last updated: Sun, 19 Nov 2017 19:57:33 GMT (2480 servers listed)

[ other stuff | list of ad server hostnames | information about this list | choose another format to view the list in ]

hide these links (see the main page for other formats in which to view the list.)


# List of IP addresses for use with Snort
#
# last updated:     Sun, 19 Nov 2017 19:57:33 GMT
# total IPs listed: 12194
#
# WARNING: using this list in IP address format may block legitimate content
# from IP addresses listed. IP addresses used are the reverse IPs for hostnames
# included in the list of ad servers, so may also be valid for other hostnames.
#
# The latest version of this list and other ways of viewing it are at:
#
#      https://pgl.yoyo.org/adservers/
#
# - Peter Lowe
#   pgl@yoyo.org
#

alert tcp 103.245.223.129 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.245.223.131 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.245.223.192 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.245.223.194 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.184 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.32 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.33 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.34 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.35 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.36 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.5 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.6.6 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.7.184 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.7.31 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.7.32 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.7.33 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.7.34 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.7.35 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.7.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 103.31.7.5 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 106.186.21.27 any $HOME_NET any (msg:"99count.com"; classtype:trojan-activity; priority:1;)
alert tcp 106.187.45.197 any $HOME_NET any (msg:"99count.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.1.218.112 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.140.119 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.144.200 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.150.214 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.165.101 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.170.67 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.172.247 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.182.114 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.187.182 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.192.122 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.206.69 any $HOME_NET any (msg:"scopelight.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.210.46 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.223.131 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.229.0 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.248.225 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.250.140 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.20.253.26 any $HOME_NET any (msg:"directivepub.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.100.192 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.108.211 any $HOME_NET any (msg:"ads.tahono.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.110.141 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.120.42 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.202.145 any $HOME_NET any (msg:"budsinc.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.236.39 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.247.135 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.247.218 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.249.192 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.249.25 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.249.38 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.251.222 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.92.233 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.95.174 any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.21.95.48 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.161.177 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.161.53 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.174.69 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.182.17 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.193.46 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.20.174 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.211.212 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.213.178 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.218.51 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.231.138 any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.240.237 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.246.83 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.250.156 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.251.105 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.252.153 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.22.253.9 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.23.168.79 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;)
alert tcp 107.23.18.192 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.192.108 any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.192.171 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.192.59 any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.192.67 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.193.108 any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.193.171 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.193.59 any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.193.67 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.193.94 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.194.105 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.194.161 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.194.164 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.194.167 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.194.177 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.194.211 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.194.45 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.194.64 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.105 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.116 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.16 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.161 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.167 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.177 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.197 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.211 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.195.45 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.196.50 any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.197.50 any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.198.193 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.198.233 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.198.89 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.198.94 any $HOME_NET any (msg:"proton-tm.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.198.98 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.199.175 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.199.233 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.199.75 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.199.89 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.199.94 any $HOME_NET any (msg:"proton-tm.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.203.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.203.253 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.203.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.204.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.204.253 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.204.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.205.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.205.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.206.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.206.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.162.207.134 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.163.163.194 any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.163.167.66 any $HOME_NET any (msg:"openx.blindferret.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.166.121.41 any $HOME_NET any (msg:"ad-tech.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.166.79.51 any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.132.186 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.157.82 any $HOME_NET any (msg:"clkads.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.160.69 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.170.82 any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.218.164 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.218.168 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.218.175 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.218.176 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.168.218.180 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.171.187.106 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.171.187.29 any $HOME_NET any (msg:"globaltakeoff.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.60.149.204 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;)
alert tcp 108.61.16.85 any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.61.4.52 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.61.5.242 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 108.61.5.243 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.123.194.85 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.123.74.252 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.123.89.175 any $HOME_NET any (msg:"clickcompare.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 109.163.234.50 any $HOME_NET any (msg:"webseoanalytics.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.169.13.178 any $HOME_NET any (msg:"sid-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.201.131.15 any $HOME_NET any (msg:"thebugs.ws"; classtype:trojan-activity; priority:1;)
alert tcp 109.203.124.224 any $HOME_NET any (msg:"casinogames.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.205.184.118 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 109.205.184.32 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 109.205.184.67 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 109.205.186.118 any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;)
alert tcp 109.205.186.32 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 109.205.186.67 any $HOME_NET any (msg:"specificmedia.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 109.205.76.16 any $HOME_NET any (msg:"potenza.cz"; classtype:trojan-activity; priority:1;)
alert tcp 109.234.109.20 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;)
alert tcp 109.234.109.21 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;)
alert tcp 109.234.109.80 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;)
alert tcp 109.235.249.19 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;)
alert tcp 109.235.59.104 any $HOME_NET any (msg:"ad2flash.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.237.130.62 any $HOME_NET any (msg:"bannercommunity.de"; classtype:trojan-activity; priority:1;)
alert tcp 109.237.138.40 any $HOME_NET any (msg:"pagerank4you.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.68.230.160 any $HOME_NET any (msg:"ad2games.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.71.162.230 any $HOME_NET any (msg:"awempire.com"; classtype:trojan-activity; priority:1;)
alert tcp 109.74.202.6 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.45.147.2 any $HOME_NET any (msg:"pro.i-doctor.co.kr"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.130 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.131 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.132 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.133 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.134 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.135 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.136 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.137 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.138 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.186.139 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.187.7 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 110.75.200.3 any $HOME_NET any (msg:"dmtracking.alibaba.com"; classtype:trojan-activity; priority:1;)
alert tcp 111.171.193.53 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 111.171.195.164 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 111.223.33.103 any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.121.185.190 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.140.42.24 any $HOME_NET any (msg:"x6.yakiuchi.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.175.233.250 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.175.255.100 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.175.255.20 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.175.255.21 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.175.255.32 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.175.255.33 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 112.78.196.110 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;)
alert tcp 113.107.107.39 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 113.107.42.34 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 113.107.96.156 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 113.107.96.157 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 113.11.203.92 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 114.112.176.12 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 114.112.176.21 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 114.112.176.218 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 114.112.176.88 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 114.80.101.42 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;)
alert tcp 114.80.101.52 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;)
alert tcp 115.112.200.66 any $HOME_NET any (msg:"campaign.bharatmatrimony.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.13 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.14 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.17 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.18 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.19 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.20 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.21 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.22 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.27 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.182.49.8 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.238.137.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.238.137.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 115.239.210.151 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;)
alert tcp 116.255.144.68 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 116.255.144.69 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 116.255.144.71 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 116.255.144.72 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 116.255.144.73 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 116.55.241.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 116.55.241.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 117.135.134.17 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;)
alert tcp 117.135.134.88 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;)
alert tcp 117.21.191.223 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 117.21.224.236 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 117.21.227.34 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 117.21.227.47 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 117.27.140.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 117.27.140.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 117.41.235.38 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 117.79.224.130 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 117.79.224.131 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 117.79.224.132 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.107.163.237 any $HOME_NET any (msg:"counter.nowlinux.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.123.202.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.123.202.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.127.5.199 any $HOME_NET any (msg:"adserver.flossiemediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.127.5.201 any $HOME_NET any (msg:"adserver.flossiemediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.13 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.14 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.17 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.19 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.20 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.21 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.22 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.27 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.145.5.8 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 118.219.254.2 any $HOME_NET any (msg:"pro.i-doctor.co.kr"; classtype:trojan-activity; priority:1;)
alert tcp 119.123.233.83 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.146.222.121 any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.147.114.19 any $HOME_NET any (msg:"51yes.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.147.47.121 any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.147.86.8 any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.15.70.147 any $HOME_NET any (msg:"ffxcam.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 119.15.70.9 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 119.245.243.82 any $HOME_NET any (msg:"xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.252.148.13 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.31.248.68 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.59.124.169 any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.12.181 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.12.182 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.12.183 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.12.184 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.12.185 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.13.165 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.13.166 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.13.167 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.13.168 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.77.13.169 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 119.84.122.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.84.122.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.84.77.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.84.77.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.97.134.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 119.97.134.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.105.227.60 any $HOME_NET any (msg:"101order.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.107.182.140 any $HOME_NET any (msg:"adprofile.net"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.1.15 any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.1.155 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.13.105 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.17.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.21.105 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.21.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.25.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.29.105 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.29.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.33.15 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.37.15 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.41.105 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.41.15 any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.45.15 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.5.15 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.69.15 any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.81.105 any $HOME_NET any (msg:"adsatt.espn.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.81.15 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.9.105 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.120.9.15 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.129.204.125 any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.129.206.71 any $HOME_NET any (msg:"ads.ipowerweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.14.155 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.3.118 any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.50.205 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.62.118 any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.62.126 any $HOME_NET any (msg:"atdmt.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.81.214 any $HOME_NET any (msg:"ch.questionmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.81.222 any $HOME_NET any (msg:"ch.questionmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.81.248 any $HOME_NET any (msg:"ch.questionmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.130.86.86 any $HOME_NET any (msg:"advert.bayarea.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.14.172.204 any $HOME_NET any (msg:"openad.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.153.20.133 any $HOME_NET any (msg:"hitcents.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.153.20.141 any $HOME_NET any (msg:"hitcents.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.153.20.149 any $HOME_NET any (msg:"hitcents.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.153.20.151 any $HOME_NET any (msg:"hitcents.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.153.224.22 any $HOME_NET any (msg:"etrade.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.158.190.23 any $HOME_NET any (msg:"updated.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.158.191.187 any $HOME_NET any (msg:"updated.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.158.191.26 any $HOME_NET any (msg:"updated.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.158.191.27 any $HOME_NET any (msg:"updated.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.158.234.169 any $HOME_NET any (msg:"adserver.gorillanation.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.163.148.9 any $HOME_NET any (msg:"ads.businessweek.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.163.148.99 any $HOME_NET any (msg:"ads.businessweek.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.171.94.36 any $HOME_NET any (msg:"ads.websiteservices.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.171.94.38 any $HOME_NET any (msg:"ads.websiteservices.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.171.94.40 any $HOME_NET any (msg:"7search.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.46.185.206 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 12.47.46.231 any $HOME_NET any (msg:"gostats.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.0.16.130 any $HOME_NET any (msg:"dmtracking.alibaba.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.10.132.223 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.10.132.235 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.10.173.39 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.11.149.28 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 121.11.69.211 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 121.11.69.212 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 121.12.173.157 any $HOME_NET any (msg:"51yes.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.12.173.212 any $HOME_NET any (msg:"51yes.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.14.35.166 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.14.35.167 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.254.178.252 any $HOME_NET any (msg:"e-debtconsolidation.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.254.178.253 any $HOME_NET any (msg:"e-debtconsolidation.com"; classtype:trojan-activity; priority:1;)
alert tcp 121.35.188.203 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 121.35.188.56 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 122.224.146.36 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 122.224.146.77 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 122.225.99.192 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.228.242.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.228.243.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.228.243.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.194.35 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.195.213 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.196.57 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.199.249 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.200.168 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.205.210 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.205.92 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.214.178 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.216.111 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.216.179 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.217.40 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.219.94 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 122.248.250.236 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp 123.125.115.43 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;)
alert tcp 123.125.115.50 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;)
alert tcp 123.125.115.51 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;)
