tcp 74.81.90.69 any $HOME_NET any (msg:"relmaxtop.com"; classtype:trojan-activity; priority:1;) alert tcp 74.84.198.230 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;) alert tcp 74.84.198.231 any $HOME_NET any (msg:"ads.oneplace.com"; classtype:trojan-activity; priority:1;) alert tcp 74.84.206.120 any $HOME_NET any (msg:"ads.oneplace.com"; classtype:trojan-activity; priority:1;) alert tcp 74.85.13.4 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 74.85.13.40 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 74.85.13.41 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 74.85.13.55 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;) alert tcp 74.85.13.6 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.126.154 any $HOME_NET any (msg:"net-filter.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.126.155 any $HOME_NET any (msg:"net-filter.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.126.226 any $HOME_NET any (msg:"clickbrokers.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.15.194 any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.197.160 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.197.161 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.197.162 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.202.236 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.232.128 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.24.240 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 74.86.43.42 any $HOME_NET any (msg:"game-advertising-online.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.45.187 any $HOME_NET any (msg:"game-advertising-online.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.70.106 any $HOME_NET any (msg:"stats.olark.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.70.107 any $HOME_NET any (msg:"stats.olark.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.71.99 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 74.86.72.250 any $HOME_NET any (msg:"adspeed.net"; classtype:trojan-activity; priority:1;) alert tcp 74.86.95.180 any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.131.215 any $HOME_NET any (msg:"mobclix.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.132.151 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.135.45 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.137.166 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.139.199 any $HOME_NET any (msg:"dapper.net"; classtype:trojan-activity; priority:1;) alert tcp 75.101.140.131 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.141.174 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.142.70 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.143.85 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.147.242 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.153.250 any $HOME_NET any (msg:"lookery.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.153.39 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.155.68 any $HOME_NET any (msg:"cashcrate.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.158.158 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.159.219 any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.162.167 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.163.223 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.214.137 any $HOME_NET any (msg:"lookery.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.215.224 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;) alert tcp 75.101.220.137 any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.115.194 any $HOME_NET any (msg:"ads2.net-communities.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 75.125.118.171 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.118.172 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.118.184 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.118.223 any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.118.232 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.118.233 any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.131.242 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 75.125.141.210 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 75.125.17.146 any $HOME_NET any (msg:"top-site-list.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.186.242 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;) alert tcp 75.125.214.11 any $HOME_NET any (msg:"liveintent.com"; classtype:trojan-activity; priority:1;) alert tcp 75.125.79.162 any $HOME_NET any (msg:"toplistcity.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.116.90 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.117.200 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.118.48 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.140.206 any $HOME_NET any (msg:"crawlability.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.144.212 any $HOME_NET any (msg:"mypagerank.net"; classtype:trojan-activity; priority:1;) alert tcp 75.126.144.222 any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.17.155 any $HOME_NET any (msg:"game-advertising-online.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.175.248 any $HOME_NET any (msg:"game-advertising-online.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.194.11 any $HOME_NET any (msg:"toplistcity.com"; classtype:trojan-activity; priority:1;) alert tcp 75.126.205.116 any $HOME_NET any (msg:"mypagerank.net"; classtype:trojan-activity; priority:1;) alert tcp 75.126.205.117 any $HOME_NET any (msg:"mypagerank.net"; classtype:trojan-activity; priority:1;) alert tcp 75.126.205.118 any $HOME_NET any (msg:"mypagerank.net"; classtype:trojan-activity; priority:1;) alert tcp 75.126.205.119 any $HOME_NET any (msg:"mypagerank.net"; classtype:trojan-activity; priority:1;) alert tcp 75.126.228.154 any $HOME_NET any (msg:"www.photo-ads.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 75.126.63.4 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;) alert tcp 75.160.72.234 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 75.98.46.13 any $HOME_NET any (msg:"ru4.com"; classtype:trojan-activity; priority:1;) alert tcp 75.98.46.16 any $HOME_NET any (msg:"xplusone.com"; classtype:trojan-activity; priority:1;) alert tcp 76.10.133.26 any $HOME_NET any (msg:"reduxmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 76.12.128.182 any $HOME_NET any (msg:"conversionruler.com"; classtype:trojan-activity; priority:1;) alert tcp 76.12.19.106 any $HOME_NET any (msg:"conversionruler.com"; classtype:trojan-activity; priority:1;) alert tcp 76.12.58.244 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;) alert tcp 76.12.8.120 any $HOME_NET any (msg:"conversionruler.com"; classtype:trojan-activity; priority:1;) alert tcp 76.13.23.51 any $HOME_NET any (msg:"adrevolver.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.158.7 any $HOME_NET any (msg:"gvisit.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.166.176 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.193.182 any $HOME_NET any (msg:"craktraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.193.188 any $HOME_NET any (msg:"ads.crakmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.248.163 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.254.120 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.254.121 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.255.117 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.255.123 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 76.74.255.125 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;) alert tcp 76.76.13.107 any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;) alert tcp 76.76.5.253 any $HOME_NET any (msg:"ads.kaktuz.net"; classtype:trojan-activity; priority:1;) alert tcp 76.9.26.12 any $HOME_NET any (msg:"ads.program3.com"; classtype:trojan-activity; priority:1;) alert tcp 76.9.29.126 any $HOME_NET any (msg:"newads.bangbros.com"; classtype:trojan-activity; priority:1;) alert tcp 76.9.3.73 any $HOME_NET any (msg:"sexcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 76.9.5.212 any $HOME_NET any (msg:"ads.crakmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 76.9.5.62 any $HOME_NET any (msg:"ads180.com"; classtype:trojan-activity; priority:1;) alert tcp 77.105.208.113 any $HOME_NET any (msg:"ads.nordichardware.se"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.139 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.152 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.153 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.161 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.162 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.168 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.169 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.176 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.185 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.192 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.193 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.195 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 77.109.169.200 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 77.222.40.116 any $HOME_NET any (msg:"counter.mojgorod.ru"; classtype:trojan-activity; priority:1;) alert tcp 77.222.40.57 any $HOME_NET any (msg:"counter.mojgorod.ru"; classtype:trojan-activity; priority:1;) alert tcp 77.222.56.18 any $HOME_NET any (msg:"counter.mojgorod.ru"; classtype:trojan-activity; priority:1;) alert tcp 77.222.56.80 any $HOME_NET any (msg:"counter.mojgorod.ru"; classtype:trojan-activity; priority:1;) alert tcp 77.232.66.26 any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;) alert tcp 77.232.81.27 any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;) alert tcp 77.238.178.122 any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;) alert tcp 77.238.187.39 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 77.238.187.43 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 77.244.243.43 any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;) alert tcp 77.247.176.12 any $HOME_NET any (msg:"targetpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 77.247.176.198 any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;) alert tcp 77.247.177.10 any $HOME_NET any (msg:"targetpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 77.247.178.171 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 77.247.178.206 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 77.247.178.22 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 77.247.178.23 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 77.247.178.24 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 77.247.178.25 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 77.247.178.26 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 77.247.178.35 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 77.67.102.156 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;) alert tcp 77.67.102.251 any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;) alert tcp 77.67.112.22 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 77.67.3.149 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 77.67.3.150 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 77.67.3.155 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 77.67.3.165 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 77.67.3.166 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 77.67.44.20 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 77.75.249.49 any $HOME_NET any (msg:"mediascale.de"; classtype:trojan-activity; priority:1;) alert tcp 77.88.21.190 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 77.88.21.90 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 77.91.231.150 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 77.91.231.151 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 77.91.248.30 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.248.32 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.248.37 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.248.50 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.248.51 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.249.30 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.249.32 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.249.37 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.249.50 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.249.51 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.251.10 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.251.11 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.252.10 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.91.252.11 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.92.72.230 any $HOME_NET any (msg:"zencudo.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 77.93.216.135 any $HOME_NET any (msg:"netagent.cz"; classtype:trojan-activity; priority:1;) alert tcp 77.93.221.45 any $HOME_NET any (msg:"imprese.cz"; classtype:trojan-activity; priority:1;) alert tcp 77.95.133.6 any $HOME_NET any (msg:"ads.adfox.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.108.80.3 any $HOME_NET any (msg:"cnt.spbland.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.108.86.2 any $HOME_NET any (msg:"cnt.spbland.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.108.86.3 any $HOME_NET any (msg:"cnt.spbland.