alert tcp 124.108.65.81 any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 124.232.159.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 124.232.159.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 124.36.209.244 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp 125.46.39.91 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 125.46.73.195 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 125.46.73.250 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 125.46.73.252 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.1 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.11 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.12 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.123 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.13 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.16 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.17 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.2 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.6 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.7.34.7 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 125.76.224.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 125.76.224.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 125.76.247.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 125.76.247.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 125.89.71.11 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 125.89.71.39 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.11.42.61 any $HOME_NET any (msg:"burstnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.121.236.169 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.168.154 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.168.160 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.168.65 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.168.66 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.131 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.133 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.135 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.137 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.139 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.141 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.143 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.145 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.147 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.149 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.192 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.194 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.196 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.198 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.202 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.204 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.206 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.208 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.222 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.226 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.228 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.232 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.242 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.244 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.169.248 any $HOME_NET any (msg:"ads.icq.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.140.224.40 any $HOME_NET any (msg:"clickmedia.ro"; classtype:trojan-activity; priority:1;)
alert tcp 128.241.88.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.241.88.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.241.88.55 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp 128.242.118.131 any $HOME_NET any (msg:"ad-souk.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.242.118.139 any $HOME_NET any (msg:"quinst.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.242.120.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.242.120.22 any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.242.127.7 any $HOME_NET any (msg:"dmtracking2.alibaba.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.242.247.185 any $HOME_NET any (msg:"ads10.speedbit.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.242.249.133 any $HOME_NET any (msg:"ad.digitallook.com"; classtype:trojan-activity; priority:1;)
alert tcp 128.242.252.86 any $HOME_NET any (msg:"humanclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 129.121.239.156 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;)
alert tcp 129.121.53.4 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;)
alert tcp 129.250.159.170 any $HOME_NET any (msg:"iwin.com"; classtype:trojan-activity; priority:1;)
alert tcp 129.33.228.192 any $HOME_NET any (msg:"ru4.com"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.10 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.11 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.12 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.13 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.14 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.15 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.151 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.152 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.153 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.154 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.16 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.17 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.18 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.19 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.20 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.21 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.22 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.23 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.4 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.5 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.6 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.7 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.8 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.117.88.9 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 130.94.18.222 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp 130.94.183.145 any $HOME_NET any (msg:"berp.com"; classtype:trojan-activity; priority:1;)
alert tcp 130.94.201.230 any $HOME_NET any (msg:"whenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 130.94.21.10 any $HOME_NET any (msg:"secure.webconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp 130.94.70.82 any $HOME_NET any (msg:"secure.webconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp 130.94.74.189 any $HOME_NET any (msg:"shareasale.com"; classtype:trojan-activity; priority:1;)
alert tcp 130.94.79.174 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 131.253.13.32 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp 131.253.33.200 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp 133.237.4.12 any $HOME_NET any (msg:"ba.afl.rakuten.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp 133.242.16.16 any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp 133.242.9.191 any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp 134.0.26.179 any $HOME_NET any (msg:"top-casting-termine.de"; classtype:trojan-activity; priority:1;)
alert tcp 137.254.16.65 any $HOME_NET any (msg:"ads.sun.com"; classtype:trojan-activity; priority:1;)
alert tcp 14.136.202.31 any $HOME_NET any (msg:"adx.atnext.com"; classtype:trojan-activity; priority:1;)
alert tcp 14.63.233.90 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 140.174.9.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 140.174.9.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 140.174.9.55 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp 140.186.79.19 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 140.186.79.30 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 140.186.79.35 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 140.186.79.36 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 140.211.167.54 any $HOME_NET any (msg:"ads.linuxfoundation.org"; classtype:trojan-activity; priority:1;)
alert tcp 140.211.169.112 any $HOME_NET any (msg:"ads.linuxfoundation.org"; classtype:trojan-activity; priority:1;)
alert tcp 140.211.169.30 any $HOME_NET any (msg:"ads.linuxfoundation.org"; classtype:trojan-activity; priority:1;)
alert tcp 140.211.169.32 any $HOME_NET any (msg:"ads.linuxfoundation.org"; classtype:trojan-activity; priority:1;)
alert tcp 140.211.169.4 any $HOME_NET any (msg:"ads.linuxfoundation.org"; classtype:trojan-activity; priority:1;)
alert tcp 140.99.102.68 any $HOME_NET any (msg:"ads.betanews.com"; classtype:trojan-activity; priority:1;)
alert tcp 140.99.94.175 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 141.0.168.7 any $HOME_NET any (msg:"enoratraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.0.173.86 any $HOME_NET any (msg:"trafficfactory.biz"; classtype:trojan-activity; priority:1;)
alert tcp 141.0.173.87 any $HOME_NET any (msg:"trafficfactory.biz"; classtype:trojan-activity; priority:1;)
alert tcp 141.0.23.181 any $HOME_NET any (msg:"mr-rank.de"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.112.11 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.112.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.112.42 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.113.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.113.42 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.114.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.115.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.116.137 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.116.64 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.117.137 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.117.64 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.123.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.101.123.42 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 141.138.198.120 any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;)
alert tcp 141.8.224.183 any $HOME_NET any (msg:"pay-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.8.224.185 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.8.224.25 any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.8.224.67 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;)
alert tcp 141.8.225.1 any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp 141.8.225.21 any $HOME_NET any (msg:"adcept.net"; classtype:trojan-activity; priority:1;)
alert tcp 142.4.0.31 any $HOME_NET any (msg:"affiliate.mogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 142.4.210.21 any $HOME_NET any (msg:"top90.ro"; classtype:trojan-activity; priority:1;)
alert tcp 142.4.45.147 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;)
alert tcp 144.140.254.208 any $HOME_NET any (msg:"ad1.pamedia.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 144.76.199.138 any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;)
alert tcp 144.76.37.44 any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;)
alert tcp 144.76.39.37 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;)
alert tcp 146.101.66.152 any $HOME_NET any (msg:"banners.resultonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.185.22.76 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.185.22.80 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.109.225 any $HOME_NET any (msg:"trafficsyndicate.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.138.194 any $HOME_NET any (msg:"admotion.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.202.112 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.202.121 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.202.87 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.202.88 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.203.172 any $HOME_NET any (msg:"trafficadept.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.205.104 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.205.119 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.205.123 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.205.96 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.205.97 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.205.99 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.206.237 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 146.82.206.34 any $HOME_NET any (msg:"tour.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 147.136.250.60 any $HOME_NET any (msg:"ads.belointeractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 147.202.86.254 any $HOME_NET any (msg:"banners.isoftmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp 147.208.15.16 any $HOME_NET any (msg:"ads.netmechanic.com"; classtype:trojan-activity; priority:1;)
alert tcp 147.208.169.72 any $HOME_NET any (msg:"ads.satyamonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 147.208.175.16 any $HOME_NET any (msg:"affiliates.allposters.com"; classtype:trojan-activity; priority:1;)
alert tcp 149.13.34.195 any $HOME_NET any (msg:"gamehouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 149.210.134.160 any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.162.118 any $HOME_NET any (msg:"fast-adv.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.162.4 any $HOME_NET any (msg:"fast-adv.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.162.8 any $HOME_NET any (msg:"fast-adv.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.182.150 any $HOME_NET any (msg:"fast-adv.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.244.150 any $HOME_NET any (msg:"adserver.html.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.244.178 any $HOME_NET any (msg:"adserver.html.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.244.197 any $HOME_NET any (msg:"adserver.html.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.244.2 any $HOME_NET any (msg:"adv.hwupgrade.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.32.173 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.32.174 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.32.177 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.32.178 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.33.3 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.65.8 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.67.219 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.67.220 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.67.222 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.67.228 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.67.229 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.67.230 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.1.67.231 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.93.133 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.93.83 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.136 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.139 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.14 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.140 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.15 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.18 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.205 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.210 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.23 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.68 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.7 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.71 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.73 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.77 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.79 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.8 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.80 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.81 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.84 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.86 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.88 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 151.249.94.89 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.208.121 any $HOME_NET any (msg:"ads.web.cs.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.208.185 any $HOME_NET any (msg:"ads.web.cs.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.208.249 any $HOME_NET any (msg:"ads.web.cs.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.208.57 any $HOME_NET any (msg:"ads.web.cs.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.226.121 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.226.153 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.226.185 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.226.25 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.226.57 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 152.163.226.89 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 154.53.129.43 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 154.53.129.44 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 154.53.129.45 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 154.53.129.47 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 156.154.164.9 any $HOME_NET any (msg:"juicyads.com"; classtype:trojan-activity; priority:1;)
alert tcp 157.151.81.100 any $HOME_NET any (msg:"aaddzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 157.22.33.57 any $HOME_NET any (msg:"toprebates.com"; classtype:trojan-activity; priority:1;)
alert tcp 158.127.18.27 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp 158.127.30.72 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp 158.255.224.131 any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;)
alert tcp 158.255.224.136 any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.226.251.12 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.33.1.57 any $HOME_NET any (msg:"ads.cbc.ca"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.238.18 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.238.2 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.238.23 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.238.69 any $HOME_NET any (msg:"ad.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.239.2 any $HOME_NET any (msg:"ads.desmoinesregister.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.239.72 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.34.142 any $HOME_NET any (msg:"ad.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.34.17 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.34.194 any $HOME_NET any (msg:"ad.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 159.54.34.225 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 160.7.249.22 any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;)
alert tcp 161.58.12.234 any $HOME_NET any (msg:"ads.internic.co.il"; classtype:trojan-activity; priority:1;)
alert tcp 161.58.178.209 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;)
alert tcp 161.58.179.169 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp 161.58.181.137 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp 161.58.187.157 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;)
alert tcp 161.58.191.254 any $HOME_NET any (msg:"shareasale.com"; classtype:trojan-activity; priority:1;)
alert tcp 161.58.56.25 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 161.58.80.46 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 161.69.13.22 any $HOME_NET any (msg:"ads.mcafee.com"; classtype:trojan-activity; priority:1;)
alert tcp 162.144.0.192 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 162.144.1.246 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 162.42.211.167 any $HOME_NET any (msg:"adsynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 164.109.17.16 any $HOME_NET any (msg:"ads.businessweek.com"; classtype:trojan-activity; priority:1;)
alert tcp 164.115.2.134 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp 164.115.2.135 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp 164.115.2.144 any $HOME_NET any (msg:"truehits1.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp 164.115.2.146 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp 164.115.2.149 any $HOME_NET any (msg:"truehits.net"; classtype:trojan-activity; priority:1;)
alert tcp 164.115.31.100 any $HOME_NET any (msg:"truehits.net"; classtype:trojan-activity; priority:1;)
alert tcp 164.115.31.102 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp 164.115.31.103 any $HOME_NET any (msg:"truehits2.gits.net.th"; classtype:trojan-activity; priority:1;)
alert tcp 165.193.122.234 any $HOME_NET any (msg:"ads.ft.com"; classtype:trojan-activity; priority:1;)
alert tcp 165.193.245.54 any $HOME_NET any (msg:"adwhirl.com"; classtype:trojan-activity; priority:1;)
alert tcp 165.193.78.137 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;)
alert tcp 165.193.78.159 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;)
alert tcp 165.193.78.248 any $HOME_NET any (msg:"voicefive.com"; classtype:trojan-activity; priority:1;)
alert tcp 165.193.78.252 any $HOME_NET any (msg:"scorecardresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 165.254.10.90 any $HOME_NET any (msg:"whenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 166.78.85.233 any $HOME_NET any (msg:"justrelevant.com"; classtype:trojan-activity; priority:1;)
alert tcp 166.78.95.129 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 167.216.227.182 any $HOME_NET any (msg:"ads.ft.com"; classtype:trojan-activity; priority:1;)
alert tcp 167.8.128.40 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 167.8.128.41 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 167.8.226.26 any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.103.22.243 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.143.117.49 any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.143.35.194 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.143.84.99 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.144.168.116 any $HOME_NET any (msg:"monsterpops.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.161.242.59 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.215.71.119 any $HOME_NET any (msg:"inboxdollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.215.71.242 any $HOME_NET any (msg:"adimages.carsoup.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.215.71.243 any $HOME_NET any (msg:"admanager.carsoup.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.62.30.182 any $HOME_NET any (msg:"ads.geekswithblogs.net"; classtype:trojan-activity; priority:1;)
alert tcp 168.75.211.34 any $HOME_NET any (msg:"adminder.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.75.65.73 any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.75.65.86 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.75.66.156 any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;)
alert tcp 168.75.66.158 any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;)
alert tcp 170.149.168.130 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 170.149.172.130 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 170.224.10.170 any $HOME_NET any (msg:"viewpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 170.224.109.13 any $HOME_NET any (msg:"ru4.com"; classtype:trojan-activity; priority:1;)
alert tcp 170.224.21.170 any $HOME_NET any (msg:"viewpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 172.228.163.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.0.67.27 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.160.113.22 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.13.229 any $HOME_NET any (msg:"free-banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.146.14 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.200.107 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.200.108 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.200.109 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.200.110 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.200.111 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.200.112 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.200.113 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.200.114 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.21.2 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.21.3 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.226.211 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.226.215 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.226.216 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.226.217 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.33.225 any $HOME_NET any (msg:"easyhits4u.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.76.133 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.76.134 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.76.138 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.192.76.171 any $HOME_NET any (msg:"ads.co.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.193.15.18 any $HOME_NET any (msg:"net-filter.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.193.174.194 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.193.232.226 any $HOME_NET any (msg:"yabuka.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.193.60.72 any $HOME_NET any (msg:"smowtion.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.105 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.106 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.107 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.108 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.109 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.110 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.111 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.121 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.122 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.123 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.124 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.128 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.129 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.130 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.131 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.132 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.133 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.134 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.135 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.136 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.137 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.138 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.139 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.140 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.141 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.142 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.143 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.144 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.145 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.146 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.147 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.148 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.153 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.155 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.156 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.160 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.161 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.162 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.163 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.164 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.165 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.166 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.167 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.168 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.169 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.170 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.171 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.172 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.173 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.174 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.175 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.176 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.177 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.178 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.179 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.180 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.185 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.186 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.187 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.188 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.64 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.65 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.66 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.67 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.68 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.69 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.70 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.71 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.72 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.73 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.74 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.75 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.76 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.77 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.78 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.89 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.90 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.91 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.92 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.96 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.97 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.98 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.34.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.36.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.37.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.105 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.106 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.107 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.108 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.109 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.110 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.121 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.122 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.123 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.124 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.128 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.129 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.130 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.131 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.132 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.133 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.134 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.135 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.136 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.137 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.138 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.139 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.140 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.141 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.142 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.143 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.144 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.145 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.146 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.148 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.153 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.155 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.156 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.160 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.161 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.162 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.163 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.164 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.165 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.166 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.167 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.168 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.169 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.170 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.171 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.172 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.173 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.174 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.185 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.186 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.187 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.188 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.64 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.65 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.66 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.67 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.68 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.69 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.70 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.71 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.72 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.73 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.74 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.75 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.76 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.77 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.78 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.89 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.90 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.91 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.92 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.96 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.97 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.98 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.41.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.65.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.65.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.65.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.65.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.65.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.65.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.132 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.148 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.149 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.155 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.156 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.157 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.164 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.165 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.166 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.167 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.66.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.67.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.70.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.70.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.70.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.70.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.70.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.70.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.132 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.148 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.149 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.154 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.155 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.156 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.157 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.194.78.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.199.115.168 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.199.120.68 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.199.133.86 any $HOME_NET any (msg:"liftdna.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.199.149.66 any $HOME_NET any (msg:"seeq.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.199.149.72 any $HOME_NET any (msg:"seeq.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.201.20.57 any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.201.239.14 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.203.107.183 any $HOME_NET any (msg:"ads.einmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.203.107.239 any $HOME_NET any (msg:"ads.einmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.203.191.118 any $HOME_NET any (msg:"campaign.bharatmatrimony.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.203.60.104 any $HOME_NET any (msg:"ads.virtualcountries.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.203.89.94 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.204.49.131 any $HOME_NET any (msg:"ads-click.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.208.154.130 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.172 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.177 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.178 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.183 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.184 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.186 any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.199 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.209 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.210 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.228 any $HOME_NET any (msg:"bannieres.acces-contenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.229 any $HOME_NET any (msg:"directivepub.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.232 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.243 any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.212.56.97 any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;)
alert tcp 173.214.168.171 any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.224.124.149 any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.224.124.177 any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.225.27.85 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.102 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.108 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.117 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.14 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.20 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.23 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.26 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.29 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.227.66.5 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.230.128.105 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.230.141.57 any $HOME_NET any (msg:"carbonads.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.231.140.218 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.231.140.219 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.236.110.98 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.236.165.119 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.236.184.111 any $HOME_NET any (msg:"ads.hideyourarms.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.236.188.251 any $HOME_NET any (msg:"oxen.hillcountrytexas.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.236.31.170 any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.240.1.37 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.240.1.38 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.241.1.178 any $HOME_NET any (msg:"ads.datinggold.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.241.136.109 any $HOME_NET any (msg:"crispads.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.241.240.4 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.245.60.121 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.245.60.15 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 173.245.60.44 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.245.61.145 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 173.245.61.15 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 173.245.61.30 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 173.245.61.56 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 173.251.68.85 any $HOME_NET any (msg:"percentmobile.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.255.205.157 any $HOME_NET any (msg:"flurry.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.255.229.104 any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.255.248.208 any $HOME_NET any (msg:"fusionads.net"; classtype:trojan-activity; priority:1;)
alert tcp 173.255.250.118 any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.44.62.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.45.100.242 any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.45.161.14 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.46.7.31 any $HOME_NET any (msg:"opienetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 173.8.109.182 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.0.156 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.113.133 any $HOME_NET any (msg:"directaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.120.175 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.120.208 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.120.221 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.120.229 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.139.9 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.152.167 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.152.186 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.167.162 any $HOME_NET any (msg:"adserver.portalofevil.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.244.229 any $HOME_NET any (msg:"tizers.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.120.252.45 any $HOME_NET any (msg:"clkads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.121.38.247 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;)
alert tcp 174.122.238.251 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.123.148.178 any $HOME_NET any (msg:"affiliate.mogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.123.154.147 any $HOME_NET any (msg:"ads.justhungry.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.123.175.226 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.123.30.237 any $HOME_NET any (msg:"idcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.123.55.226 any $HOME_NET any (msg:"blogtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.127.101.225 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.127.127.178 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.128.237.30 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.102.210 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.11.178 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.12.237 any $HOME_NET any (msg:"cetrk.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.122.46 any $HOME_NET any (msg:"viewpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.14.235 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.16.231 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.17.142 any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.19.78 any $HOME_NET any (msg:"admarvel.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.2.142 any $HOME_NET any (msg:"picadmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.2.71 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.20.213 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.201.226 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.201.230 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.203.88 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.205.223 any $HOME_NET any (msg:"ads.tahono.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.209.156 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.21.25 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.213.25 any $HOME_NET any (msg:"affiliate.offgamers.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.216.213 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.217.153 any $HOME_NET any (msg:"gvisit.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.218.62 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.220.107 any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.222.175 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.223.195 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.227.33 any $HOME_NET any (msg:"chartbeat.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.229.200 any $HOME_NET any (msg:"advertpro.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.232.188 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.233.103 any $HOME_NET any (msg:"impressionz.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.233.188 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.235.147 any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.236.152 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.240.12 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.243.62 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.244.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.249.79 any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.25.217 any $HOME_NET any (msg:"smowtion.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.252.108 any $HOME_NET any (msg:"servedbyopenx.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.253.18 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.28.138 any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.28.68 any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.29.15 any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.30.89 any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.35.49 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.4.121 any $HOME_NET any (msg:"mastermind.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.40.79 any $HOME_NET any (msg:"radarurl.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.43.138 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.43.206 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.44.143 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.129.7.234 any $HOME_NET any (msg:"adwhirl.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.132.110.250 any $HOME_NET any (msg:"adreactor.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.132.242.50 any $HOME_NET any (msg:"blogrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.132.34.18 any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.132.65.58 any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.132.67.194 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.132.67.76 any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.133.203.114 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.133.78.191 any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.133.96.9 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.136.107.84 any $HOME_NET any (msg:"ad.nozonedata.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.114.57 any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.114.60 any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.114.62 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.125.110 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.125.35 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.125.36 any $HOME_NET any (msg:"actionsplash.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.125.68 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.125.78 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.125.92 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.125.95 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.132.28 any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.182.164 any $HOME_NET any (msg:"privatecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.137.34.105 any $HOME_NET any (msg:"videoegg.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.140.166.211 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 174.140.17.100 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.11.178 any $HOME_NET any (msg:"radarurl.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.113.41 any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.113.46 any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.183.86 any $HOME_NET any (msg:"affbuzzads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.19.190 any $HOME_NET any (msg:"openx.blindferret.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.207.198 any $HOME_NET any (msg:"midnightclicking.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.251.52 any $HOME_NET any (msg:"affbuzzads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.251.53 any $HOME_NET any (msg:"ads.pushplay.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.79.83 any $HOME_NET any (msg:"radarurl.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.142.90.140 any $HOME_NET any (msg:"class-act-clicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.100.53 any $HOME_NET any (msg:"liveintent.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.114.147 any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.140.88 any $HOME_NET any (msg:"stats.olark.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.172.51 any $HOME_NET any (msg:"tlvmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.211.138 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.211.253 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.212.219 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.234.59 any $HOME_NET any (msg:"yoggrt.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.241.129 any $HOME_NET any (msg:"theadhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.241.76 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.242.228 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.242.242 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.243.5 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.243.8 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.45.106 any $HOME_NET any (msg:"justrelevant.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.45.129 any $HOME_NET any (msg:"admeta.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.51.42 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.53.252 any $HOME_NET any (msg:"blogherads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.143.73.146 any $HOME_NET any (msg:"at-adserver.alltop.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.34.228.181 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.34.255.64 any $HOME_NET any (msg:"zeusclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.35.64.38 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.35.64.49 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.35.65.93 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.35.66.74 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.35.66.82 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.35.67.30 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.103.119 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.103.124 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.105.208 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.105.210 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.11.48 any $HOME_NET any (msg:"cashlayer.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.114.21 any $HOME_NET any (msg:"ads.cricbuzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.138.28 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.193.150 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.232.136 any $HOME_NET any (msg:"histats.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.240.233 any $HOME_NET any (msg:"histats.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.45.48 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.58.233 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.36.6.58 any $HOME_NET any (msg:"itsptp.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.147.184 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.154.104 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.154.236 any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.172.68 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.172.69 any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.205.202 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.207.102 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.214.225 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.234.56 any $HOME_NET any (msg:"gtop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.251.18 any $HOME_NET any (msg:"yabuka.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.37.33.236 any $HOME_NET any (msg:"pay-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.46.248.90 any $HOME_NET any (msg:"precisionclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.47.188.40 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.47.188.5 any $HOME_NET any (msg:"ads.glispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.47.188.6 any $HOME_NET any (msg:"onenetworkdirect.com"; classtype:trojan-activity; priority:1;)
alert tcp 174.47.188.8 any $HOME_NET any (msg:"affiliates.digitalriver.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.139.218 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.154.13 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.163.74 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.164.117 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.167.119 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.169.96 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.172.191 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.173.86 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.176.16 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.176.88 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.178.71 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.179.16 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.184.32 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.186.8 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 175.41.3.36 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.28.52.151 any $HOME_NET any (msg:"webmaster-partnerprogramme24.de"; classtype:trojan-activity; priority:1;)