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.109.91.17 any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;) alert tcp 78.110.17.130 any $HOME_NET any (msg:"scratch2cash.com"; classtype:trojan-activity; priority:1;) alert tcp 78.129.205.10 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 78.129.205.126 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 78.129.205.4 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 78.129.244.78 any $HOME_NET any (msg:"totemcash.com"; classtype:trojan-activity; priority:1;) alert tcp 78.129.244.79 any $HOME_NET any (msg:"totemcash.com"; classtype:trojan-activity; priority:1;) alert tcp 78.136.25.240 any $HOME_NET any (msg:"adjug.com"; classtype:trojan-activity; priority:1;) alert tcp 78.137.164.92 any $HOME_NET any (msg:"adforce.com"; classtype:trojan-activity; priority:1;) alert tcp 78.140.130.29 any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;) alert tcp 78.140.132.26 any $HOME_NET any (msg:"onclickads.net"; classtype:trojan-activity; priority:1;) alert tcp 78.140.138.132 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.138.133 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.138.147 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.142.173 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.142.174 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.142.178 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.142.183 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.142.186 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.143.6 any $HOME_NET any (msg:"onclickads.net"; classtype:trojan-activity; priority:1;) alert tcp 78.140.146.169 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.140.160.7 any $HOME_NET any (msg:"banners.babylon-x.com"; classtype:trojan-activity; priority:1;) alert tcp 78.140.173.200 any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;) alert tcp 78.143.58.70 any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;) alert tcp 78.143.58.73 any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;) alert tcp 78.143.58.78 any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;) alert tcp 78.153.217.203 any $HOME_NET any (msg:"adforce.com"; classtype:trojan-activity; priority:1;) alert tcp 78.159.102.207 any $HOME_NET any (msg:"linktarget.com"; classtype:trojan-activity; priority:1;) alert tcp 78.159.111.111 any $HOME_NET any (msg:"adonspot.com"; classtype:trojan-activity; priority:1;) alert tcp 78.24.10.218 any $HOME_NET any (msg:"netagent.cz"; classtype:trojan-activity; priority:1;) alert tcp 78.31.105.131 any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;) alert tcp 78.40.200.209 any $HOME_NET any (msg:"ilbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 78.46.100.179 any $HOME_NET any (msg:"rankingchart.de"; classtype:trojan-activity; priority:1;) alert tcp 78.46.122.140 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 78.46.154.33 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 78.46.154.38 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 78.46.249.125 any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 78.46.67.131 any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;) alert tcp 78.46.68.213 any $HOME_NET any (msg:"mypagerank.ru"; classtype:trojan-activity; priority:1;) alert tcp 78.46.69.205 any $HOME_NET any (msg:"pagerank-ranking.de"; classtype:trojan-activity; priority:1;) alert tcp 78.46.9.18 any $HOME_NET any (msg:"scripte-monster.de"; classtype:trojan-activity; priority:1;) alert tcp 78.46.91.10 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 78.47.133.245 any $HOME_NET any (msg:"ad-pay.de"; classtype:trojan-activity; priority:1;) alert tcp 78.47.187.116 any $HOME_NET any (msg:"witch-counter.de"; classtype:trojan-activity; priority:1;) alert tcp 78.47.20.108 any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;) alert tcp 78.47.220.194 any $HOME_NET any (msg:"adnews.maddog2000.de"; classtype:trojan-activity; priority:1;) alert tcp 78.47.254.190 any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;) alert tcp 78.47.28.193 any $HOME_NET any (msg:"link-booster.de"; classtype:trojan-activity; priority:1;) alert tcp 78.47.96.186 any $HOME_NET any (msg:"i1media.no"; classtype:trojan-activity; priority:1;) alert tcp 79.110.87.201 any $HOME_NET any (msg:"ad2games.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.104.121 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.105.103 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.108.159 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.108.183 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.108.184 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.109.94 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.110.124 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.114.99 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.117.50 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.118.64 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.123.246 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.123.31 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.123.32 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.126.60 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.126.61 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.126.66 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.14.102 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.15.132 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.16.153 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.18.180 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.19.227 any $HOME_NET any (msg:"mediaz.angloinfo.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.19.34 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.19.77 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.20.149 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.22.122 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.22.135 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.22.239 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.22.77 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.22.87 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.23.75 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.25.6 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.3.230 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.41.136 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.125.43.74 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;) alert tcp 79.136.112.202 any $HOME_NET any (msg:"tailsweep.se"; classtype:trojan-activity; priority:1;) alert tcp 79.136.112.203 any $HOME_NET any (msg:"tailsweep.se"; classtype:trojan-activity; priority:1;) alert tcp 79.136.112.39 any $HOME_NET any (msg:"webtraffic.se"; classtype:trojan-activity; priority:1;) alert tcp 79.140.142.22 any $HOME_NET any (msg:"adforce.com"; classtype:trojan-activity; priority:1;) alert tcp 79.96.1.253 any $HOME_NET any (msg:"novem.pl"; classtype:trojan-activity; priority:1;) alert tcp 79.98.104.10 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;) alert tcp 79.98.108.133 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;) alert tcp 79.98.108.137 any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 8.10.73.51 any $HOME_NET any (msg:"openads.org"; classtype:trojan-activity; priority:1;) alert tcp 8.10.77.142 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;) alert tcp 8.12.137.158 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 8.12.137.174 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 8.12.137.29 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 8.12.199.124 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 8.12.199.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 8.12.205.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 8.12.211.124 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 8.12.211.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 8.15.14.42 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.108 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.115 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.116 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.117 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.118 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.127 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.128 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.131 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.132 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.19 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.219 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.84 any $HOME_NET any (msg:"nuseek.com"; classtype:trojan-activity; priority:1;) alert tcp 8.15.231.96 any $HOME_NET any (msg:"onlinecash.com"; classtype:trojan-activity; priority:1;) alert tcp 8.19.10.2 any $HOME_NET any (msg:"advertise.com"; classtype:trojan-activity; priority:1;) alert tcp 8.19.18.80 any $HOME_NET any (msg:"exelator.com"; classtype:trojan-activity; priority:1;) alert tcp 8.21.32.181 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;) alert tcp 8.21.32.252 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;) alert tcp 8.22.226.85 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;) alert tcp 8.254.118.254 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 8.254.119.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 8.254.71.253 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 8.254.72.126 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 8.254.72.254 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 8.26.222.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 8.26.223.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;) alert tcp 8.26.223.254 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 8.26.70.7 any $HOME_NET any (msg:"advertise.com"; classtype:trojan-activity; priority:1;) alert tcp 8.27.0.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 8.27.2.253 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 8.27.3.253 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 8.27.3.254 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 8.27.4.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 8.27.4.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 8.27.5.254 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 8.27.6.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 8.27.6.254 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 8.27.7.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;) alert tcp 8.3.10.180 any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;) alert tcp 8.30.244.16 any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.0.129 any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.0.168 any $HOME_NET any (msg:"ads7.gamecity.net"; classtype:trojan-activity; priority:1;) alert tcp 8.5.0.181 any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.14 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.180 any $HOME_NET any (msg:"nuseek.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.32 any $HOME_NET any (msg:"eadexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.37 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.39 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.40 any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.43 any $HOME_NET any (msg:"adforce.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.45 any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;) alert tcp 8.5.1.51 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 80.118.149.10 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 80.118.149.17 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 80.118.149.20 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 80.118.149.24 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 80.118.149.30 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;) alert tcp 80.15.238.102 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 80.15.238.13 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 80.15.238.14 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 80.154.38.204 any $HOME_NET any (msg:"adnews.maddog2000.de"; classtype:trojan-activity; priority:1;) alert tcp 80.175.28.131 any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;) alert tcp 80.190.194.111 any $HOME_NET any (msg:"cash4popup.de"; classtype:trojan-activity; priority:1;) alert tcp 80.190.200.242 any $HOME_NET any (msg:"jinkads.de"; classtype:trojan-activity; priority:1;) alert tcp 80.190.200.243 any $HOME_NET any (msg:"jinkads.de"; classtype:trojan-activity; priority:1;) alert tcp 80.190.227.20 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 80.190.228.10 any $HOME_NET any (msg:"bannerads.de"; classtype:trojan-activity; priority:1;) alert tcp 80.197.136.27 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;) alert tcp 80.231.198.82 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.231.198.83 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.231.198.84 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.231.198.85 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.237.130.40 any $HOME_NET any (msg:"eusta.de"; classtype:trojan-activity; priority:1;) alert tcp 80.237.133.66 any $HOME_NET any (msg:"180hits.de"; classtype:trojan-activity; priority:1;) alert tcp 80.237.156.78 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;) alert tcp 80.237.180.36 any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;) alert tcp 80.237.198.202 any $HOME_NET any (msg:"ligatus.com"; classtype:trojan-activity; priority:1;) alert tcp 80.237.198.212 any $HOME_NET any (msg:"ligatus.de"; classtype:trojan-activity; priority:1;) alert tcp 80.237.211.63 any $HOME_NET any (msg:"fc.webmasterpro.de"; classtype:trojan-activity; priority:1;) alert tcp 80.237.212.87 any $HOME_NET any (msg:"max.i12.de"; classtype:trojan-activity; priority:1;) alert tcp 80.237.216.81 any $HOME_NET any (msg:"adnews.maddog2000.de"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.18 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.19 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.20 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.21 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.41 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.42 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.43 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.44 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.45 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.46 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.47 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.48 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.49 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.50 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.51 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.52 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.53 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.54 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.55 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.56 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.57 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.58 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.59 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.175.60 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 80.239.201.24 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 80.239.201.64 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 80.239.207.38 any $HOME_NET any (msg:"annonser.dagbladet.no"; classtype:trojan-activity; priority:1;) alert tcp 80.244.162.32 any $HOME_NET any (msg:"ads.internic.co.il"; classtype:trojan-activity; priority:1;) alert tcp 80.245.197.244 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;) alert tcp 80.245.197.245 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;) alert tcp 80.245.40.16 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 80.248.218.154 any $HOME_NET any (msg:"provexia.com"; classtype:trojan-activity; priority:1;) alert tcp 80.249.168.110 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;) alert tcp 80.249.171.156 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;) alert tcp 80.250.10.23 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 80.250.189.12 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 80.250.189.18 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 80.250.189.27 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 80.253.103.133 any $HOME_NET any (msg:"affiliatefuture.com"; classtype:trojan-activity; priority:1;) alert tcp 80.253.99.23 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 80.253.99.236 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;) alert tcp 80.48.15.200 any $HOME_NET any (msg:"stat.pl"; classtype:trojan-activity; priority:1;) alert tcp 80.48.15.236 any $HOME_NET any (msg:"stat.pl"; classtype:trojan-activity; priority:1;) alert tcp 80.48.16.117 any $HOME_NET any (msg:"stat.pl"; classtype:trojan-activity; priority:1;) alert tcp 80.48.16.144 any $HOME_NET any (msg:"adocean.pl"; classtype:trojan-activity; priority:1;) alert tcp 80.48.16.148 any $HOME_NET any (msg:"adocean.pl"; classtype:trojan-activity; priority:1;) alert tcp 80.48.16.81 any $HOME_NET any (msg:"stat.pl"; classtype:trojan-activity; priority:1;) alert tcp 80.63.9.153 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;) alert tcp 80.67.16.221 any $HOME_NET any (msg:"ad.domainfactory.de"; classtype:trojan-activity; priority:1;) alert tcp 80.67.22.224 any $HOME_NET any (msg:"mr-rank.de"; classtype:trojan-activity; priority:1;) alert tcp 80.67.23.81 any $HOME_NET any (msg:"ads.medienhaus.de"; classtype:trojan-activity; priority:1;) alert tcp 80.67.24.58 any $HOME_NET any (msg:"auto-bannertausch.de"; classtype:trojan-activity; priority:1;) alert tcp 80.67.81.14 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 80.67.81.15 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 80.67.81.22 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 80.67.81.23 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 80.67.81.31 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 80.67.81.33 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 80.67.81.9 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 80.67.87.113 any $HOME_NET any (msg:"ads.