alert tcp 176.31.115.188 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.31.89.10 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.192 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.193 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.195 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.198 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.201 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.240 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.248 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.64 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.67 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.68 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.72 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.100.75 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.101.129 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.101.137 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.101.145 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.101.148 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.101.65 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.101.73 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.101.8 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.102.122 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.102.41 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.102.49 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.102.57 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.97.252 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.98.226 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.98.230 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.98.233 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.98.234 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.98.238 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.100 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.112 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.153 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.161 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.164 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.201 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.204 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.212 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.217 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.35 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.39 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.43 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.47 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.32.99.96 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.100.20 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.106.2 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.109.100 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.109.246 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.117.117 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.117.169 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.132.146 any $HOME_NET any (msg:"ad.crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.132.183 any $HOME_NET any (msg:"ad.crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.132.201 any $HOME_NET any (msg:"ad.crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.184.204 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.185.182 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.186.134 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.190.192 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.191.0 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.191.3 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.191.4 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.191.5 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.224.77 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.224.89 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.224.94 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.225.120 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.225.33 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.227.166 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.234.52 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.243.178 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.244.227 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.250.173 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.250.175 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.252.9 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.34.96.235 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 176.58.105.10 any $HOME_NET any (msg:"clickcompare.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 176.58.111.49 any $HOME_NET any (msg:"buyhitscheap.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.74.176.167 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.74.176.178 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.74.176.179 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.12.70 any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.127.79 any $HOME_NET any (msg:"wholesaletraffic.info"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.168.254 any $HOME_NET any (msg:"rank-master.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.195.100 any $HOME_NET any (msg:"advertisingbox.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.224.89 any $HOME_NET any (msg:"yieldads.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.30.231 any $HOME_NET any (msg:"rb1.design.ru"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.38.163 any $HOME_NET any (msg:"net-filter.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.45.195 any $HOME_NET any (msg:"linktarget.com"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.46.73 any $HOME_NET any (msg:"ad.nachtagenten.de"; classtype:trojan-activity; priority:1;)
alert tcp 176.9.83.231 any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;)
alert tcp 178.18.138.60 any $HOME_NET any (msg:"hollandbusinessadvertising.nl"; classtype:trojan-activity; priority:1;)
alert tcp 178.18.22.157 any $HOME_NET any (msg:"ads.ultimate-guitar.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.18.22.159 any $HOME_NET any (msg:"ads.ultimate-guitar.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.20.8.56 any $HOME_NET any (msg:"ads.krawall.de"; classtype:trojan-activity; priority:1;)
alert tcp 178.217.244.6 any $HOME_NET any (msg:"ads2.xnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp 178.250.0.87 any $HOME_NET any (msg:"criteo.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.32.3.115 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.32.5.13 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.32.5.2 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.33.130.39 any $HOME_NET any (msg:"advertstream.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.33.210.24 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 178.63.121.138 any $HOME_NET any (msg:"pagerank-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp 178.63.130.36 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 178.63.30.19 any $HOME_NET any (msg:"experteerads.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.63.30.79 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.63.45.1 any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;)
alert tcp 178.63.48.27 any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;)
alert tcp 178.63.48.50 any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;)
alert tcp 178.73.224.61 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;)
alert tcp 178.77.91.4 any $HOME_NET any (msg:"teliad.de"; classtype:trojan-activity; priority:1;)
alert tcp 178.79.152.45 any $HOME_NET any (msg:"ewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 178.79.153.133 any $HOME_NET any (msg:"ukbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 180.137.255.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 180.137.255.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 180.179.78.6 any $HOME_NET any (msg:"admagnet.net"; classtype:trojan-activity; priority:1;)
alert tcp 180.188.130.168 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 180.188.173.89 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 180.96.17.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 180.96.17.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 182.131.17.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 182.131.17.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 182.140.130.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 182.140.130.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 182.48.20.237 any $HOME_NET any (msg:"clicktrack.ziyu.net"; classtype:trojan-activity; priority:1;)
alert tcp 182.48.27.8 any $HOME_NET any (msg:"azfront.com"; classtype:trojan-activity; priority:1;)
alert tcp 182.48.45.175 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;)
alert tcp 183.60.136.42 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 183.60.136.43 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 183.60.136.44 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 183.60.136.45 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 183.60.136.46 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 183.60.136.65 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.105.177.9 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.106.107.123 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.106.112.30 any $HOME_NET any (msg:"yabuka.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.106.113.79 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.106.162.192 any $HOME_NET any (msg:"profero.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.106.218.127 any $HOME_NET any (msg:"adtoll.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.106.218.181 any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.106.40.102 any $HOME_NET any (msg:"reedbusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.107.176.141 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.107.179.18 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.107.233.122 any $HOME_NET any (msg:"radarurl.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.107.247.2 any $HOME_NET any (msg:"british-banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.154.131.18 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 184.154.158.58 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 184.154.27.234 any $HOME_NET any (msg:"affiliates.babylon.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.154.42.132 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.154.83.2 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.164.68.45 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.192.134 any $HOME_NET any (msg:"audience2media.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.198.1 any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.11 any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.29 any $HOME_NET any (msg:"adexpose.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.32 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.35 any $HOME_NET any (msg:"adthis.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.44 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.5 any $HOME_NET any (msg:"fusionquest.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.52 any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.53 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.74 any $HOME_NET any (msg:"tizers.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.81 any $HOME_NET any (msg:"shareadspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.82 any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.83 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.88 any $HOME_NET any (msg:"targetingnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.221.96 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.230.1 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.168.60.1 any $HOME_NET any (msg:"7bpeople.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.134.55 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.136.91 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.137.103 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.141.196 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.143.195 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.151.104 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.152.104 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.154.252 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.154.28 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.155.27 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.157.176 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.169.160.119 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.171.243.83 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 184.172.159.35 any $HOME_NET any (msg:"toplistcity.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.172.163.192 any $HOME_NET any (msg:"funpageexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.172.173.14 any $HOME_NET any (msg:"tntclix.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 184.172.176.21 any $HOME_NET any (msg:"gator.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.172.32.211 any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.172.61.109 any $HOME_NET any (msg:"ads.co.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.173.142.195 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.173.144.76 any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.173.170.82 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.173.170.84 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.173.190.238 any $HOME_NET any (msg:"aistat.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.173.198.30 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.173.227.227 any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;)
alert tcp 184.50.25.155 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 184.50.25.161 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.145.174 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.217.144 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.222.11 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.222.208 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.222.69 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.223.181 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.225.218 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.226.15 any $HOME_NET any (msg:"trafficsecrets.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.230.138 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.238.78 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.239.114 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.243.126 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.251.95 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.252.42 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.34.12 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.35.89 any $HOME_NET any (msg:"adsymptotic.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.38.83 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.40.142 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.48.158 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.49.147 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.50.104 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.53.95 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.55.242 any $HOME_NET any (msg:"bluewhaleweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.56.252 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.56.78 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.57.7 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.62.187 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.63.127 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.72.63.194 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.155.159 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.157.167 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.157.169 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.158.147 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.168.169 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.168.97 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.172.97 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.173.83 any $HOME_NET any (msg:"tapad.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.179.240 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.181.220 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.182.116 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.203.202 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.208.18 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.218.61 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.219.21 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.220.206 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.222.134 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.226.176 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.227.129 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.227.206 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.228.195 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.229.70 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.230.215 any $HOME_NET any (msg:"smowtion.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.232.179 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.233.176 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.234.18 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.235.191 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.241.202 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.73.252.202 any $HOME_NET any (msg:"identads.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.82.236.89 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 184.85.205.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.16.129 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.16.131 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.16.192 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.17.129 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.17.192 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.18.129 any $HOME_NET any (msg:"track.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.18.131 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.18.192 any $HOME_NET any (msg:"track.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.18.194 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.19.129 any $HOME_NET any (msg:"track.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.19.131 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.19.192 any $HOME_NET any (msg:"track.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.31.19.194 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 185.33.52.68 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;)
alert tcp 187.31.192.6 any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 188.120.243.65 any $HOME_NET any (msg:"wmirk.ru"; classtype:trojan-activity; priority:1;)
alert tcp 188.120.246.197 any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp 188.125.82.39 any $HOME_NET any (msg:"adserver.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.138.117.219 any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.138.16.84 any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.138.86.110 any $HOME_NET any (msg:"trendcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.138.99.203 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.126.242 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.17.196 any $HOME_NET any (msg:"novem.pl"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.208.157 any $HOME_NET any (msg:"sexystat.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.32.146 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.32.158 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.32.199 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.33.86 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.95.83 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.165.95.84 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.240.88.251 any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.102.72 any $HOME_NET any (msg:"fc.webmasterpro.de"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.117.12 any $HOME_NET any (msg:"adboost.de.vu"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.128.14 any $HOME_NET any (msg:"commindo-media-ressourcen.de"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.175.83 any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.236.153 any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.29.131 any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.52.146 any $HOME_NET any (msg:"mypagerank.ru"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.68.199 any $HOME_NET any (msg:"top123.ro"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.70.27 any $HOME_NET any (msg:"adboost.de.vu"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.70.29 any $HOME_NET any (msg:"adboost.de.vu"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.70.45 any $HOME_NET any (msg:"adboost.de.vu"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.79.136 any $HOME_NET any (msg:"grafstat.ro"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.79.179 any $HOME_NET any (msg:"admedia.ro"; classtype:trojan-activity; priority:1;)
alert tcp 188.40.81.145 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;)
alert tcp 188.64.58.124 any $HOME_NET any (msg:"ad.onad.eu"; classtype:trojan-activity; priority:1;)
alert tcp 188.65.183.182 any $HOME_NET any (msg:"banner.casino.net"; classtype:trojan-activity; priority:1;)
alert tcp 188.65.61.50 any $HOME_NET any (msg:"affiliatefuture.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.65.61.61 any $HOME_NET any (msg:"vertadnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.93.15.70 any $HOME_NET any (msg:"mr-rank.de"; classtype:trojan-activity; priority:1;)
alert tcp 188.93.8.30 any $HOME_NET any (msg:"muwmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 188.95.224.186 any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;)
alert tcp 188.95.49.42 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;)
alert tcp 188.95.49.72 any $HOME_NET any (msg:"adskape.ru"; classtype:trojan-activity; priority:1;)
alert tcp 190.210.100.72 any $HOME_NET any (msg:"harrenmedianetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.210.100.86 any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.240.10 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.240.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.240.178 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.240.42 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.241.10 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.241.119 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.241.178 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.242.10 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.242.166 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.243.10 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.243.166 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.243.41 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.244.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.245.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.246.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.247.4 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.248.22 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.249.22 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.250.41 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.250.67 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.251.41 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.251.67 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.252.179 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.252.31 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.252.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.253.179 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.253.31 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 190.93.253.6 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.0.80.247 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.0.80.248 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.104.182.105 any $HOME_NET any (msg:"adsys.townnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.104.182.111 any $HOME_NET any (msg:"stats.townnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.114.68.46 any $HOME_NET any (msg:"ads.jpost.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.114.68.48 any $HOME_NET any (msg:"ads.jpost.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.114.68.50 any $HOME_NET any (msg:"ads.jpost.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.114.68.62 any $HOME_NET any (msg:"ads.jpost.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.148.26.68 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.155.48.93 any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.155.50.93 any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.107.94 any $HOME_NET any (msg:"slickaffiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.16.163 any $HOME_NET any (msg:"tntclix.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.194.35 any $HOME_NET any (msg:"alladvantage.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.20.36 any $HOME_NET any (msg:"funpageexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.21.186 any $HOME_NET any (msg:"topsite.lv"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.225.201 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.34.198 any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.37.235 any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.39.38 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.5.33 any $HOME_NET any (msg:"gator.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.99.201 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.185.99.63 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.206.150.192 any $HOME_NET any (msg:"ads.thestar.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.221.106.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.221.111.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.221.111.253 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.221.115.254 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 192.221.120.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.221.97.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 192.237.150.253 any $HOME_NET any (msg:"ads.kelbymediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.237.165.27 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.245.235.5 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.254.237.121 any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.13 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.143 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.149 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.162 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.17 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.22 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.23 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.24 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.31 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.51 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.31.186.8 any $HOME_NET any (msg:"adbooth.net"; classtype:trojan-activity; priority:1;)
alert tcp 192.41.45.75 any $HOME_NET any (msg:"ads.internic.co.il"; classtype:trojan-activity; priority:1;)
alert tcp 192.71.58.232 any $HOME_NET any (msg:"ads.fotosidan.se"; classtype:trojan-activity; priority:1;)
alert tcp 192.95.22.192 any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;)
alert tcp 192.95.33.163 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.105.127.48 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.153.102 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.153.110 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.153.117 any $HOME_NET any (msg:"a32.g.a.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.153.132 any $HOME_NET any (msg:"a32.g.a.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.153.133 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.153.84 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.89.46 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.89.48 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.108.89.49 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.110.128.200 any $HOME_NET any (msg:"elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 193.110.128.209 any $HOME_NET any (msg:"elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 193.110.128.212 any $HOME_NET any (msg:"elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 193.110.128.95 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 193.110.128.96 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 193.110.128.99 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 193.110.146.70 any $HOME_NET any (msg:"ktu.sv2.biz"; classtype:trojan-activity; priority:1;)
alert tcp 193.110.146.71 any $HOME_NET any (msg:"ktu.sv2.biz"; classtype:trojan-activity; priority:1;)
alert tcp 193.111.160.200 any $HOME_NET any (msg:"ads.hbv.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.111.199.175 any $HOME_NET any (msg:"addcontrol.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.125.152.10 any $HOME_NET any (msg:"banner.relcom.ru"; classtype:trojan-activity; priority:1;)
alert tcp 193.126.240.136 any $HOME_NET any (msg:"ads1.mediacapital.pt"; classtype:trojan-activity; priority:1;)
alert tcp 193.13.74.166 any $HOME_NET any (msg:"adcenter.mdf.se"; classtype:trojan-activity; priority:1;)
alert tcp 193.138.212.50 any $HOME_NET any (msg:"banner.buempliz-online.ch"; classtype:trojan-activity; priority:1;)
alert tcp 193.138.214.40 any $HOME_NET any (msg:"banner.buempliz-online.ch"; classtype:trojan-activity; priority:1;)
alert tcp 193.142.100.166 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;)
alert tcp 193.149.121.11 any $HOME_NET any (msg:"pubs.lemonde.fr"; classtype:trojan-activity; priority:1;)
alert tcp 193.149.47.50 any $HOME_NET any (msg:"euroclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.149.47.51 any $HOME_NET any (msg:"euroclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.149.47.65 any $HOME_NET any (msg:"euroclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.149.47.98 any $HOME_NET any (msg:"ad.amgdgt.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.131.150 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.131.165 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.131.171 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.131.173 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.131.20 any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.133.215 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.139.34 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.139.35 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.139.37 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.140.205 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.164.140.213 any $HOME_NET any (msg:"ad.httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.169.104.240 any $HOME_NET any (msg:"adsmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.169.188.117 any $HOME_NET any (msg:"a.0day.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp 193.169.234.204 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.169.234.205 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.169.66.18 any $HOME_NET any (msg:"ad.eurosport.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.17.41.167 any $HOME_NET any (msg:"ads.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp 193.17.41.242 any $HOME_NET any (msg:"adserver.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp 193.17.41.30 any $HOME_NET any (msg:"adserver.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp 193.17.41.75 any $HOME_NET any (msg:"adserver.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp 193.17.41.97 any $HOME_NET any (msg:"ads.o2.pl"; classtype:trojan-activity; priority:1;)
alert tcp 193.178.145.193 any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.189.137.205 any $HOME_NET any (msg:"quarterserver.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.19.137.248 any $HOME_NET any (msg:"webcounter.goweb.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.19.159.130 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.19.159.131 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.19.159.133 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.192.41.2 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.201.10.242 any $HOME_NET any (msg:"tfag.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.201.12.48 any $HOME_NET any (msg:"statistik.motorpresse.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.201.12.58 any $HOME_NET any (msg:"fragmentserv.iac-online.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.202.82.155 any $HOME_NET any (msg:"ads.deltha.hu"; classtype:trojan-activity; priority:1;)
alert tcp 193.202.83.19 any $HOME_NET any (msg:"ctnetwork.hu"; classtype:trojan-activity; priority:1;)
alert tcp 193.203.227.118 any $HOME_NET any (msg:"adserver.betandwin.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.22.164.62 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.223.101.160 any $HOME_NET any (msg:"adspace.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.223.101.174 any $HOME_NET any (msg:"chestionar.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.223.101.26 any $HOME_NET any (msg:"chestionar.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.223.101.43 any $HOME_NET any (msg:"adspace.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.226.128.1 any $HOME_NET any (msg:"grafstat.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.226.140.107 any $HOME_NET any (msg:"clickmedia.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.226.140.169 any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.226.140.246 any $HOME_NET any (msg:"grafstat.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.226.140.81 any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.226.140.84 any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.226.171.188 any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.227.204.179 any $HOME_NET any (msg:"ad.tv2.no"; classtype:trojan-activity; priority:1;)
alert tcp 193.229.3.120 any $HOME_NET any (msg:"banner.elisa.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.231.123.227 any $HOME_NET any (msg:"boom.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.231.187.33 any $HOME_NET any (msg:"best-top.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.231.202.29 any $HOME_NET any (msg:"ip.ro"; classtype:trojan-activity; priority:1;)
alert tcp 193.239.249.18 any $HOME_NET any (msg:"partnercash.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.239.4.55 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.239.5.103 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.239.68.42 any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 193.239.68.68 any $HOME_NET any (msg:"ad0.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.239.68.78 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.239.68.90 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.24.252.33 any $HOME_NET any (msg:"ads.gamigo.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.24.255.11 any $HOME_NET any (msg:"ads.gamigo.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.252.138.38 any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;)
alert tcp 193.252.138.84 any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;)
alert tcp 193.252.242.154 any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;)
alert tcp 193.252.242.218 any $HOME_NET any (msg:"sbx.pagesjaunes.fr"; classtype:trojan-activity; priority:1;)
alert tcp 193.254.184.86 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.254.241.63 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;)
alert tcp 193.254.241.64 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;)
alert tcp 193.27.253.44 any $HOME_NET any (msg:"ad.jamba.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.28.195.17 any $HOME_NET any (msg:"adserver.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.28.197.214 any $HOME_NET any (msg:"adserver.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.28.197.8 any $HOME_NET any (msg:"ad.mgd.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.28.197.91 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.28.86.27 any $HOME_NET any (msg:"ctnetwork.hu"; classtype:trojan-activity; priority:1;)
alert tcp 193.33.115.57 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.33.115.64 any $HOME_NET any (msg:"blogcounter.de"; classtype:trojan-activity; priority:1;)
alert tcp 193.34.150.139 any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;)
alert tcp 193.35.8.15 any $HOME_NET any (msg:"adverts.carltononline.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.110 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.111 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.112 any $HOME_NET any (msg:"media.ftv-publicite.fr"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.113 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.118 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.70 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.71 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.73 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.80 any $HOME_NET any (msg:"media.ftv-publicite.fr"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.82 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.94 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.95 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.1.96 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.10.95 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.10.97 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.15.104 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.15.106 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.15.107 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.45.15.144 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.56.143.16 any $HOME_NET any (msg:"ads.kompass.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.68.35.131 any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;)
alert tcp 193.68.35.136 any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;)
alert tcp 193.68.35.149 any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;)
alert tcp 193.84.187.9 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;)
alert tcp 193.85.207.202 any $HOME_NET any (msg:"counter.cnw.cz"; classtype:trojan-activity; priority:1;)
alert tcp 193.85.232.68 any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;)
alert tcp 193.85.232.69 any $HOME_NET any (msg:"counter.cz"; classtype:trojan-activity; priority:1;)
alert tcp 193.85.233.130 any $HOME_NET any (msg:"ad.hyena.cz"; classtype:trojan-activity; priority:1;)
alert tcp 193.86.103.74 any $HOME_NET any (msg:"webcounter.cz"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.187.9 any $HOME_NET any (msg:"instadia.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.111 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.114 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.141 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.149 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.150 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.154 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.155 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.156 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.158 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.161 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.163 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.164 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.165 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.167 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.168 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.170 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.71.172 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.89.178 any $HOME_NET any (msg:"banner.webdmz.tv2.dk"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.89.25 any $HOME_NET any (msg:"babs.tv2.dk"; classtype:trojan-activity; priority:1;)
alert tcp 193.88.89.48 any $HOME_NET any (msg:"banner.webdmz.tv2.dk"; classtype:trojan-activity; priority:1;)
alert tcp 193.91.69.232 any $HOME_NET any (msg:"audit.median.hu"; classtype:trojan-activity; priority:1;)
alert tcp 194.0.131.16 any $HOME_NET any (msg:"stat24.meta.ua"; classtype:trojan-activity; priority:1;)
alert tcp 194.100.134.17 any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;)
alert tcp 194.100.134.20 any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;)
alert tcp 194.100.33.176 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp 194.100.33.178 any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp 194.103.17.20 any $HOME_NET any (msg:"ads.fotosidan.se"; classtype:trojan-activity; priority:1;)
alert tcp 194.105.56.11 any $HOME_NET any (msg:"hits.puls.lv"; classtype:trojan-activity; priority:1;)
alert tcp 194.107.19.164 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.108.10.68 any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.108.76.226 any $HOME_NET any (msg:"add.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.110.246.62 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 194.116.154.20 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;)
alert tcp 194.116.167.31 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.116.167.51 any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.116.167.56 any $HOME_NET any (msg:"affiliatewindow.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.117.236.118 any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp 194.117.236.216 any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp 194.117.237.125 any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp 194.126.131.54 any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;)
alert tcp 194.126.157.51 any $HOME_NET any (msg:"cybermonitor.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.126.157.60 any $HOME_NET any (msg:"estat.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.126.157.64 any $HOME_NET any (msg:"estat.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.126.253.26 any $HOME_NET any (msg:"chestionar.ro"; classtype:trojan-activity; priority:1;)
alert tcp 194.135.19.60 any $HOME_NET any (msg:"rate.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.146.224.73 any $HOME_NET any (msg:"provexia.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.149.10.19 any $HOME_NET any (msg:"indexstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.149.10.56 any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;)
alert tcp 194.149.10.57 any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;)
alert tcp 194.149.10.58 any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;)
alert tcp 194.150.236.217 any $HOME_NET any (msg:"clicmanager.fr"; classtype:trojan-activity; priority:1;)
alert tcp 194.150.237.120 any $HOME_NET any (msg:"clicmanager.fr"; classtype:trojan-activity; priority:1;)
alert tcp 194.150.237.53 any $HOME_NET any (msg:"clicmanager.fr"; classtype:trojan-activity; priority:1;)
alert tcp 194.154.228.75 any $HOME_NET any (msg:"naj.sk"; classtype:trojan-activity; priority:1;)
alert tcp 194.158.120.145 any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;)
alert tcp 194.158.121.145 any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;)
alert tcp 194.165.56.231 any $HOME_NET any (msg:"ads.edbindex.dk"; classtype:trojan-activity; priority:1;)
alert tcp 194.169.128.28 any $HOME_NET any (msg:"banners.thomsonlocal.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.169.129.228 any $HOME_NET any (msg:"banners.thomsonlocal.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.169.201.115 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.169.201.160 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.169.201.166 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.169.201.252 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.24.137 any $HOME_NET any (msg:"ad1.emediate.dk"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.24.163 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.24.164 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.24.230 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.24.231 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.24.232 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.24.233 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.179 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.181 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.182 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.183 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.184 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.185 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.186 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.187 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.188 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.17.45.189 any $HOME_NET any (msg:"adsfac.eu"; classtype:trojan-activity; priority:1;)
alert tcp 194.177.4.133 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;)
alert tcp 194.177.4.217 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;)
alert tcp 194.186.25.4 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.186.36.222 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.186.88.102 any $HOME_NET any (msg:"adland.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.187.110.81 any $HOME_NET any (msg:"uarating.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.187.96.138 any $HOME_NET any (msg:"cjlog.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.20.158.119 any $HOME_NET any (msg:"ads.rcs.it"; classtype:trojan-activity; priority:1;)
alert tcp 194.20.158.219 any $HOME_NET any (msg:"ads.rcs.it"; classtype:trojan-activity; priority:1;)
alert tcp 194.20.232.3 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;)
alert tcp 194.203.155.31 any $HOME_NET any (msg:"reedbusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.209.62.171 any $HOME_NET any (msg:"ad.gate24.ch"; classtype:trojan-activity; priority:1;)
alert tcp 194.213.53.208 any $HOME_NET any (msg:"adrenaline.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.213.53.212 any $HOME_NET any (msg:"ad2.linxcz.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.213.62.37 any $HOME_NET any (msg:"billboard.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.213.62.41 any $HOME_NET any (msg:"billboard.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.228.200.95 any $HOME_NET any (msg:"adx.allstar.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.228.32.72 any $HOME_NET any (msg:"ad.seznam.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.228.50.121 any $HOME_NET any (msg:"adrenaline.cz"; classtype:trojan-activity; priority:1;)
alert tcp 194.230.33.138 any $HOME_NET any (msg:"admanagement.ch"; classtype:trojan-activity; priority:1;)
alert tcp 194.230.33.167 any $HOME_NET any (msg:"admanagement.ch"; classtype:trojan-activity; priority:1;)
alert tcp 194.230.72.16 any $HOME_NET any (msg:"banner.vadian.net"; classtype:trojan-activity; priority:1;)
alert tcp 194.230.72.76 any $HOME_NET any (msg:"banner.vadian.net"; classtype:trojan-activity; priority:1;)
alert tcp 194.232.105.60 any $HOME_NET any (msg:"oewa.at"; classtype:trojan-activity; priority:1;)
alert tcp 194.236.124.44 any $HOME_NET any (msg:"banner.linux.se"; classtype:trojan-activity; priority:1;)
alert tcp 194.24.252.203 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;)
alert tcp 194.24.252.208 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;)
alert tcp 194.24.252.213 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;)
alert tcp 194.24.252.215 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;)
alert tcp 194.24.252.217 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;)
alert tcp 194.244.107.100 any $HOME_NET any (msg:"oas.repubblica.it"; classtype:trojan-activity; priority:1;)
alert tcp 194.28.158.210 any $HOME_NET any (msg:"ads.pushplay.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.28.158.230 any $HOME_NET any (msg:"affbuzzads.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.38.107.20 any $HOME_NET any (msg:"adserver.hardsextube.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.38.107.21 any $HOME_NET any (msg:"adserver.hardsextube.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.38.107.6 any $HOME_NET any (msg:"adserver.hardsextube.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.44.85.161 any $HOME_NET any (msg:"adskape.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.58.78.43 any $HOME_NET any (msg:"rate.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.6.248.18 any $HOME_NET any (msg:"ads.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.63.247.30 any $HOME_NET any (msg:"adman.in.gr"; classtype:trojan-activity; priority:1;)
alert tcp 194.63.248.27 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.63.248.47 any $HOME_NET any (msg:"i1media.no"; classtype:trojan-activity; priority:1;)
alert tcp 194.64.51.36 any $HOME_NET any (msg:"fragmentserv.iac-online.de"; classtype:trojan-activity; priority:1;)
alert tcp 194.65.79.159 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;)
alert tcp 194.65.79.50 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp 194.67.23.251 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.67.32.247 any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.67.35.133 any $HOME_NET any (msg:"spylog.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.67.35.205 any $HOME_NET any (msg:"mytrix.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.67.45.100 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.67.45.105 any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.67.45.123 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.67.45.98 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.70.234.209 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 194.70.234.215 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 194.71.107.25 any $HOME_NET any (msg:"anus.thepiratebay.tw"; classtype:trojan-activity; priority:1;)
alert tcp 194.72.108.14 any $HOME_NET any (msg:"bannersng.yell.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.8.80.8 any $HOME_NET any (msg:"ip.ro"; classtype:trojan-activity; priority:1;)
alert tcp 194.84.16.2 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.84.16.3 any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.24.129 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.24.130 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.24.131 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.24.132 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.24.153 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.94.245 any $HOME_NET any (msg:"blogtoppen.se"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.94.85 any $HOME_NET any (msg:"blogtoppen.se"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.94.86 any $HOME_NET any (msg:"blogtoppen.se"; classtype:trojan-activity; priority:1;)
alert tcp 194.9.95.245 any $HOME_NET any (msg:"blogtoppen.se"; classtype:trojan-activity; priority:1;)
alert tcp 194.97.34.10 any $HOME_NET any (msg:"adview.ppro.de"; classtype:trojan-activity; priority:1;)
alert tcp 194.98.19.1 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.98.19.196 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.98.19.20 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.98.19.21 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.98.19.241 any $HOME_NET any (msg:"hit-parade.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.98.19.28 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 194.98.19.30 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.10.195.150 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.10.195.151 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.10.195.152 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.10.195.153 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.10.195.154 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.10.195.155 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.10.195.227 any $HOME_NET any (msg:"domainsteam.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.110.103.3 any $HOME_NET any (msg:"ads.dada.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.110.122.162 any $HOME_NET any (msg:"ads.dada.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.110.124.133 any $HOME_NET any (msg:"pro-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.110.126.136 any $HOME_NET any (msg:"banner.supereva.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.113.150.14 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.113.150.15 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.113.150.16 any $HOME_NET any (msg:"eur.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.224.123 any $HOME_NET any (msg:"ad1.emediate.dk"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.165 any $HOME_NET any (msg:"ad1.emediate.dk"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.174 any $HOME_NET any (msg:"ad1.emediate.dk"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.34 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.36 any $HOME_NET any (msg:"annonser.dagbladet.no"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.37 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.38 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.39 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.40 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.228.41 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.197 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.198 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.200 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.201 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.202 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.205 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.206 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.207 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.208 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.209 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.210 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.211 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.212 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.214 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.218 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.219 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.12.231.222 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.121.7.193 any $HOME_NET any (msg:"ads.planet.nl"; classtype:trojan-activity; priority:1;)