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 80.67.87.30 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 80.67.87.63 any $HOME_NET any (msg:"ads.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 80.67.87.9 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 80.68.240.57 any $HOME_NET any (msg:"banner.rbc.ru"; classtype:trojan-activity; priority:1;) alert tcp 80.68.242.108 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 80.68.246.95 any $HOME_NET any (msg:"banner.rbc.ru"; classtype:trojan-activity; priority:1;) alert tcp 80.69.224.204 any $HOME_NET any (msg:"ad-server.gulasidorna.se"; classtype:trojan-activity; priority:1;) alert tcp 80.69.72.29 any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;) alert tcp 80.69.83.183 any $HOME_NET any (msg:"checkstat.nl"; classtype:trojan-activity; priority:1;) alert tcp 80.69.84.4 any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;) alert tcp 80.70.213.164 any $HOME_NET any (msg:"e-m.fr"; classtype:trojan-activity; priority:1;) alert tcp 80.70.219.16 any $HOME_NET any (msg:"e-m.fr"; classtype:trojan-activity; priority:1;) alert tcp 80.76.145.10 any $HOME_NET any (msg:"adtoma.com"; classtype:trojan-activity; priority:1;) alert tcp 80.76.145.58 any $HOME_NET any (msg:"ricollect.research-int.se"; classtype:trojan-activity; priority:1;) alert tcp 80.76.154.22 any $HOME_NET any (msg:"adtoma.com"; classtype:trojan-activity; priority:1;) alert tcp 80.77.113.25 any $HOME_NET any (msg:"awempire.com"; classtype:trojan-activity; priority:1;) alert tcp 80.77.126.98 any $HOME_NET any (msg:"awempire.com"; classtype:trojan-activity; priority:1;) alert tcp 80.79.200.21 any $HOME_NET any (msg:"adremedy.com"; classtype:trojan-activity; priority:1;) alert tcp 80.79.25.80 any $HOME_NET any (msg:"adv.yo.cz"; classtype:trojan-activity; priority:1;) alert tcp 80.81.255.178 any $HOME_NET any (msg:"ad.profiwin.de"; classtype:trojan-activity; priority:1;) alert tcp 80.81.255.179 any $HOME_NET any (msg:"ad.profiwin.de"; classtype:trojan-activity; priority:1;) alert tcp 80.81.255.181 any $HOME_NET any (msg:"ad.profiwin.de"; classtype:trojan-activity; priority:1;) alert tcp 80.81.255.182 any $HOME_NET any (msg:"ad.profiwin.de"; classtype:trojan-activity; priority:1;) alert tcp 80.81.255.183 any $HOME_NET any (msg:"ad.profiwin.de"; classtype:trojan-activity; priority:1;) alert tcp 80.82.215.175 any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;) alert tcp 80.83.113.140 any $HOME_NET any (msg:"auto-bannertausch.de"; classtype:trojan-activity; priority:1;) alert tcp 80.83.180.19 any $HOME_NET any (msg:"interreklame.de"; classtype:trojan-activity; priority:1;) alert tcp 80.86.107.30 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 80.86.107.88 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;) alert tcp 80.86.167.148 any $HOME_NET any (msg:"adcell.de"; classtype:trojan-activity; priority:1;) alert tcp 80.86.167.160 any $HOME_NET any (msg:"adcell.de"; classtype:trojan-activity; priority:1;) alert tcp 80.86.184.242 any $HOME_NET any (msg:"superclix.de"; classtype:trojan-activity; priority:1;) alert tcp 80.86.80.187 any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;) alert tcp 80.86.83.144 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;) alert tcp 80.89.112.200 any $HOME_NET any (msg:"banners.direction-x.com"; classtype:trojan-activity; priority:1;) alert tcp 80.89.112.201 any $HOME_NET any (msg:"e-m.fr"; classtype:trojan-activity; priority:1;) alert tcp 80.89.125.16 any $HOME_NET any (msg:"banners.direction-x.com"; classtype:trojan-activity; priority:1;) alert tcp 80.89.125.30 any $HOME_NET any (msg:"banners.direction-x.com"; classtype:trojan-activity; priority:1;) alert tcp 80.91.35.136 any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;) alert tcp 80.91.35.196 any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;) alert tcp 80.92.75.20 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 80.93.58.59 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 80.93.59.105 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 80.94.69.40 any $HOME_NET any (msg:"adperium.com"; classtype:trojan-activity; priority:1;) alert tcp 80.94.76.4 any $HOME_NET any (msg:"adperium.com"; classtype:trojan-activity; priority:1;) alert tcp 80.95.101.195 any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;) alert tcp 80.95.101.235 any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;) alert tcp 80.95.108.162 any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.0.231.49 any $HOME_NET any (msg:"webcounter.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.0.232.65 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.0.239.181 any $HOME_NET any (msg:"ad.cgi.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.0.254.182 any $HOME_NET any (msg:"itop.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.145.143.129 any $HOME_NET any (msg:"ads.jobsite.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 81.145.44.52 any $HOME_NET any (msg:"debtbusterloans.com"; classtype:trojan-activity; priority:1;) alert tcp 81.145.59.69 any $HOME_NET any (msg:"debtbusterloans.com"; classtype:trojan-activity; priority:1;) alert tcp 81.169.130.31 any $HOME_NET any (msg:"megawerbung.de"; classtype:trojan-activity; priority:1;) alert tcp 81.169.135.173 any $HOME_NET any (msg:"ranking-hits.de"; classtype:trojan-activity; priority:1;) alert tcp 81.169.145.75 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;) alert tcp 81.169.162.35 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;) alert tcp 81.169.238.21 any $HOME_NET any (msg:"express-submit.de"; classtype:trojan-activity; priority:1;) alert tcp 81.17.240.200 any $HOME_NET any (msg:"adserver.irishwebmasterforum.com"; classtype:trojan-activity; priority:1;) alert tcp 81.17.242.28 any $HOME_NET any (msg:"adserver.irishwebmasterforum.com"; classtype:trojan-activity; priority:1;) alert tcp 81.176.228.115 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.228.22 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.228.43 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.228.51 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.228.52 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.228.66 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.230.150 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.230.175 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.230.178 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.67.69 any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;) alert tcp 81.176.69.195 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.176.69.222 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.177.7.6 any $HOME_NET any (msg:"ads.adfox.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.18.240.137 any $HOME_NET any (msg:"onestat.com"; classtype:trojan-activity; priority:1;) alert tcp 81.18.240.139 any $HOME_NET any (msg:"stats4all.com"; classtype:trojan-activity; priority:1;) alert tcp 81.18.240.169 any $HOME_NET any (msg:"onestat.com"; classtype:trojan-activity; priority:1;) alert tcp 81.19.238.61 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;) alert tcp 81.19.239.230 any $HOME_NET any (msg:"chart.dk"; classtype:trojan-activity; priority:1;) alert tcp 81.19.48.74 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 81.19.66.149 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.66.19 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.66.238 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.66.32 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.66.35 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.66.97 any $HOME_NET any (msg:"top100-images.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.70.13 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.70.8 any $HOME_NET any (msg:"top100-images.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.88.102 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.88.103 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.88.106 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.88.108 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.88.80 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.88.81 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.88.95 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.19.88.96 any $HOME_NET any (msg:"counter.rambler.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.2.129.202 any $HOME_NET any (msg:"quarterserver.de"; classtype:trojan-activity; priority:1;) alert tcp 81.2.196.111 any $HOME_NET any (msg:"window.nixnet.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.2.196.119 any $HOME_NET any (msg:"cnt1.pocitadlo.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.2.196.210 any $HOME_NET any (msg:"cnt1.pocitadlo.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.2.196.211 any $HOME_NET any (msg:"cnt1.pocitadlo.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.2.196.212 any $HOME_NET any (msg:"cnt1.pocitadlo.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.2.196.222 any $HOME_NET any (msg:"window.nixnet.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.2.196.29 any $HOME_NET any (msg:"ireklama.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.2.196.76 any $HOME_NET any (msg:"ireklama.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.2.210.136 any $HOME_NET any (msg:"reklama.mironet.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.201.103.143 any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;) alert tcp 81.201.211.101 any $HOME_NET any (msg:"reklam.rfsl.se"; classtype:trojan-activity; priority:1;) alert tcp 81.201.211.104 any $HOME_NET any (msg:"reklam.rfsl.se"; classtype:trojan-activity; priority:1;) alert tcp 81.209.166.66 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 81.209.243.197 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;) alert tcp 81.22.32.106 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 81.222.128.98 any $HOME_NET any (msg:"rle.ru"; classtype:trojan-activity; priority:1;) alert tcp 81.26.166.13 any $HOME_NET any (msg:"ligatus.com"; classtype:trojan-activity; priority:1;) alert tcp 81.26.166.23 any $HOME_NET any (msg:"ligatus.de"; classtype:trojan-activity; priority:1;) alert tcp 81.27.197.73 any $HOME_NET any (msg:"ads.nyx.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.29.65.112 any $HOME_NET any (msg:"ads.allsites.com"; classtype:trojan-activity; priority:1;) alert tcp 81.29.66.29 any $HOME_NET any (msg:"ads.allsites.com"; classtype:trojan-activity; priority:1;) alert tcp 81.29.69.248 any $HOME_NET any (msg:"ads.allsites.com"; classtype:trojan-activity; priority:1;) alert tcp 81.3.37.221 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;) alert tcp 81.3.59.8 any $HOME_NET any (msg:"ads.krawall.de"; classtype:trojan-activity; priority:1;) alert tcp 81.31.32.113 any $HOME_NET any (msg:"add.newmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.47.113 any $HOME_NET any (msg:"ads.ferianc.com"; classtype:trojan-activity; priority:1;) alert tcp 81.31.5.14 any $HOME_NET any (msg:"ad3.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.5.15 any $HOME_NET any (msg:"navrcholu.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.5.33 any $HOME_NET any (msg:"ad.lupa.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.5.4 any $HOME_NET any (msg:"www.navrcholu.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.5.7 any $HOME_NET any (msg:"ad2.lupa.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.7.165 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.7.83 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.7.91 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.31.7.92 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.88.34.134 any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.35.194 any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.37.110 any $HOME_NET any (msg:"targad.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.39.1 any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.40.51 any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.40.52 any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.40.53 any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.40.56 any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.40.57 any $HOME_NET any (msg:"adsponse.de"; classtype:trojan-activity; priority:1;) alert tcp 81.88.48.82 any $HOME_NET any (msg:"banner.supereva.it"; classtype:trojan-activity; priority:1;) alert tcp 81.89.247.127 any $HOME_NET any (msg:"coupling-media.de"; classtype:trojan-activity; priority:1;) alert tcp 81.89.255.93 any $HOME_NET any (msg:"coupling-media.de"; classtype:trojan-activity; priority:1;) alert tcp 81.9.8.178 any $HOME_NET any (msg:"bridesservice.com"; classtype:trojan-activity; priority:1;) alert tcp 81.91.82.166 any $HOME_NET any (msg:"ad.grafika.cz"; classtype:trojan-activity; priority:1;) alert tcp 81.93.163.121 any $HOME_NET any (msg:"annonser.dagbladet.no"; classtype:trojan-activity; priority:1;) alert tcp 81.93.187.4 any $HOME_NET any (msg:"privatecash.com"; classtype:trojan-activity; priority:1;) alert tcp 81.95.0.38 any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;) alert tcp 81.95.6.29 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;) alert tcp 82.109.190.12 any $HOME_NET any (msg:"ad.digitallook.com"; classtype:trojan-activity; priority:1;) alert tcp 82.113.50.12 any $HOME_NET any (msg:"vrs.