alert tcp 195.122.194.228 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.122.194.234 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.122.194.236 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.122.194.240 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.122.194.246 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.128.234.185 any $HOME_NET any (msg:"fast-adv.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.13.58.133 any $HOME_NET any (msg:"ads.y-0.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.130.225.240 any $HOME_NET any (msg:"ad.tiscali.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.131.4.166 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.137.184.101 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.137.184.7 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.14.94.9 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.140.186.100 any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.140.186.101 any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.140.186.102 any $HOME_NET any (msg:"ads.domeus.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.140.186.183 any $HOME_NET any (msg:"ecircle-ag.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.146.100.126 any $HOME_NET any (msg:"reklama.mironet.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.149.105.37 any $HOME_NET any (msg:"a.sakh.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.149.158.3 any $HOME_NET any (msg:"emediate.eu"; classtype:trojan-activity; priority:1;)
alert tcp 195.149.158.4 any $HOME_NET any (msg:"ad1.emediate.dk"; classtype:trojan-activity; priority:1;)
alert tcp 195.151.251.41 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.154.120.68 any $HOME_NET any (msg:"pubs.lemonde.fr"; classtype:trojan-activity; priority:1;)
alert tcp 195.154.98.110 any $HOME_NET any (msg:"ad.yourmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.154.98.156 any $HOME_NET any (msg:"ad.yourmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.154.98.157 any $HOME_NET any (msg:"ad.yourmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.158.241.11 any $HOME_NET any (msg:"comclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.161.118.20 any $HOME_NET any (msg:"ad.tbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.161.118.21 any $HOME_NET any (msg:"ad.100.tbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.161.119.52 any $HOME_NET any (msg:"www-banner.chat.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.161.119.84 any $HOME_NET any (msg:"www-banner.chat.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.161.119.85 any $HOME_NET any (msg:"www-banner.chat.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.165.77.52 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp 195.165.77.53 any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp 195.167.100.193 any $HOME_NET any (msg:"adman.otenet.gr"; classtype:trojan-activity; priority:1;)
alert tcp 195.167.20.40 any $HOME_NET any (msg:"adman.otenet.gr"; classtype:trojan-activity; priority:1;)
alert tcp 195.168.10.150 any $HOME_NET any (msg:"etargetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.168.10.35 any $HOME_NET any (msg:"partner.pelikan.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.170.124.167 any $HOME_NET any (msg:"foo.cosmocode.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.170.168.1 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.170.168.136 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.170.168.2 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.170.168.6 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.170.99.24 any $HOME_NET any (msg:"mediascale.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.171.206.205 any $HOME_NET any (msg:"ads.jobsite.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 195.179.163.1 any $HOME_NET any (msg:"mediavantage.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.189.118.37 any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;)
alert tcp 195.189.143.135 any $HOME_NET any (msg:"promote.opera.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.189.236.35 any $HOME_NET any (msg:"affili.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.189.236.90 any $HOME_NET any (msg:"webmasterplan.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.190.31.201 any $HOME_NET any (msg:"adservinginternational.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.191.128.39 any $HOME_NET any (msg:"tizers.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.193.95.230 any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;)
alert tcp 195.198.236.113 any $HOME_NET any (msg:"banner.ad.nu"; classtype:trojan-activity; priority:1;)
alert tcp 195.198.236.63 any $HOME_NET any (msg:"banner.ad.nu"; classtype:trojan-activity; priority:1;)
alert tcp 195.2.64.1 any $HOME_NET any (msg:"stat.zenon.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.2.82.69 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.20.224.83 any $HOME_NET any (msg:"cgicounter.puretec.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.20.225.24 any $HOME_NET any (msg:"cgicounter.puretec.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.20.249.19 any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.204.232.34 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.204.232.40 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.210.87.1 any $HOME_NET any (msg:"adserver.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.210.87.2 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.210.91.107 any $HOME_NET any (msg:"adserver.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.210.91.77 any $HOME_NET any (msg:"adv-banner.libero.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.210.96.10 any $HOME_NET any (msg:"shinystat.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.210.96.8 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.214.243.112 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.214.243.117 any $HOME_NET any (msg:"ads.canalblog.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.17 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.18 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.19 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.2 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.20 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.21 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.22 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.23 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.24 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.25 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.26 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.27 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.28 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.29 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.30 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.216.243.7 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.218.200.234 any $HOME_NET any (msg:"rb1.design.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.71 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.72 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.73 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.74 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.75 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.76 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.77 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.78 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.79 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.80 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.81 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.82 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.83 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.84 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.85 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.86 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.87 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.88 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.89 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.219.3.90 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.22.10.107 any $HOME_NET any (msg:"nitroclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.224.235.182 any $HOME_NET any (msg:"adviva.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.225.176.138 any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.225.196.197 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.225.196.215 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.227.6.99 any $HOME_NET any (msg:"numax.nu-1.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.155.159 any $HOME_NET any (msg:"reklamcsere.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.156.206 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.254.126 any $HOME_NET any (msg:"reklamcsere.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.254.53 any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.45.195 any $HOME_NET any (msg:"ad.wavu.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.75.120 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.75.156 any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.75.171 any $HOME_NET any (msg:"ad.wavu.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.75.214 any $HOME_NET any (msg:"toplista.mw.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.228.75.92 any $HOME_NET any (msg:"ad.mediastorm.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.229.240.108 any $HOME_NET any (msg:"ads.emirates.net.ae"; classtype:trojan-activity; priority:1;)
alert tcp 195.23.126.144 any $HOME_NET any (msg:"ad.clix.pt"; classtype:trojan-activity; priority:1;)
alert tcp 195.23.133.206 any $HOME_NET any (msg:"ad.clix.pt"; classtype:trojan-activity; priority:1;)
alert tcp 195.234.11.113 any $HOME_NET any (msg:"ads.creativematch.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.235.97.80 any $HOME_NET any (msg:"ads.ole.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.239.86.26 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.24.37.245 any $HOME_NET any (msg:"hit.bg"; classtype:trojan-activity; priority:1;)
alert tcp 195.242.117.32 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 195.245.125.226 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.245.125.235 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 195.245.125.236 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 195.245.125.243 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.245.179.177 any $HOME_NET any (msg:"adserver.portugalmail.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.245.179.77 any $HOME_NET any (msg:"adserver.portugalmail.pt"; classtype:trojan-activity; priority:1;)
alert tcp 195.245.220.26 any $HOME_NET any (msg:"chestionar.ro"; classtype:trojan-activity; priority:1;)
alert tcp 195.246.230.97 any $HOME_NET any (msg:"allosponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.246.99.153 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.248.250.50 any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;)
alert tcp 195.248.251.137 any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;)
alert tcp 195.248.83.71 any $HOME_NET any (msg:"comprabanner.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.249.40.10 any $HOME_NET any (msg:"stat.cliche.se"; classtype:trojan-activity; priority:1;)
alert tcp 195.249.40.72 any $HOME_NET any (msg:"danban.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.250.147.210 any $HOME_NET any (msg:"banners.czi.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.250.204.84 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.26.11.160 any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.27.248.187 any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.28.79.58 any $HOME_NET any (msg:"etargetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.34.132.38 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.36.162.14 any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;)
alert tcp 195.36.166.14 any $HOME_NET any (msg:"pub.club-internet.fr"; classtype:trojan-activity; priority:1;)
alert tcp 195.39.196.36 any $HOME_NET any (msg:"counter.mirohost.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.39.234.210 any $HOME_NET any (msg:"ads.hbv.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.39.44.210 any $HOME_NET any (msg:"banik.redigy.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.39.54.33 any $HOME_NET any (msg:"reklama.reflektor.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.41.114.140 any $HOME_NET any (msg:"adservinginternational.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.41.114.143 any $HOME_NET any (msg:"adservinginternational.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.41.47.113 any $HOME_NET any (msg:"au2m8.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.43.182.185 any $HOME_NET any (msg:"fast-adv.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.47.108.138 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.47.116.44 any $HOME_NET any (msg:"potenza.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.47.116.72 any $HOME_NET any (msg:"window.nixnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.47.86.2 any $HOME_NET any (msg:"bm.annonce.cz"; classtype:trojan-activity; priority:1;)
alert tcp 195.5.165.34 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.5.165.35 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.5.165.37 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.50.67.41 any $HOME_NET any (msg:"ads.foxkidseurope.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.52.220.67 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.54.192.200 any $HOME_NET any (msg:"rotabanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.54.192.50 any $HOME_NET any (msg:"musiccounter.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.54.209.9 any $HOME_NET any (msg:"musiccounter.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.54.48.30 any $HOME_NET any (msg:"weborama.fr"; classtype:trojan-activity; priority:1;)
alert tcp 195.56.44.150 any $HOME_NET any (msg:"ads.deltha.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.56.77.184 any $HOME_NET any (msg:"audit.webinform.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.60.12.141 any $HOME_NET any (msg:"ukbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.60.188.38 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.60.188.68 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.60.77.145 any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.62.28.74 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 195.65.248.142 any $HOME_NET any (msg:"ad.gate24.ch"; classtype:trojan-activity; priority:1;)
alert tcp 195.68.160.179 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.68.160.185 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.68.160.186 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.69.128.11 any $HOME_NET any (msg:"partner-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.69.131.37 any $HOME_NET any (msg:"partner-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.70.16.138 any $HOME_NET any (msg:"ads-click.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.70.36.17 any $HOME_NET any (msg:"gpr.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.70.38.135 any $HOME_NET any (msg:"gpr.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.70.38.152 any $HOME_NET any (msg:"interstat.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.70.38.181 any $HOME_NET any (msg:"interstat.hu"; classtype:trojan-activity; priority:1;)
alert tcp 195.71.93.131 any $HOME_NET any (msg:"adscale.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.74.36.210 any $HOME_NET any (msg:"admeta.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.74.70.112 any $HOME_NET any (msg:"ads.berlinonline.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.77.175.83 any $HOME_NET any (msg:"ad.anuntis.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.77.175.85 any $HOME_NET any (msg:"ad.anuntis.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.77.179.23 any $HOME_NET any (msg:"ad.anuntis.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.78.108.2 any $HOME_NET any (msg:"adskape.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.78.108.3 any $HOME_NET any (msg:"popunder.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.78.229.201 any $HOME_NET any (msg:"sixsigmatraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.78.76.234 any $HOME_NET any (msg:"best-pr.info"; classtype:trojan-activity; priority:1;)
alert tcp 195.78.94.139 any $HOME_NET any (msg:"hexusads.fluent.ltd.uk"; classtype:trojan-activity; priority:1;)
alert tcp 195.80.230.221 any $HOME_NET any (msg:"ad.jamba.net"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.101 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.102 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.103 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.104 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.105 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.106 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.107 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.108 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.109 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.110 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.111 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.112 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.113 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.114 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.115 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.116 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.117 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.118 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.119 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.81.202.120 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 195.85.207.39 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;)
alert tcp 195.85.228.168 any $HOME_NET any (msg:"comprabanner.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.85.228.61 any $HOME_NET any (msg:"comprabanner.it"; classtype:trojan-activity; priority:1;)
alert tcp 195.9.14.160 any $HOME_NET any (msg:"rate.ru"; classtype:trojan-activity; priority:1;)
alert tcp 195.90.249.17 any $HOME_NET any (msg:"wondoads.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.93.85.51 any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;)
alert tcp 195.95.133.41 any $HOME_NET any (msg:"accounts.pkr.com"; classtype:trojan-activity; priority:1;)
alert tcp 196.2.24.20 any $HOME_NET any (msg:"banner.coza.com"; classtype:trojan-activity; priority:1;)
alert tcp 196.2.63.180 any $HOME_NET any (msg:"banner.coza.com"; classtype:trojan-activity; priority:1;)
alert tcp 196.25.210.68 any $HOME_NET any (msg:"ads.img.co.za"; classtype:trojan-activity; priority:1;)
alert tcp 196.25.210.69 any $HOME_NET any (msg:"banner.img.co.za"; classtype:trojan-activity; priority:1;)
alert tcp 196.30.168.91 any $HOME_NET any (msg:"adsrv.iol.co.za"; classtype:trojan-activity; priority:1;)
alert tcp 196.31.249.35 any $HOME_NET any (msg:"adserv.iafrica.com"; classtype:trojan-activity; priority:1;)
alert tcp 196.31.4.10 any $HOME_NET any (msg:"ads.iafrica.com"; classtype:trojan-activity; priority:1;)
alert tcp 196.34.149.71 any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;)
alert tcp 196.38.17.67 any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;)
alert tcp 196.38.17.68 any $HOME_NET any (msg:"ads.brabys.com"; classtype:trojan-activity; priority:1;)
alert tcp 196.41.214.139 any $HOME_NET any (msg:"banner.img.co.za"; classtype:trojan-activity; priority:1;)
alert tcp 198.1.115.107 any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.104.158.237 any $HOME_NET any (msg:"banner.casino.net"; classtype:trojan-activity; priority:1;)
alert tcp 198.104.159.65 any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.105.193.19 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.136.202.114 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.136.202.143 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.136.27.250 any $HOME_NET any (msg:"ads.kaktuz.net"; classtype:trojan-activity; priority:1;)
alert tcp 198.142.76.100 any $HOME_NET any (msg:"ads.optusnet.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 198.145.117.105 any $HOME_NET any (msg:"pheedo.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.145.13.21 any $HOME_NET any (msg:"roxr.net"; classtype:trojan-activity; priority:1;)
alert tcp 198.160.26.23 any $HOME_NET any (msg:"emarketer.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.160.26.30 any $HOME_NET any (msg:"emarketer.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.161.157.218 any $HOME_NET any (msg:"cityads.telus.net"; classtype:trojan-activity; priority:1;)
alert tcp 198.172.202.250 any $HOME_NET any (msg:"specificclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 198.172.81.32 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.172.81.42 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.202.142.18 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.202.142.20 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.202.142.229 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.202.143.18 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.202.143.20 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.23.53.105 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.252.206.16 any $HOME_NET any (msg:"ads.stackoverflow.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.252.98.40 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.41.185.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.41.186.34 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 198.41.186.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.41.187.34 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 198.41.187.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.41.188.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.41.189.57 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.50.113.122 any $HOME_NET any (msg:"banner.wirenode.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.51.152.82 any $HOME_NET any (msg:"tapad.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.51.152.83 any $HOME_NET any (msg:"tapad.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.58.123.32 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.58.96.228 any $HOME_NET any (msg:"veruta.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.61.145.152 any $HOME_NET any (msg:"idcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.64.128.97 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.64.134.121 any $HOME_NET any (msg:"herbalaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.64.139.114 any $HOME_NET any (msg:"fineclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.65.102.164 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.65.102.87 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.65.116.34 any $HOME_NET any (msg:"humanclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.65.119.21 any $HOME_NET any (msg:"iad.liveperson.net"; classtype:trojan-activity; priority:1;)
alert tcp 198.65.134.58 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.65.152.9 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.74.57.251 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.74.62.254 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.77.36.41 any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.78.206.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.78.210.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.78.212.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.78.218.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.78.219.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.80.189.106 any $HOME_NET any (msg:"adserver.janes.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.87.214.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.98.113.3 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 198.98.113.65 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.106.209.244 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.106.213.104 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.107.237.207 any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.117.103.146 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 199.117.103.155 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.11 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.17 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.19 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.72 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.73 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.74 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.75 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.76 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.122.7.77 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.15.160.100 any $HOME_NET any (msg:"adsrv.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.15.160.110 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.15.160.120 any $HOME_NET any (msg:"adsrv.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.15.160.121 any $HOME_NET any (msg:"adcast.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.15.160.36 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.15.160.37 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.181.132.207 any $HOME_NET any (msg:"log.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.181.132.250 any $HOME_NET any (msg:"ad.infoseek.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.181.132.80 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.182.216.202 any $HOME_NET any (msg:"ads.pof.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.19.200.170 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.19.200.172 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.19.67.142 any $HOME_NET any (msg:"ads.betanews.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.10.100 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.10.122 any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.10.150 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.10.203 any $HOME_NET any (msg:"clients.tbo.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.10.30 any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.10.50 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.10.90 any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.13.122 any $HOME_NET any (msg:"clients.tbo.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.13.203 any $HOME_NET any (msg:"clients.tbo.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.13.30 any $HOME_NET any (msg:"clients.tbo.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.13.50 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.13.90 any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.193.9.23 any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.204.137.111 any $HOME_NET any (msg:"adzerk.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.21.148.10 any $HOME_NET any (msg:"yesadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.21.148.21 any $HOME_NET any (msg:"clicksor.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.21.148.39 any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.21.148.42 any $HOME_NET any (msg:"lzjl.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.212.222.22 any $HOME_NET any (msg:"reedbusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.231.210.200 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.232.159.232 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.232.159.252 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.232.159.253 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.233.57.41 any $HOME_NET any (msg:"crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.239.136.200 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.239.136.245 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.239.137.200 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.239.137.245 any $HOME_NET any (msg:"ads.nytimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.134.14 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.134.26 any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.134.65 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.134.67 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.134.96 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.134.98 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.135.14 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.135.26 any $HOME_NET any (msg:"mediadvertising.ro"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.135.65 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.135.67 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.135.98 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.72.129 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.74.129 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.74.192 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.75.192 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.76.129 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.76.131 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.76.192 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.76.194 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.76.5 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.77.129 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.77.131 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.77.192 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.27.77.194 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.34.228.130 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.38.164.173 any $HOME_NET any (msg:"xplusone.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.38.164.180 any $HOME_NET any (msg:"xplusone.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.38.181.237 any $HOME_NET any (msg:"ads-click.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.161.204 any $HOME_NET any (msg:"xtremetop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.179 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.181 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.182 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.183 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.184 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.185 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.186 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.188 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.189 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.203 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.207 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.209 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.214 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.215 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.216 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.218 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.241.250 any $HOME_NET any (msg:"adtology.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.243.105 any $HOME_NET any (msg:"topforall.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.243.111 any $HOME_NET any (msg:"adyea.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.243.118 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.243.120 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.59.243.92 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.66.166.202 any $HOME_NET any (msg:"affiliate.mercola.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.66.218.115 any $HOME_NET any (msg:"images.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.66.218.116 any $HOME_NET any (msg:"ads.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.66.218.118 any $HOME_NET any (msg:"images.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.66.218.119 any $HOME_NET any (msg:"ads.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.80.54.47 any $HOME_NET any (msg:"mgid.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.83.128.192 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 199.83.130.4 any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.83.132.187 any $HOME_NET any (msg:"inboxdollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.83.132.192 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 199.83.134.187 any $HOME_NET any (msg:"inboxdollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.85.4.63 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.93.42.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 199.93.54.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.93.57.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.93.57.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.93.62.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 199.95.206.210 any $HOME_NET any (msg:"doubleclick.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.16.11.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.16.139.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.16.157.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.16.31.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.16.57.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.16.59.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.16.63.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.16.65.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.115.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.118.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.120.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.125.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.13.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.208.74 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.224.74 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.244.74 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.6.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.70.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.77.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.18.8.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.115.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.120.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.125.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.147.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.150.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.152.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.157.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.200.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.211.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.19.221.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.20.248.74 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 2.20.28.74 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 2.20.36.74 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 2.21.115.153 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.21.211.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.21.214.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.21.216.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.21.221.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.22.48.147 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 2.22.48.89 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 200.123.152.52 any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 200.123.152.61 any $HOME_NET any (msg:"harrenmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 200.124.140.9 any $HOME_NET any (msg:"richwebmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 200.124.142.108 any $HOME_NET any (msg:"inspectorclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 200.140.126.104 any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.140.126.105 any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.140.126.106 any $HOME_NET any (msg:"ads.ibest.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.147.3.170 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.147.35.170 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.147.67.170 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.16.144.230 any $HOME_NET any (msg:"admotion.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp 200.173.74.162 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.201.192.31 any $HOME_NET any (msg:"trix.net"; classtype:trojan-activity; priority:1;)
alert tcp 200.201.192.40 any $HOME_NET any (msg:"trix.net"; classtype:trojan-activity; priority:1;)
alert tcp 200.203.43.161 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.221.7.120 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.221.7.121 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.221.7.122 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.221.7.70 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 200.32.3.53 any $HOME_NET any (msg:"admotion.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp 200.69.192.231 any $HOME_NET any (msg:"ads.e-planning.net"; classtype:trojan-activity; priority:1;)
alert tcp 200.69.192.239 any $HOME_NET any (msg:"ads.e-planning.net"; classtype:trojan-activity; priority:1;)
alert tcp 200.80.18.185 any $HOME_NET any (msg:"bannerlandia.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp 200.98.211.10 any $HOME_NET any (msg:"banners.bol.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 201.235.35.25 any $HOME_NET any (msg:"harrenmedianetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.100.74.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.100.74.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.101.62.9 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.103.178.176 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.150.118 any $HOME_NET any (msg:"518ad.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.236.112 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.236.113 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.236.144 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.236.224 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.236.38 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.237.194 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.237.200 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.237.201 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.104.237.211 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 202.130.103.100 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.134.124.142 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 202.137.236.25 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.137.237.29 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.137.239.21 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.138.113.146 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.139.106.179 any $HOME_NET any (msg:"adserver.news.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.139.107.20 any $HOME_NET any (msg:"adserver.news.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.139.94.37 any $HOME_NET any (msg:"clixgalore.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.168.197.3 any $HOME_NET any (msg:"adserver.aidameter.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.168.212.103 any $HOME_NET any (msg:"newbie.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.168.214.53 any $HOME_NET any (msg:"newbie.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.170.120.110 any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.170.120.122 any $HOME_NET any (msg:"adsstat.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.170.120.99 any $HOME_NET any (msg:"ads.bumq.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.172.236.75 any $HOME_NET any (msg:"ad01.mediacorpsingapore.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.175.130.134 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 202.175.135.197 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 202.175.135.91 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 202.177.198.92 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 202.214.174.52 any $HOME_NET any (msg:"bizad.nikkeibp.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp 202.222.31.77 any $HOME_NET any (msg:"xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.228.239.198 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;)
alert tcp 202.239.162.253 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.248.228.20 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 202.27.17.118 any $HOME_NET any (msg:"ads.asia1.com.sg"; classtype:trojan-activity; priority:1;)
alert tcp 202.27.17.119 any $HOME_NET any (msg:"adimage.asiaone.com.sg"; classtype:trojan-activity; priority:1;)
alert tcp 202.27.184.50 any $HOME_NET any (msg:"ads.xtra.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 202.27.28.177 any $HOME_NET any (msg:"adimage.asiaone.com.sg"; classtype:trojan-activity; priority:1;)
alert tcp 202.27.28.179 any $HOME_NET any (msg:"ads.asia1.com.sg"; classtype:trojan-activity; priority:1;)
alert tcp 202.30.198.36 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.43.202.46 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.58.48.222 any $HOME_NET any (msg:"ads.ninemsn.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.58.48.78 any $HOME_NET any (msg:"ads.ninemsn.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.58.49.222 any $HOME_NET any (msg:"ads.ninemsn.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.58.49.78 any $HOME_NET any (msg:"ads.ninemsn.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.58.56.78 any $HOME_NET any (msg:"ads.ninemsn.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.7.109.106 any $HOME_NET any (msg:"adjustnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.85.137.13 any $HOME_NET any (msg:"bannerserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.85.162.118 any $HOME_NET any (msg:"adx.atnext.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.85.162.159 any $HOME_NET any (msg:"adx.atnext.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.85.162.168 any $HOME_NET any (msg:"adx.atnext.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.85.162.175 any $HOME_NET any (msg:"adx.atnext.com"; classtype:trojan-activity; priority:1;)
alert tcp 202.92.216.66 any $HOME_NET any (msg:"sensismediasmart.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.92.216.94 any $HOME_NET any (msg:"sensismediasmart.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 202.96.140.122 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.110.143.97 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 203.131.192.52 any $HOME_NET any (msg:"adv.livedoor.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.140.231.149 any $HOME_NET any (msg:"ads.gplusmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.140.231.150 any $HOME_NET any (msg:"ads.gplusmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.140.72.50 any $HOME_NET any (msg:"e-debtconsolidation.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.147.166.233 any $HOME_NET any (msg:"sensismediasmart.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 203.151.21.60 any $HOME_NET any (msg:"truehits.net"; classtype:trojan-activity; priority:1;)
alert tcp 203.166.18.103 any $HOME_NET any (msg:"imrworldwide.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.166.18.175 any $HOME_NET any (msg:"imrworldwide.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.166.18.221 any $HOME_NET any (msg:"imrworldwide.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.169.9.169 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.171.236.171 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.171.236.172 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.174.66.131 any $HOME_NET any (msg:"custom-click.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.179.90.162 any $HOME_NET any (msg:"tatsumi-sys.jp"; classtype:trojan-activity; priority:1;)
alert tcp 203.186.128.71 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.190.224.60 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 203.199.83.180 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.199.83.53 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.199.93.148 any $HOME_NET any (msg:"ads.indiatimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.2.192.124 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.202.150.138 any $HOME_NET any (msg:"clixgalore.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.215.251.29 any $HOME_NET any (msg:"adx.atnext.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.26.5.11 any $HOME_NET any (msg:"admonitor.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.26.51.157 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 203.26.51.172 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 203.26.51.42 any $HOME_NET any (msg:"ffxcam.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 203.26.51.50 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 203.27.227.29 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.69.40.90 any $HOME_NET any (msg:"hotrank.com.tw"; classtype:trojan-activity; priority:1;)
alert tcp 203.84.214.58 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 203.89.229.13 any $HOME_NET any (msg:"ad3.pamedia.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 203.99.65.226 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 203.99.65.227 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 203.99.65.233 any $HOME_NET any (msg:"ads.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 203.99.65.75 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 204.1.152.68 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.1.154.218 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.1.154.228 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.1.155.74 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.109.133 any $HOME_NET any (msg:"tribalfusion.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.109.134 any $HOME_NET any (msg:"exponential.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.109.70 any $HOME_NET any (msg:"tribalfusion.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.32.22 any $HOME_NET any (msg:"pro-market.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.33.22 any $HOME_NET any (msg:"pro-market.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.51.34 any $HOME_NET any (msg:"dynamic.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.51.35 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.52.68 any $HOME_NET any (msg:"blogtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.11.56.21 any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.12.68.104 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.12.71.5 any $HOME_NET any (msg:"ads.ncm.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.12.89.69 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.12.89.76 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.128.175.252 any $HOME_NET any (msg:"adserver.theonering.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.160.129 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.160.131 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.160.134 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.160.182 any $HOME_NET any (msg:"domainsponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.160.35 any $HOME_NET any (msg:"revenue.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.160.52 any $HOME_NET any (msg:"domainsponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.161.127 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.161.136 any $HOME_NET any (msg:"information.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.161.177 any $HOME_NET any (msg:"information.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.161.226 any $HOME_NET any (msg:"domainsponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.161.23 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.161.30 any $HOME_NET any (msg:"domainsponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.167.6 any $HOME_NET any (msg:"traffictrader.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.248.125 any $HOME_NET any (msg:"mopub.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.8.18 any $HOME_NET any (msg:"roxr.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.13.8.76 any $HOME_NET any (msg:"roxr.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.137.28.222 any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.137.28.46 any $HOME_NET any (msg:"ads.ibryte.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.14.234.105 any $HOME_NET any (msg:"lct.salesforce.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.145.237.105 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.145.71.140 any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.15.193.131 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.15.193.132 any $HOME_NET any (msg:"dynamic.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.152.207.98 any $HOME_NET any (msg:"mgid.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.152.99.164 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.155.175.102 any $HOME_NET any (msg:"ads.pni.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.155.175.112 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.155.175.115 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.155.175.116 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.155.175.117 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.155.175.201 any $HOME_NET any (msg:"ads.pni.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.155.175.242 any $HOME_NET any (msg:"q.azcentral.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.16.173.2 any $HOME_NET any (msg:"newbie.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.16.252.98 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.160.107.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.160.120.125 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 204.160.98.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.160.98.253 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.176.177.140 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.176.45.153 any $HOME_NET any (msg:"affiliate.viator.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.176.88.14 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.179.240.184 any $HOME_NET any (msg:"ads.bloomberg.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.179.240.226 any $HOME_NET any (msg:"ads.bloomberg.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.179.240.43 any $HOME_NET any (msg:"ads.bloomberg.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.179.240.79 any $HOME_NET any (msg:"ads.bloomberg.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.181.14.4 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.183.113.68 any $HOME_NET any (msg:"percentmobile.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.197.240.133 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.202.132.19 any $HOME_NET any (msg:"ad.infoseek.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.202.148.19 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.213.185.13 any $HOME_NET any (msg:"ads.grindinggears.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.228.229.165 any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.228.229.167 any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.228.229.169 any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.228.229.170 any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.228.229.173 any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.228.229.175 any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.228.229.178 any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.232.157.46 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.232.193.225 any $HOME_NET any (msg:"ewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.232.200.125 any $HOME_NET any (msg:"advertisespace.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.236.129.98 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.236.130.237 any $HOME_NET any (msg:"ads.ask.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.236.218.179 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.236.230.121 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.236.237.158 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.244.102.6 any $HOME_NET any (msg:"ads.activestate.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.10.200 any $HOME_NET any (msg:"dnads.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.10.211 any $HOME_NET any (msg:"banners.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.10.231 any $HOME_NET any (msg:"stats.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.10.232 any $HOME_NET any (msg:"stats.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.15.153 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.15.160 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.15.169 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.15.171 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.15.174 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.15.175 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.251.15.193 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.253.104.220 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 204.71.191.220 any $HOME_NET any (msg:"leader.linkexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.71.191.94 any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.78.32.60 any $HOME_NET any (msg:"e-adimages.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.78.32.70 any $HOME_NET any (msg:"adsremote.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.78.34.113 any $HOME_NET any (msg:"adsremote.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.78.34.115 any $HOME_NET any (msg:"adsremote.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.78.50.226 any $HOME_NET any (msg:"e-adimages.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.78.50.230 any $HOME_NET any (msg:"adsremote.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.78.55.112 any $HOME_NET any (msg:"adsremote.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.78.55.114 any $HOME_NET any (msg:"adsremote.scrippsnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.79.197.200 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.8.169.150 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.8.169.182 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.8.169.214 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.8.169.246 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.8.49.19 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.8.49.20 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.9.177.90 any $HOME_NET any (msg:"videoegg.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.9.178.17 any $HOME_NET any (msg:"videoegg.