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.117.36.104 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 82.117.36.115 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 82.117.42.50 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 82.117.50.14 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 82.117.50.195 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 82.117.50.43 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;) alert tcp 82.118.193.195 any $HOME_NET any (msg:"snoobi.com"; classtype:trojan-activity; priority:1;) alert tcp 82.135.57.51 any $HOME_NET any (msg:"ad.nachtagenten.de"; classtype:trojan-activity; priority:1;) alert tcp 82.135.57.54 any $HOME_NET any (msg:"ad.nachtagenten.de"; classtype:trojan-activity; priority:1;) alert tcp 82.146.33.62 any $HOME_NET any (msg:"top.proext.com"; classtype:trojan-activity; priority:1;) alert tcp 82.149.225.18 any $HOME_NET any (msg:"ads.administrator.de"; classtype:trojan-activity; priority:1;) alert tcp 82.149.225.20 any $HOME_NET any (msg:"ads.administrator.de"; classtype:trojan-activity; priority:1;) alert tcp 82.149.225.22 any $HOME_NET any (msg:"ads.administrator.de"; classtype:trojan-activity; priority:1;) alert tcp 82.161.231.2 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;) alert tcp 82.165.108.236 any $HOME_NET any (msg:"clicktag.de"; classtype:trojan-activity; priority:1;) alert tcp 82.165.161.195 any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;) alert tcp 82.165.243.151 any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;) alert tcp 82.165.253.215 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;) alert tcp 82.165.52.27 any $HOME_NET any (msg:"interreklame.de"; classtype:trojan-activity; priority:1;) alert tcp 82.165.97.173 any $HOME_NET any (msg:"eusta.de"; classtype:trojan-activity; priority:1;) alert tcp 82.192.70.93 any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;) alert tcp 82.192.84.57 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 82.194.75.177 any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;) alert tcp 82.195.129.128 any $HOME_NET any (msg:"advertiseireland.com"; classtype:trojan-activity; priority:1;) alert tcp 82.199.129.10 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;) alert tcp 82.204.39.82 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;) alert tcp 82.206.0.48 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;) alert tcp 82.208.14.241 any $HOME_NET any (msg:"banner.inyourpocket.com"; classtype:trojan-activity; priority:1;) alert tcp 82.208.14.244 any $HOME_NET any (msg:"banner.inyourpocket.com"; classtype:trojan-activity; priority:1;) alert tcp 82.208.174.125 any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;) alert tcp 82.208.18.11 any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.25.3 any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.27.68 any $HOME_NET any (msg:"ads.ferianc.com"; classtype:trojan-activity; priority:1;) alert tcp 82.208.28.114 any $HOME_NET any (msg:"imprese.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.4.178 any $HOME_NET any (msg:"counter.cnw.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.4.55 any $HOME_NET any (msg:"bannery.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.4.94 any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.4.95 any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.50.140 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.50.150 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.208.9.87 any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;) alert tcp 82.211.108.10 any $HOME_NET any (msg:"ad.uk.tangozebra.com"; classtype:trojan-activity; priority:1;) alert tcp 82.211.108.11 any $HOME_NET any (msg:"tangozebra.com"; classtype:trojan-activity; priority:1;) alert tcp 82.211.108.15 any $HOME_NET any (msg:"ad.uk.tangozebra.com"; classtype:trojan-activity; priority:1;) alert tcp 82.211.108.33 any $HOME_NET any (msg:"tangozebra.com"; classtype:trojan-activity; priority:1;) alert tcp 82.211.108.34 any $HOME_NET any (msg:"tangozebra.com"; classtype:trojan-activity; priority:1;) alert tcp 82.211.108.9 any $HOME_NET any (msg:"ad.uk.tangozebra.com"; classtype:trojan-activity; priority:1;) alert tcp 82.221.96.221 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 82.80.196.113 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;) alert tcp 82.80.196.115 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;) alert tcp 82.80.215.71 any $HOME_NET any (msg:"adserver-pro.net"; classtype:trojan-activity; priority:1;) alert tcp 82.96.104.105 any $HOME_NET any (msg:"megawerbung.de"; classtype:trojan-activity; priority:1;) alert tcp 82.98.69.47 any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.161 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.169 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.170 any $HOME_NET any (msg:"therapistla.com"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.171 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.174 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.175 any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.176 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.179 any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.180 any $HOME_NET any (msg:"sedoparking.com"; classtype:trojan-activity; priority:1;) alert tcp 82.98.86.183 any $HOME_NET any (msg:"revenuedirect.com"; classtype:trojan-activity; priority:1;) alert tcp 83.125.73.215 any $HOME_NET any (msg:"top-casting-termine.de"; classtype:trojan-activity; priority:1;) alert tcp 83.133.48.180 any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;) alert tcp 83.133.52.77 any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;) alert tcp 83.138.135.57 any $HOME_NET any (msg:"77tracking.com"; classtype:trojan-activity; priority:1;) alert tcp 83.138.136.130 any $HOME_NET any (msg:"affiliatewindow.com"; classtype:trojan-activity; priority:1;) alert tcp 83.138.136.131 any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;) alert tcp 83.138.145.71 any $HOME_NET any (msg:"clickcompare.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 83.138.186.56 any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;) alert tcp 83.138.187.17 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;) alert tcp 83.138.187.18 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;) alert tcp 83.140.72.24 any $HOME_NET any (msg:"annonser.dagbladet.no"; classtype:trojan-activity; priority:1;) alert tcp 83.141.36.24 any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;) alert tcp 83.141.36.25 any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;) alert tcp 83.145.246.174 any $HOME_NET any (msg:"snoobi.com"; classtype:trojan-activity; priority:1;) alert tcp 83.149.101.2 any $HOME_NET any (msg:"linktarget.com"; classtype:trojan-activity; priority:1;) alert tcp 83.149.110.10 any $HOME_NET any (msg:"targetpoint.com"; classtype:trojan-activity; priority:1;) alert tcp 83.149.116.80 any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;) alert tcp 83.149.123.187 any $HOME_NET any (msg:"adonspot.com"; classtype:trojan-activity; priority:1;) alert tcp 83.167.252.172 any $HOME_NET any (msg:"naj.sk"; classtype:trojan-activity; priority:1;) alert tcp 83.168.201.138 any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;) alert tcp 83.168.230.165 any $HOME_NET any (msg:"widespace.com"; classtype:trojan-activity; priority:1;) alert tcp 83.168.230.28 any $HOME_NET any (msg:"widespace.com"; classtype:trojan-activity; priority:1;) alert tcp 83.170.72.109 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;) alert tcp 83.211.3.121 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;) alert tcp 83.211.3.21 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;) alert tcp 83.220.129.150 any $HOME_NET any (msg:"ads5.virtual-nights.com"; classtype:trojan-activity; priority:1;) alert tcp 83.220.129.153 any $HOME_NET any (msg:"ad.virtual-nights.com"; classtype:trojan-activity; priority:1;) alert tcp 83.221.140.44 any $HOME_NET any (msg:"flexbanner.com"; classtype:trojan-activity; priority:1;) alert tcp 83.222.23.136 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 83.222.23.186 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 83.222.230.35 any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 83.222.234.6 any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;) alert tcp 83.223.112.138 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 83.223.112.142 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 83.231.151.77 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 83.231.151.78 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 83.231.151.79 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 83.231.151.81 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 83.231.151.82 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 83.231.151.84 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 83.231.151.85 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 83.231.151.86 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 83.231.171.230 any $HOME_NET any (msg:"adforce.com"; classtype:trojan-activity; priority:1;) alert tcp 83.231.185.65 any $HOME_NET any (msg:"profero.com"; classtype:trojan-activity; priority:1;) alert tcp 83.241.238.66 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;) alert tcp 83.241.238.67 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;) alert tcp 83.243.20.127 any $HOME_NET any (msg:"pub.hardware.fr"; classtype:trojan-activity; priority:1;) alert tcp 83.243.20.90 any $HOME_NET any (msg:"pub.hardware.fr"; classtype:trojan-activity; priority:1;) alert tcp 83.243.41.202 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 83.243.41.225 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 83.243.41.227 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;) alert tcp 83.244.139.39 any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;) alert tcp 83.244.139.6 any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;) alert tcp 83.244.164.54 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;) alert tcp 83.98.131.135 any $HOME_NET any (msg:"adworx.nl"; classtype:trojan-activity; priority:1;) alert tcp 83.98.133.117 any $HOME_NET any (msg:"thebugs.ws"; classtype:trojan-activity; priority:1;) alert tcp 83.98.199.27 any $HOME_NET any (msg:"ads.wiezoekje.nl"; classtype:trojan-activity; priority:1;) alert tcp 84.12.5.139 any $HOME_NET any (msg:"hexusads.fluent.ltd.uk"; classtype:trojan-activity; priority:1;) alert tcp 84.18.201.36 any $HOME_NET any (msg:"exponential.com"; classtype:trojan-activity; priority:1;) alert tcp 84.19.162.10 any $HOME_NET any (msg:"adnet.de"; classtype:trojan-activity; priority:1;) alert tcp 84.19.162.62 any $HOME_NET any (msg:"adnet.biz"; classtype:trojan-activity; priority:1;) alert tcp 84.19.188.203 any $HOME_NET any (msg:"rankchamp.de"; classtype:trojan-activity; priority:1;) alert tcp 84.2.39.101 any $HOME_NET any (msg:"ad.mediastorm.hu"; classtype:trojan-activity; priority:1;) alert tcp 84.20.192.134 any $HOME_NET any (msg:"ads.betfair.com"; classtype:trojan-activity; priority:1;) alert tcp 84.20.200.66 any $HOME_NET any (msg:"ads.betfair.com"; classtype:trojan-activity; priority:1;) alert tcp 84.200.235.206 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;) alert tcp 84.200.242.43 any $HOME_NET any (msg:"megawerbung.de"; classtype:trojan-activity; priority:1;) alert tcp 84.200.247.109 any $HOME_NET any (msg:"link-booster.de"; classtype:trojan-activity; priority:1;) alert tcp 84.201.45.243 any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;) alert tcp 84.201.59.198 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;) alert tcp 84.21.31.206 any $HOME_NET any (msg:"keymedia.hu"; classtype:trojan-activity; priority:1;) alert tcp 84.21.31.225 any $HOME_NET any (msg:"keymedia.hu"; classtype:trojan-activity; priority:1;) alert tcp 84.22.161.57 any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;) alert tcp 84.233.205.194 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 84.233.205.195 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 84.233.205.196 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 84.233.205.197 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 84.233.205.198 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 84.233.205.199 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 84.233.205.200 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 84.233.205.201 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 84.34.159.52 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 84.34.159.53 any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;) alert tcp 84.39.235.148 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;) alert tcp 84.40.1.122 any $HOME_NET any (msg:"clustrmaps.com"; classtype:trojan-activity; priority:1;) alert tcp 84.45.224.15 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 84.45.224.22 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 84.45.224.7 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 84.45.224.9 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.134.138 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.134.139 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.134.198 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.134.199 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.134.200 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 84.53.134.207 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.14 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.142 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.149 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.15 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.150 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.152 any $HOME_NET any (msg:"ads.friendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.16 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.21 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.143.29 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 84.53.156.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 84.53.167.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 85.10.217.24 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 85.10.220.187 any $HOME_NET any (msg:"visitbox.de"; classtype:trojan-activity; priority:1;) alert tcp 85.112.8.248 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;) alert tcp 85.114.130.132 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;) alert tcp 85.114.140.137 any $HOME_NET any (msg:"praddpro.de"; classtype:trojan-activity; priority:1;) alert tcp 85.114.140.95 any $HOME_NET any (msg:"praddpro.de"; classtype:trojan-activity; priority:1;) alert tcp 85.114.144.196 any $HOME_NET any (msg:"yieldlab.net"; classtype:trojan-activity; priority:1;) alert tcp 85.12.15.12 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;) alert tcp 85.12.17.135 any $HOME_NET any (msg:"ads.guru3d.com"; classtype:trojan-activity; priority:1;) alert tcp 85.12.17.138 any $HOME_NET any (msg:"ads.guru3d.com"; classtype:trojan-activity; priority:1;) alert tcp 85.12.2.209 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;) alert tcp 85.12.47.164 any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;) alert tcp 85.12.47.200 any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;) alert tcp 85.12.9.5 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 85.12.9.7 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 85.13.130.194 any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;) alert tcp 85.13.132.106 any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;) alert tcp 85.13.134.100 any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;) alert tcp 85.13.134.115 any $HOME_NET any (msg:"adsend.de"; classtype:trojan-activity; priority:1;) alert tcp 85.13.134.33 any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;) alert tcp 85.13.136.161 any $HOME_NET any (msg:"adsklick.de"; classtype:trojan-activity; priority:1;) alert tcp 85.13.197.50 any $HOME_NET any (msg:"openx.angelsgroup.org.uk"; classtype:trojan-activity; priority:1;) alert tcp 85.131.135.205 any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;) alert tcp 85.132.151.211 any $HOME_NET any (msg:"banik.redigy.cz"; classtype:trojan-activity; priority:1;) alert tcp 85.158.204.168 any $HOME_NET any (msg:"m4n.nl"; classtype:trojan-activity; priority:1;) alert tcp 85.159.232.14 any $HOME_NET any (msg:"ventivmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 85.159.233.47 any $HOME_NET any (msg:"thebugs.ws"; classtype:trojan-activity; priority:1;) alert tcp 85.159.236.99 any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;) alert tcp 85.159.237.38 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;) alert tcp 85.17.113.116 any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;) alert tcp 85.17.127.66 any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;) alert tcp 85.17.143.7 any $HOME_NET any (msg:"checkstat.nl"; classtype:trojan-activity; priority:1;) alert tcp 85.17.149.60 any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;) alert tcp 85.17.161.1 any $HOME_NET any (msg:"popupmoney.com"; classtype:trojan-activity; priority:1;) alert tcp 85.17.161.3 any $HOME_NET any (msg:"aim4media.com"; classtype:trojan-activity; priority:1;) alert tcp 85.17.164.152 any $HOME_NET any (msg:"ads.ultimate-guitar.com"; classtype:trojan-activity; priority:1;) alert tcp 85.17.214.175 any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;) alert tcp 85.17.31.57 any $HOME_NET any (msg:"trafficfactory.biz"; classtype:trojan-activity; priority:1;) alert tcp 85.17.35.48 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 85.17.35.51 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 85.17.40.128 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 85.17.40.138 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 85.17.40.139 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;) alert tcp 85.17.45.155 any $HOME_NET any (msg:"rankingchart.de"; classtype:trojan-activity; priority:1;) alert tcp 85.17.52.47 any $HOME_NET any (msg:"thebugs.ws"; classtype:trojan-activity; priority:1;) alert tcp 85.17.59.170 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;) alert tcp 85.17.80.120 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;) alert tcp 85.183.249.137 any $HOME_NET any (msg:"sedotracker.com"; classtype:trojan-activity; priority:1;) alert tcp 85.190.2.107 any $HOME_NET any (msg:"bannerads.de"; classtype:trojan-activity; priority:1;) alert tcp 85.197.96.170 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;) alert tcp 85.214.111.122 any $HOME_NET any (msg:"scripte-monster.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.128.188 any $HOME_NET any (msg:"mlm.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.201.250 any $HOME_NET any (msg:"ads.medienhaus.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.217.29 any $HOME_NET any (msg:"visitbox.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.220.237 any $HOME_NET any (msg:"ads.medienhaus.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.26.183 any $HOME_NET any (msg:"homepageking.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.33.5 any $HOME_NET any (msg:"express-submit.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.34.137 any $HOME_NET any (msg:"ranking-hits.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.37.213 any $HOME_NET any (msg:"ads.gaming-universe.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.82.88 any $HOME_NET any (msg:"mlm.de"; classtype:trojan-activity; priority:1;) alert tcp 85.214.93.123 any $HOME_NET any (msg:"homepageking.de"; classtype:trojan-activity; priority:1;) alert tcp 85.232.246.243 any $HOME_NET any (msg:"adocean.pl"; classtype:trojan-activity; priority:1;) alert tcp 85.233.160.70 any $HOME_NET any (msg:"abc-ads.com"; classtype:trojan-activity; priority:1;) alert tcp 85.235.246.2 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;) alert tcp 85.235.246.3 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;) alert tcp 85.237.85.69 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;) alert tcp 85.25.71.142 any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 85.25.81.35 any $HOME_NET any (msg:"hits.europuls.eu"; classtype:trojan-activity; priority:1;) alert tcp 85.31.97.44 any $HOME_NET any (msg:"topsite.lv"; classtype:trojan-activity; priority:1;) alert tcp 85.62.8.101 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 85.62.8.102 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 85.62.8.103 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 85.62.8.104 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;) alert tcp 85.90.254.47 any $HOME_NET any (msg:"adjug.com"; classtype:trojan-activity; priority:1;) alert tcp 85.92.214.164 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;) alert tcp 85.92.214.166 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;) alert tcp 85.93.23.12 any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;) alert tcp 85.93.28.2 any $HOME_NET any (msg:"megawerbung.de"; classtype:trojan-activity; priority:1;) alert tcp 86.111.241.26 any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;) alert tcp 86.111.241.28 any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;) alert tcp 86.111.247.5 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;) alert tcp 86.58.139.10 any $HOME_NET any (msg:"adform.com"; classtype:trojan-activity; priority:1;) alert tcp 86.58.139.18 any $HOME_NET any (msg:"adform.com"; classtype:trojan-activity; priority:1;) alert tcp 86.58.139.19 any $HOME_NET any (msg:"adform.com"; classtype:trojan-activity; priority:1;) alert tcp 86.58.139.9 any $HOME_NET any (msg:"adform.com"; classtype:trojan-activity; priority:1;) alert tcp 86.58.179.98 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;) alert tcp 86.58.179.99 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;) alert tcp 87.106.163.226 any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;) alert tcp 87.106.20.121 any $HOME_NET any (msg:"adrotate.de"; classtype:trojan-activity; priority:1;) alert tcp 87.106.21.147 any $HOME_NET any (msg:"jinkads.de"; classtype:trojan-activity; priority:1;) alert tcp 87.106.28.211 any $HOME_NET any (msg:"spezialreporte.de"; classtype:trojan-activity; priority:1;) alert tcp 87.106.28.57 any $HOME_NET any (msg:"muwmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 87.106.35.190 any $HOME_NET any (msg:"targad.de"; classtype:trojan-activity; priority:1;) alert tcp 87.106.5.110 any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;) alert tcp 87.118.124.39 any $HOME_NET any (msg:"rankchamp.de"; classtype:trojan-activity; priority:1;) alert tcp 87.119.193.166 any $HOME_NET any (msg:"777partner.com"; classtype:trojan-activity; priority:1;) alert tcp 87.119.193.171 any $HOME_NET any (msg:"777partner.com"; classtype:trojan-activity; priority:1;) alert tcp 87.119.203.72 any $HOME_NET any (msg:"pimpmyclicks.com"; classtype:trojan-activity; priority:1;) alert tcp 87.204.60.217 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;) alert tcp 87.230.15.13 any $HOME_NET any (msg:"scripte-monster.de"; classtype:trojan-activity; priority:1;) alert tcp 87.230.55.60 any $HOME_NET any (msg:"adspirit.de"; classtype:trojan-activity; priority:1;) alert tcp 87.233.141.30 any $HOME_NET any (msg:"cash4members.com"; classtype:trojan-activity; priority:1;) alert tcp 87.233.203.68 any $HOME_NET any (msg:"cash4members.com"; classtype:trojan-activity; priority:1;) alert tcp 87.233.5.164 any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;) alert tcp 87.236.194.91 any $HOME_NET any (msg:"netagent.cz"; classtype:trojan-activity; priority:1;) alert tcp 87.236.27.201 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;) alert tcp 87.237.120.78 any $HOME_NET any (msg:"cash4popup.de"; classtype:trojan-activity; priority:1;) alert tcp 87.237.123.51 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;) alert tcp 87.242.91.6 any $HOME_NET any (msg:"ads.adfox.ru"; classtype:trojan-activity; priority:1;) alert tcp 87.248.120.148 any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;) alert tcp 87.248.203.253 any $HOME_NET any (msg:"l-stat.livejournal.com"; classtype:trojan-activity; priority:1;) alert tcp 87.248.203.254 any $HOME_NET any (msg:"l-stat.livejournal.com"; classtype:trojan-activity; priority:1;) alert tcp 87.248.210.253 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;) alert tcp 87.248.210.254 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;) alert tcp 87.248.217.251 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;) alert tcp 87.248.217.253 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;) alert tcp 87.248.217.254 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;) alert tcp 87.249.117.91 any $HOME_NET any (msg:"xertive.com"; classtype:trojan-activity; priority:1;) alert tcp 87.250.250.190 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 87.250.250.90 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 87.250.251.190 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 87.250.251.90 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 87.252.210.32 any $HOME_NET any (msg:"banner.goldenpalace.com"; classtype:trojan-activity; priority:1;) alert tcp 87.252.215.237 any $HOME_NET any (msg:"cpays.com"; classtype:trojan-activity; priority:1;) alert tcp 87.252.216.119 any $HOME_NET any (msg:"banner.eurogrand.com"; classtype:trojan-activity; priority:1;) alert tcp 87.72.32.55 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;) alert tcp 87.84.169.106 any $HOME_NET any (msg:"ads.footymad.net"; classtype:trojan-activity; priority:1;) alert tcp 87.84.77.171 any $HOME_NET any (msg:"ad.digitallook.com"; classtype:trojan-activity; priority:1;) alert tcp 87.86.7.52 any $HOME_NET any (msg:"debtbusterloans.com"; classtype:trojan-activity; priority:1;) alert tcp 87.98.150.129 any $HOME_NET any (msg:"alenty.com"; classtype:trojan-activity; priority:1;) alert tcp 87.98.156.161 any $HOME_NET any (msg:"alenty.com"; classtype:trojan-activity; priority:1;) alert tcp 87.98.165.158 any $HOME_NET any (msg:"ads.expat-blog.biz"; classtype:trojan-activity; priority:1;) alert tcp 87.98.169.74 any $HOME_NET any (msg:"geovisite.com"; classtype:trojan-activity; priority:1;) alert tcp 87.98.177.235 any $HOME_NET any (msg:"visual-pagerank.fr"; classtype:trojan-activity; priority:1;) alert tcp 87.98.209.106 any $HOME_NET any (msg:"spywords.com"; classtype:trojan-activity; priority:1;) alert tcp 87.98.217.208 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 87.98.242.50 any $HOME_NET any (msg:"ads.medienhaus.de"; classtype:trojan-activity; priority:1;) alert tcp 88.190.221.12 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 88.190.221.184 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 88.190.221.40 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 88.190.222.61 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.131.12 any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;) alert tcp 88.191.14.178 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.15.10 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.17.52 any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;) alert tcp 88.191.222.116 any $HOME_NET any (msg:"alenty.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.227.144 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.23.180 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.230.161 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.230.71 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.26.111 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 88.191.27.218 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;) alert tcp 88.198.215.209 any $HOME_NET any (msg:"ads.gsmexchange.com"; classtype:trojan-activity; priority:1;) alert tcp 88.198.231.1 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;) alert tcp 88.198.231.8 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;) alert tcp 88.198.24.51 any $HOME_NET any (msg:"foo.cosmocode.de"; classtype:trojan-activity; priority:1;) alert tcp 88.198.25.200 any $HOME_NET any (msg:"ad1.emule-project.org"; classtype:trojan-activity; priority:1;) alert tcp 88.198.34.76 any $HOME_NET any (msg:"cash4popup.de"; classtype:trojan-activity; priority:1;) alert tcp 88.198.51.68 any $HOME_NET any (msg:"ad.virtual-nights.com"; classtype:trojan-activity; priority:1;) alert tcp 88.198.58.147 any $HOME_NET any (msg:"fc.webmasterpro.de"; classtype:trojan-activity; priority:1;) alert tcp 88.198.62.210 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;) alert tcp 88.198.99.106 any $HOME_NET any (msg:"ads5.virtual-nights.com"; classtype:trojan-activity; priority:1;) alert tcp 88.208.118.87 any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.208.119.36 any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.208.23.10 any $HOME_NET any (msg:"ads.xhamster.com"; classtype:trojan-activity; priority:1;) alert tcp 88.208.23.102 any $HOME_NET any (msg:"ads.xhamster.com"; classtype:trojan-activity; priority:1;) alert tcp 88.208.23.103 any $HOME_NET any (msg:"ads.xhamster.com"; classtype:trojan-activity; priority:1;) alert tcp 88.208.23.7 any $HOME_NET any (msg:"ads.xhamster.com"; classtype:trojan-activity; priority:1;) alert tcp 88.208.244.67 any $HOME_NET any (msg:"ads.horsehero.com"; classtype:trojan-activity; priority:1;) alert tcp 88.208.32.80 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.100 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.101 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.102 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.103 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.104 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.105 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.122 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.123 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.124 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.66 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.67 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.69 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.70 any $HOME_NET any (msg:"yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.72 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.75 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.76 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.77 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.78 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.80 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.85 any $HOME_NET any (msg:"ad.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.89 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.196.92 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.200.112 any $HOME_NET any (msg:"adland.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.200.71 any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.212.202.2 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;) alert tcp 88.214.194.113 any $HOME_NET any (msg:"bridesservice.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.163.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.171.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.174.145 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.179.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.182.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.16 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.19 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.24 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.27 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.32 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.42 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.48 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.50 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.51 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.58 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.66 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.67 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.73 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.75 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.8 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.80 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.81 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.83 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.91 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.96 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 88.221.26.98 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 88.80.192.60 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;) alert tcp 88.80.192.62 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;) alert tcp 88.80.202.155 any $HOME_NET any (msg:"layer-ad.de"; classtype:trojan-activity; priority:1;) alert tcp 88.80.7.173 any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;) alert tcp 88.81.149.203 any $HOME_NET any (msg:"accounts.pkr.com"; classtype:trojan-activity; priority:1;) alert tcp 88.81.155.243 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 88.81.155.244 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 88.81.155.245 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 88.81.155.246 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 88.81.155.247 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 88.81.155.248 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;) alert tcp 88.85.84.18 any $HOME_NET any (msg:"bridesservice.com"; classtype:trojan-activity; priority:1;) alert tcp 88.86.101.1 any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.101.2 any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.104.12 any $HOME_NET any (msg:"bannery.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.104.121 any $HOME_NET any (msg:"bannery.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.104.62 any $HOME_NET any (msg:"bannery.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.107.65 any $HOME_NET any (msg:"counter.cnw.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.109.130 any $HOME_NET any (msg:"ad.hyena.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.109.131 any $HOME_NET any (msg:"ad.grafika.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.111.138 any $HOME_NET any (msg:"ad.grafika.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.113.150 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;) alert tcp 88.86.125.12 any $HOME_NET any (msg:"advisormedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.108.109.38 any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;) alert tcp 89.108.86.235 any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;) alert tcp 89.108.87.88 any $HOME_NET any (msg:"ad0.bigmir.net"; classtype:trojan-activity; priority:1;) alert tcp 89.108.87.90 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;) alert tcp 89.110.133.18 any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;) alert tcp 89.111.174.46 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;) alert tcp 89.144.1.148 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;) alert tcp 89.145.95.3 any $HOME_NET any (msg:"grapeshot.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 89.151.66.200 any $HOME_NET any (msg:"360yield.com"; classtype:trojan-activity; priority:1;) alert tcp 89.167.138.249 any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;) alert tcp 89.184.64.112 any $HOME_NET any (msg:"counter.mirohost.net"; classtype:trojan-activity; priority:1;) alert tcp 89.184.74.33 any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;) alert tcp 89.184.81.34 any $HOME_NET any (msg:"hit.ua"; classtype:trojan-activity; priority:1;) alert tcp 89.185.242.107 any $HOME_NET any (msg:"reklama.mironet.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.185.242.114 any $HOME_NET any (msg:"reklama.mironet.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.185.242.53 any $HOME_NET any (msg:"netagent.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.185.247.187 any $HOME_NET any (msg:"reklama.mironet.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.187.121.150 any $HOME_NET any (msg:"ad.digitallook.com"; classtype:trojan-activity; priority:1;) alert tcp 89.187.68.37 any $HOME_NET any (msg:"openx.angelsgroup.org.uk"; classtype:trojan-activity; priority:1;) alert tcp 89.188.109.162 any $HOME_NET any (msg:"inetlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 89.188.127.214 any $HOME_NET any (msg:"inetlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 89.188.28.129 any $HOME_NET any (msg:"ads.guru3d.com"; classtype:trojan-activity; priority:1;) alert tcp 89.20.202.5 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;) alert tcp 89.202.193.162 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 89.202.193.163 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 89.202.193.167 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 89.202.193.171 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 89.234.39.243 any $HOME_NET any (msg:"clickdensity.com"; classtype:trojan-activity; priority:1;) alert tcp 89.238.137.235 any $HOME_NET any (msg:"ads.kinxxx.com"; classtype:trojan-activity; priority:1;) alert tcp 89.238.81.142 any $HOME_NET any (msg:"megawerbung.de"; classtype:trojan-activity; priority:1;) alert tcp 89.250.243.179 any $HOME_NET any (msg:"k.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.250.243.180 any $HOME_NET any (msg:"k.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.250.248.14 any $HOME_NET any (msg:"ad3.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.250.248.15 any $HOME_NET any (msg:"navrcholu.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.250.252.14 any $HOME_NET any (msg:"ad3.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.250.252.15 any $HOME_NET any (msg:"navrcholu.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.250.252.33 any $HOME_NET any (msg:"ia.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.250.252.36 any $HOME_NET any (msg:"ia.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.250.252.7 any $HOME_NET any (msg:"ad2.lupa.cz"; classtype:trojan-activity; priority:1;) alert tcp 89.31.143.1 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;) alert tcp 89.35.55.35 any $HOME_NET any (msg:"ip.ro"; classtype:trojan-activity; priority:1;) alert tcp 90.156.178.46 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;) alert tcp 90.156.178.47 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;) alert tcp 90.156.194.133 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;) alert tcp 90.156.194.205 any $HOME_NET any (msg:"mytrix.com"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.11 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.124 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.13 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.14 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.22 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.24 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.36 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.41 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.84 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.90 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.156.201.96 any $HOME_NET any (msg:"owebmoney.ru"; classtype:trojan-activity; priority:1;) alert tcp 90.183.101.135 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 90.183.101.151 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 90.183.101.231 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 90.183.38.67 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;) alert tcp 90.183.39.243 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;) alert tcp 90.216.131.2 any $HOME_NET any (msg:"ads.oddschecker.com"; classtype:trojan-activity; priority:1;) alert tcp 91.103.138.50 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 91.103.138.65 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 91.103.139.50 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 91.103.142.100 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 91.103.32.74 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 91.103.32.76 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 91.103.4.74 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.102.107 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.124.214 any $HOME_NET any (msg:"x-traceur.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.134.56 any $HOME_NET any (msg:"stat.webmedia.pl"; classtype:trojan-activity; priority:1;) alert tcp 91.121.151.206 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.151.223 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.151.225 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.16.201 any $HOME_NET any (msg:"popub.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.183.179 any $HOME_NET any (msg:"visual-pagerank.fr"; classtype:trojan-activity; priority:1;) alert tcp 91.121.197.149 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.220.114 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.220.116 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.220.118 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.30.34 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.53.224 any $HOME_NET any (msg:"spywords.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.68.57 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.80.105 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.82.215 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 91.121.83.225 any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;) alert tcp 91.146.108.3 any $HOME_NET any (msg:"hits4me.com"; classtype:trojan-activity; priority:1;) alert tcp 91.184.37.253 any $HOME_NET any (msg:"wondoads.de"; classtype:trojan-activity; priority:1;) alert tcp 91.189.41.143 any $HOME_NET any (msg:"adtoma.com"; classtype:trojan-activity; priority:1;) alert tcp 91.189.41.145 any $HOME_NET any (msg:"adtoma.com"; classtype:trojan-activity; priority:1;) alert tcp 91.189.41.162 any $HOME_NET any (msg:"adtoma.com"; classtype:trojan-activity; priority:1;) alert tcp 91.189.41.70 any $HOME_NET any (msg:"adtoma.com"; classtype:trojan-activity; priority:1;) alert tcp 91.192.110.112 any $HOME_NET any (msg:"sixsigmatraffic.com"; classtype:trojan-activity; priority:1;) alert tcp 91.192.111.37 any $HOME_NET any (msg:"smart4ads.com"; classtype:trojan-activity; priority:1;) alert tcp 91.192.148.82 any $HOME_NET any (msg:"begun.ru"; classtype:trojan-activity; priority:1;) alert tcp 91.192.148.89 any $HOME_NET any (msg:"begun.ru"; classtype:trojan-activity; priority:1;) alert tcp 91.192.149.82 any $HOME_NET any (msg:"begun.ru"; classtype:trojan-activity; priority:1;) alert tcp 91.192.149.89 any $HOME_NET any (msg:"begun.ru"; classtype:trojan-activity; priority:1;) alert tcp 91.192.43.151 any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;) alert tcp 91.192.43.152 any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;) alert tcp 91.194.150.131 any $HOME_NET any (msg:"adpepper.dk"; classtype:trojan-activity; priority:1;) alert tcp 91.194.205.37 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 91.194.205.51 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 91.194.91.210 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 91.194.91.211 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 91.194.91.212 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 91.194.91.213 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 91.194.91.217 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;) alert tcp 91.195.169.26 any $HOME_NET any (msg:"affiliatefuture.com"; classtype:trojan-activity; priority:1;) alert tcp 91.195.241.121 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;) alert tcp 91.198.165.34 any $HOME_NET any (msg:"hits4me.com"; classtype:trojan-activity; priority:1;) alert tcp 91.199.255.4 any $HOME_NET any (msg:"imgpromo.easyrencontre.com"; classtype:trojan-activity; priority:1;) alert tcp 91.201.63.116 any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;) alert tcp 91.202.200.37 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 91.202.200.41 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 91.202.200.65 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 91.202.200.66 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 91.202.200.69 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 91.202.200.7 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 91.202.200.70 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 91.203.202.32 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 91.203.202.33 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 91.203.202.34 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 91.203.202.35 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;) alert tcp 91.203.68.130 any $HOME_NET any (msg:"topsite.lv"; classtype:trojan-activity; priority:1;) alert tcp 91.205.13.10 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;) alert tcp 91.206.185.110 any $HOME_NET any (msg:"ranking-links.de"; classtype:trojan-activity; priority:1;) alert tcp 91.208.181.38 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 91.208.42.67 any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;) alert tcp 91.208.42.72 any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;) alert tcp 91.209.18.55 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;) alert tcp 91.210.233.2 any $HOME_NET any (msg:"advertiseireland.com"; classtype:trojan-activity; priority:1;) alert tcp 91.213.160.14 any $HOME_NET any (msg:"ad3.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 91.213.160.15 any $HOME_NET any (msg:"navrcholu.cz"; classtype:trojan-activity; priority:1;) alert tcp 91.213.160.33 any $HOME_NET any (msg:"ia.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 91.213.160.36 any $HOME_NET any (msg:"ia.iinfo.cz"; classtype:trojan-activity; priority:1;) alert tcp 91.213.160.7 any $HOME_NET any (msg:"ad2.lupa.cz"; classtype:trojan-activity; priority:1;) alert tcp 91.213.232.5 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;) alert tcp 91.216.195.53 any $HOME_NET any (msg:"perf.weborama.fr"; classtype:trojan-activity; priority:1;) alert tcp 91.217.39.30 any $HOME_NET any (msg:"affiliates.thrixxx.com"; classtype:trojan-activity; priority:1;) alert tcp 91.221.127.248 any $HOME_NET any (msg:"adocean.pl"; classtype:trojan-activity; priority:1;) alert tcp 91.226.182.243 any $HOME_NET any (msg:"ktu.sv2.biz"; classtype:trojan-activity; priority:1;) alert tcp 91.228.45.211 any $HOME_NET any (msg:"banik.redigy.cz"; classtype:trojan-activity; priority:1;) alert tcp 91.236.122.1 any $HOME_NET any (msg:"adcell.de"; classtype:trojan-activity; priority:1;) alert tcp 91.236.78.69 any $HOME_NET any (msg:"admanagement.ch"; classtype:trojan-activity; priority:1;) alert tcp 91.237.218.12 any $HOME_NET any (msg:"statm.the-adult-company.com"; classtype:trojan-activity; priority:1;) alert tcp 91.237.218.19 any $HOME_NET any (msg:"netclickstats.com"; classtype:trojan-activity; priority:1;) alert tcp 91.250.82.19 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;) alert tcp 91.250.98.197 any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;) alert tcp 92.122.125.50 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.105 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.121 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.123 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.128 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.138 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.161 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.177 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.186 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.187 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.19 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.201 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.203 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.208 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.216 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.218 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.226 any $HOME_NET any (msg:"ads.yldmgrimg.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.227 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.232 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.233 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.241 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.250 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.251 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.27 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.32 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.56 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.58 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.65 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.126.80 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.10 any $HOME_NET any (msg:"ads.verticalresponse.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.11 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.16 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.17 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.18 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.24 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.241 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.242 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.243 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.27 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.32 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.34 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.35 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.41 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.49 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.56 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.57 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.66 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.73 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.83 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.9 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.90 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.127.96 any $HOME_NET any (msg:"ads.lesbianpersonals.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.16.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.114 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.115 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.123 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.129 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.131 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.137 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.144 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.145 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.146 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.154 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.160 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.161 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.162 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.163 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.168 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.170 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.171 any $HOME_NET any (msg:"ads.yldmgrimg.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.185 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.186 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.193 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.35 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.208.74 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.121 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.137 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.139 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.145 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.147 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.161 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.163 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.169 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.176 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.210.187 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.211.107 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.211.113 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.16 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.18 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.19 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.232 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.243 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.25 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.26 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.34 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.40 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.42 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.43 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.49 any $HOME_NET any (msg:"ads.yldmgrimg.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.51 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.56 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.57 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.58 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.59 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.65 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.67 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.72 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.73 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.74 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.75 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.80 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.88 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.90 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.91 any $HOME_NET any (msg:"ads.yldmgrimg.net"; classtype:trojan-activity; priority:1;) alert tcp 92.122.49.98 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.123.109.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 92.123.189.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;) alert tcp 92.123.19.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.123.197.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 92.123.83.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.123.86.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;) alert tcp 92.123.88.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.123.93.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 92.123.99.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 92.240.234.45 any $HOME_NET any (msg:"blueadvertise.com"; classtype:trojan-activity; priority:1;) alert tcp 92.241.179.2 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;) alert tcp 92.43.106.10 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;) alert tcp 92.51.153.33 any $HOME_NET any (msg:"max.i12.de"; classtype:trojan-activity; priority:1;) alert tcp 92.52.85.115 any $HOME_NET any (msg:"au2m8.com"; classtype:trojan-activity; priority:1;) alert tcp 92.61.114.22 any $HOME_NET any (msg:"img.prohardver.hu"; classtype:trojan-activity; priority:1;) alert tcp 92.61.148.161 any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;) alert tcp 93.114.46.213 any $HOME_NET any (msg:"webseoanalytics.com"; classtype:trojan-activity; priority:1;) alert tcp 93.158.134.190 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 93.158.134.90 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;) alert tcp 93.170.16.22 any $HOME_NET any (msg:"netagent.cz"; classtype:trojan-activity; priority:1;) alert tcp 93.183.203.194 any $HOME_NET any (msg:"hit.ua"; classtype:trojan-activity; priority:1;) alert tcp 93.184.220.103 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;) alert tcp 93.184.220.20 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;) alert tcp 93.186.161.248 any $HOME_NET any (msg:"webcounter.goweb.de"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.100 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.12 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.13 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.138 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.139 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.14 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.141 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.142 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.143 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.144 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.145 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.15 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.16 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.163 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.165 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.17 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.18 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.19 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.20 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.21 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.22 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.23 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.24 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.25 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.26 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.27 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.28 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.29 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.30 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.31 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.32 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.33 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.35 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.36 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.37 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.38 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.39 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.40 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.41 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.42 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.43 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.44 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.45 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.46 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.47 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.48 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.49 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.50 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.51 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.52 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.53 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.54 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.55 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.56 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.128.94 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.130.13 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.130.18 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.130.22 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.130.35 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.130.49 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.130.83 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;) alert tcp 93.188.130.97 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.131.153 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.131.6 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.188.135.42 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;) alert tcp 93.190.69.146 any $HOME_NET any (msg:"adrolays.de"; classtype:trojan-activity; priority:1;) alert tcp 93.90.176.36 any $HOME_NET any (msg:"wondoads.de"; classtype:trojan-activity; priority:1;) alert tcp 93.91.240.106 any $HOME_NET any (msg:"vrs.cz"; classtype:trojan-activity; priority:1;) alert tcp 93.93.53.194 any $HOME_NET any (msg:"creatives.livejasmin.com"; classtype:trojan-activity; priority:1;) alert tcp 93.99.21.67 any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 93.99.21.82 any $HOME_NET any (msg:"add.newmedia.cz"; classtype:trojan-activity; priority:1;) alert tcp 94.100.178.210 any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;) alert tcp 94.100.178.220 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 94.100.179.156 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.179.158 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.179.162 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.179.163 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.179.174 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.179.178 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.179.183 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.179.186 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.191 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.194 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.195 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.196 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.197 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.199 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.200 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.202 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.203 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.204 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.207 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.208 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.209 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.210 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.212 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.213 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.220 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.221 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.222 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.223 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.181.224 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.185.20 any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;) alert tcp 94.100.185.50 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;) alert tcp 94.100.186.134 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.186.138 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.191 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.192 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.193 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.194 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.195 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.196 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.197 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.238 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.239 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.100.187.241 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;) alert tcp 94.102.208.173 any $HOME_NET any (msg:"link-booster.de"; classtype:trojan-activity; priority:1;) alert tcp 94.124.76.1 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;) alert tcp 94.124.89.230 any $HOME_NET any (msg:"ads.massinfra.nl"; classtype:trojan-activity; priority:1;) alert tcp 94.125.253.116 any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;) alert tcp 94.125.253.119 any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;) alert tcp 94.127.72.60 any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;) alert tcp 94.127.74.170 any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;) alert tcp 94.127.74.60 any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;) alert tcp 94.127.76.190 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;) alert tcp 94.127.76.60 any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;) alert tcp 94.136.40.82 any $HOME_NET any (msg:"debtbusterloans.com"; classtype:trojan-activity; priority:1;) alert tcp 94.140.46.187 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;) alert tcp 94.198.100.232 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;) alert tcp 94.198.100.236 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;) alert tcp 94.23.109.213 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;) alert tcp 94.23.231.28 any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;) alert tcp 94.23.236.80 any $HOME_NET any (msg:"popub.com"; classtype:trojan-activity; priority:1;) alert tcp 94.23.3.165 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;) alert tcp 94.23.97.3 any $HOME_NET any (msg:"x-traceur.com"; classtype:trojan-activity; priority:1;) alert tcp 94.230.50.142 any $HOME_NET any (msg:"ad.nachtagenten.de"; classtype:trojan-activity; priority:1;) alert tcp 94.236.96.101 any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;) alert tcp 94.242.219.161 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 94.246.113.219 any $HOME_NET any (msg:"ads.nordichardware.com"; classtype:trojan-activity; priority:1;) alert tcp 94.60.139.201 any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;) alert tcp 94.75.230.33 any $HOME_NET any (msg:"banners.babylon-x.com"; classtype:trojan-activity; priority:1;) alert tcp 94.75.254.227 any $HOME_NET any (msg:"heyos.com"; classtype:trojan-activity; priority:1;) alert tcp 95.100.189.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 95.100.83.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 95.100.88.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 95.100.93.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;) alert tcp 95.101.243.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 95.101.248.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;) alert tcp 95.129.49.229 any $HOME_NET any (msg:"megawerbung.de"; classtype:trojan-activity; priority:1;) alert tcp 95.130.251.151 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;) alert tcp 95.131.121.175 any $HOME_NET any (msg:"quisma.com"; classtype:trojan-activity; priority:1;) alert tcp 95.131.121.65 any $HOME_NET any (msg:"gmads.net"; classtype:trojan-activity; priority:1;) alert tcp 95.131.121.66 any $HOME_NET any (msg:"gmads.net"; classtype:trojan-activity; priority:1;) alert tcp 95.131.121.67 any $HOME_NET any (msg:"gmads.net"; classtype:trojan-activity; priority:1;) alert tcp 95.131.136.4 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 95.131.136.5 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 95.142.100.22 any $HOME_NET any (msg:"pubdirecte.com"; classtype:trojan-activity; priority:1;) alert tcp 95.142.170.154 any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;) alert tcp 95.163.105.100 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;) alert tcp 95.168.209.8 any $HOME_NET any (msg:"ads2.xnet.cz"; classtype:trojan-activity; priority:1;) alert tcp 95.169.190.132 any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;) alert tcp 95.169.190.38 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;) alert tcp 95.211.117.201 any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.12.140 any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.133.204 any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.2.37 any $HOME_NET any (msg:"linktarget.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.221.150 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.221.151 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.221.152 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.76.16 any $HOME_NET any (msg:"popupmoney.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.76.57 any $HOME_NET any (msg:"popupmoney.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.76.58 any $HOME_NET any (msg:"popupmoney.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.85.94 any $HOME_NET any (msg:"linktarget.com"; classtype:trojan-activity; priority:1;) alert tcp 95.211.98.240 any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;) alert tcp 96.126.104.90 any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;) alert tcp 96.126.115.155 any $HOME_NET any (msg:"adzerk.net"; classtype:trojan-activity; priority:1;) alert tcp 96.127.137.235 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;) alert tcp 96.127.160.130 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;) alert tcp 96.30.19.32 any $HOME_NET any (msg:"topmmorpgsites.com"; classtype:trojan-activity; priority:1;) alert tcp 96.30.19.34 any $HOME_NET any (msg:"blogtoplist.se"; classtype:trojan-activity; priority:1;) alert tcp 96.31.88.157 any $HOME_NET any (msg:"blogtopsites.com"; classtype:trojan-activity; priority:1;) alert tcp 96.31.88.162 any $HOME_NET any (msg:"blogtopsites.com"; classtype:trojan-activity; priority:1;) alert tcp 96.44.154.35 any $HOME_NET any (msg:"worldwide-cash.net"; classtype:trojan-activity; priority:1;) alert tcp 96.45.82.132 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 96.45.82.133 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 96.45.82.196 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 96.45.82.197 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 96.45.82.4 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 96.45.82.5 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 96.45.82.68 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 96.45.82.69 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;) alert tcp 96.47.68.254 any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;) alert tcp 96.47.69.32 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 96.47.69.33 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;) alert tcp 96.47.69.96 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;) alert tcp 96.47.69.97 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;) alert tcp 96.8.80.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 96.8.81.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 96.8.82.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 96.8.83.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 96.8.84.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 96.8.85.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;) alert tcp 96.9.133.248 any $HOME_NET any (msg:"mypagerank.net"; classtype:trojan-activity; priority:1;) alert tcp 97.74.18.141 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 97.74.208.81 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;) alert tcp 97.74.215.214 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 97.74.215.24 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 97.74.215.25 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 97.74.215.36 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;) alert tcp 97.74.215.76 any $HOME_NET any (msg:"audience2media.com"; classtype:trojan-activity; priority:1;) alert tcp 97.74.65.159 any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;) alert tcp 98.124.248.156 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;) alert tcp 98.124.248.70 any $HOME_NET any (msg:"dmtracker.com"; classtype:trojan-activity; priority:1;) alert tcp 98.124.248.89 any $HOME_NET any (msg:"ads7.gamecity.net"; classtype:trojan-activity; priority:1;) alert tcp 98.124.248.94 any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;) alert tcp 98.129.153.166 any $HOME_NET any (msg:"ads.cc"; classtype:trojan-activity; priority:1;) alert tcp 98.129.229.164 any $HOME_NET any (msg:"justrelevant.com"; classtype:trojan-activity; priority:1;) alert tcp 98.136.92.79 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;) alert tcp 98.137.80.31 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 98.137.80.32 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 98.137.80.33 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 98.137.80.34 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 98.137.80.49 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 98.137.80.50 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;) alert tcp 98.139.102.145 any $HOME_NET any (msg:"yieldmanager.net"; classtype:trojan-activity; priority:1;) alert tcp 98.139.134.174 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 98.139.135.198 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 98.139.135.21 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 98.139.135.22 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;) alert tcp 98.139.200.237 any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;) alert tcp 98.158.129.52 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;) alert tcp 98.188.121.151 any $HOME_NET any (msg:"spywarelabs.com"; classtype:trojan-activity; priority:1;) alert tcp 98.203.240.4 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;) alert tcp 99.192.139.238 any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;) alert tcp 99.192.245.153 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;) alert tcp 99.63.194.183 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)