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.9.47.28 any $HOME_NET any (msg:"zintext.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.91.10.86 any $HOME_NET any (msg:"reklamer.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 204.92.97.210 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.92.97.211 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.92.97.82 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 204.93.155.71 any $HOME_NET any (msg:"mrskincash.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.66.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.67.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.68.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.78.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.79.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.82.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.85.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.90.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.95.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.128.95.254 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 205.134.162.67 any $HOME_NET any (msg:"reklamer.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 205.134.162.68 any $HOME_NET any (msg:"reklamer.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 205.134.165.70 any $HOME_NET any (msg:"clickbrokers.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.134.169.121 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.134.177.105 any $HOME_NET any (msg:"bannerspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.134.177.110 any $HOME_NET any (msg:"bannerspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.134.238.64 any $HOME_NET any (msg:"casinogames.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.134.249.55 any $HOME_NET any (msg:"casinogames.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.138.3.230 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.139.101.150 any $HOME_NET any (msg:"admax.nexage.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.139.28.97 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.139.40.76 any $HOME_NET any (msg:"wdads.sx.atl.publicus.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.144.161.42 any $HOME_NET any (msg:"eurekster.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.150.0.180 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.150.176.247 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.153.84.207 any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.153.85.31 any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.157.163.16 any $HOME_NET any (msg:"ads.pennet.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.177.28.48 any $HOME_NET any (msg:"4affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.178.145.65 any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.178.152.39 any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.178.187.14 any $HOME_NET any (msg:"ads.networksolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.178.189.128 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.178.189.131 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.178.190.66 any $HOME_NET any (msg:"phoenix-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.178.190.75 any $HOME_NET any (msg:"superstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.180.85.15 any $HOME_NET any (msg:"adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.180.85.18 any $HOME_NET any (msg:"exchange-it.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.180.85.19 any $HOME_NET any (msg:"adcycle.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.180.85.9 any $HOME_NET any (msg:"adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.180.86.20 any $HOME_NET any (msg:"adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.180.86.4 any $HOME_NET any (msg:"fastclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.186.160.123 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.186.161.170 any $HOME_NET any (msg:"snoobi.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.186.179.165 any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.186.187.197 any $HOME_NET any (msg:"mypowermall.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.100.58 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.101.58 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.142.182 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.148.152 any $HOME_NET any (msg:"ads.aol.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.165.121 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.165.185 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.165.249 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.165.57 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.80.9 any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.81.9 any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.82.9 any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.83.9 any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.188.93.193 any $HOME_NET any (msg:"ads.web.cs.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.201.167.135 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.203.131.34 any $HOME_NET any (msg:"a.mktw.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.204.112.70 any $HOME_NET any (msg:"dmtracking2.alibaba.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.102 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.108 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.114 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.120 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.66 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.72 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.78 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.84 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.90 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.29.96 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.205.86.51 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.206.209.58 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.147.177 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.152.166 any $HOME_NET any (msg:"methodcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.156.140 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.186.67 any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.186.68 any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.188.45 any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.188.46 any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.188.52 any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.209.188.53 any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.210.170.77 any $HOME_NET any (msg:"ads1.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 205.214.64.136 any $HOME_NET any (msg:"advertpro.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.218.64.7 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.218.65.142 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.219.72.44 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.234.175.175 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 205.236.34.206 any $HOME_NET any (msg:"webreseau.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.236.34.7 any $HOME_NET any (msg:"webreseau.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.246.203.30 any $HOME_NET any (msg:"webpower.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.246.203.36 any $HOME_NET any (msg:"clickcash.webpower.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.246.203.37 any $HOME_NET any (msg:"clickcash.webpower.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.101 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.128 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.131 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.133 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.139 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.149 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.152 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.165 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.180 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.184 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.188 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.197 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.240 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.248 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.242.39 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.243.180 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.243.65 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.243.73 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.243.89 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.251.243.97 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 205.252.167.2 any $HOME_NET any (msg:"clicktrace.info"; classtype:trojan-activity; priority:1;)
alert tcp 205.252.167.3 any $HOME_NET any (msg:"clicktrace.info"; classtype:trojan-activity; priority:1;)
alert tcp 206.107.131.10 any $HOME_NET any (msg:"ads.addesktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.123.114.138 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.123.90.137 any $HOME_NET any (msg:"reduxmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.125.166.246 any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.125.41.13 any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.127.24.153 any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.131.168.12 any $HOME_NET any (msg:"adimages.homestore.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.131.180.161 any $HOME_NET any (msg:"adimages.homestore.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.132.241.147 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.132.241.152 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 206.132.241.154 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.132.241.171 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 206.132.241.176 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.132.241.177 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.132.8.137 any $HOME_NET any (msg:"banner.orb.net"; classtype:trojan-activity; priority:1;)
alert tcp 206.138.137.100 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.14.209.56 any $HOME_NET any (msg:"oas.salon.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.14.214.45 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.14.64.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.14.64.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.113 any $HOME_NET any (msg:"ads.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.129 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.130 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.131 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.132 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.133 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.134 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.140 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.141 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.142 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.143 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.162 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.187 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.235 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.0.45 any $HOME_NET any (msg:"adimg.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.1.87 any $HOME_NET any (msg:"ads.zdnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.220.130 any $HOME_NET any (msg:"pepperjamnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.59.21 any $HOME_NET any (msg:"firstlightera.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.59.22 any $HOME_NET any (msg:"firstlightera.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.16.59.23 any $HOME_NET any (msg:"firstlightera.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.165.199.86 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.168.47.1 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.169.239.20 any $HOME_NET any (msg:"iesnare.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.188.13.105 any $HOME_NET any (msg:"ads.jiwire.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.188.13.106 any $HOME_NET any (msg:"ads.jiwire.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.188.192.127 any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.188.193.206 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 206.188.193.93 any $HOME_NET any (msg:"lucidmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.190.56.190 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.190.56.191 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.190.60.37 any $HOME_NET any (msg:"yieldmanager.net"; classtype:trojan-activity; priority:1;)
alert tcp 206.191.173.57 any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.191.173.69 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.196.125.120 any $HOME_NET any (msg:"tracker.icerocket.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.200.251.66 any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.204.187.42 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.207.85.33 any $HOME_NET any (msg:"a.consumer.net"; classtype:trojan-activity; priority:1;)
alert tcp 206.207.87.8 any $HOME_NET any (msg:"a.consumer.net"; classtype:trojan-activity; priority:1;)
alert tcp 206.214.218.200 any $HOME_NET any (msg:"sharepointads.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.214.223.6 any $HOME_NET any (msg:"takru.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.214.223.81 any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.222.17.10 any $HOME_NET any (msg:"24log.de"; classtype:trojan-activity; priority:1;)
alert tcp 206.223.146.200 any $HOME_NET any (msg:"methodcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.223.157.210 any $HOME_NET any (msg:"methodcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.223.178.88 any $HOME_NET any (msg:"ard.xxxblackbook.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.223.183.156 any $HOME_NET any (msg:"ard.xxxblackbook.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.224.64.168 any $HOME_NET any (msg:"ads.einmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.251.184.10 any $HOME_NET any (msg:"banners.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.252.153.4 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;)
alert tcp 206.252.157.58 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.33.34.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.33.54.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.33.55.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.47.74.31 any $HOME_NET any (msg:"oas.toronto.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.51.226.142 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.55.125.138 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.62.142.86 any $HOME_NET any (msg:"servethis.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.65.183.20 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 206.65.72.215 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.71.176.133 any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.72.113.48 any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.72.122.217 any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.72.124.132 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.79.171.196 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.79.194.73 any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;)
alert tcp 206.80.4.56 any $HOME_NET any (msg:"oas.salon.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.114.236.40 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.114.236.45 any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.123.33.124 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 207.123.33.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 207.123.34.126 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.123.39.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.123.40.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 207.123.40.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.123.57.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.123.61.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.126.99.149 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.126.99.165 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.126.99.166 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.126.99.174 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.13.199.239 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.136.67.30 any $HOME_NET any (msg:"casinogames.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.136.67.32 any $HOME_NET any (msg:"casinogames.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.139.24.248 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.150.154.83 any $HOME_NET any (msg:"justwebads.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.150.160.71 any $HOME_NET any (msg:"realtechnetwork.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.150.160.72 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.153.203.227 any $HOME_NET any (msg:"server.iad.liveperson.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.153.253.148 any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.12 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.14 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.187 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.44 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.47 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.48 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.59 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.63 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.7 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.71 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.72 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.73 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.76 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.78 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.248.9 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.250.23 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.109 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.118 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.12 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.18 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.38 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.4 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.47 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.48 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.59 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.63 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.71 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.72 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.73 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.76 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.252.78 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.253.151 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.155.254.23 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.159.120.151 any $HOME_NET any (msg:"i1img.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.14.112 any $HOME_NET any (msg:"ad.amgdgt.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.1 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.129 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.132 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.139 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.14 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.142 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.152 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.162 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.196 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.203 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.206 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.21 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.216 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.226 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.24 any $HOME_NET any (msg:"adzerk.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.34 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.163.4 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.166.176 any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.171.175.96 any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.130 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.136 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.142 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.148 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.154 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.160 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.166 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.172 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.178 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.176.169.184 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.178.141.253 any $HOME_NET any (msg:"cecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.178.159.100 any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.178.247.51 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.178.46.13 any $HOME_NET any (msg:"ads.ztod.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.178.46.25 any $HOME_NET any (msg:"ads.ztod.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.182.139.42 any $HOME_NET any (msg:"ads.returnpath.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.188.5.190 any $HOME_NET any (msg:"gamehouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.188.5.210 any $HOME_NET any (msg:"gamehouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.188.9.32 any $HOME_NET any (msg:"gamehouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.189.109.121 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.189.109.125 any $HOME_NET any (msg:"identads.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.189.109.37 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.189.97.33 any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.190.12.215 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.195.225.10 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.199.88.218 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.199.89.200 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.200.17.74 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.200.74.38 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.200.84.59 any $HOME_NET any (msg:"hitometer.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.200.94.38 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.210.100.18 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.210.201.116 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.210.231.201 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.210.234.196 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.218.202.34 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.218.248.11 any $HOME_NET any (msg:"adrevolver.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.218.248.21 any $HOME_NET any (msg:"sponsors.thoughtsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.219.111.20 any $HOME_NET any (msg:"casinorewards.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.226.113.55 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.229.11.11 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.230.145.120 any $HOME_NET any (msg:"ads4.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.230.146.20 any $HOME_NET any (msg:"ads4.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.230.153.11 any $HOME_NET any (msg:"ads4.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.230.156.254 any $HOME_NET any (msg:"ads.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.230.156.8 any $HOME_NET any (msg:"ads.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.231.204.32 any $HOME_NET any (msg:"as.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.231.204.56 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.234.129.124 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.234.145.148 any $HOME_NET any (msg:"topforall.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.234.158.41 any $HOME_NET any (msg:"hits4pay.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.234.224.47 any $HOME_NET any (msg:"exchange-it.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.239.63.229 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.243.40.150 any $HOME_NET any (msg:"mediageneral.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.243.40.90 any $HOME_NET any (msg:"utils.mediageneral.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.244.223.68 any $HOME_NET any (msg:"tracker.icerocket.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.135.45 any $HOME_NET any (msg:"mtree.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.136.167 any $HOME_NET any (msg:"sextracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.39 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.40 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.41 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.42 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.43 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.44 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.45 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.46 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.47 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.48 any $HOME_NET any (msg:"c3.xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.137.64 any $HOME_NET any (msg:"xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.138.104 any $HOME_NET any (msg:"sexlist.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.138.7 any $HOME_NET any (msg:"xxxcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.147.247 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.147.248 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.147.249 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.147.250 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.13 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.14 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.15 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.16 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.228 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.229 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.230 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.231 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.235 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.246.153.236 any $HOME_NET any (msg:"naiadsystems.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.25.71.155 any $HOME_NET any (msg:"customad.cnn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.250.14.13 any $HOME_NET any (msg:"ads.simtel.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.250.191.119 any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.250.236.115 any $HOME_NET any (msg:"start.freeze.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.250.236.230 any $HOME_NET any (msg:"start.freeze.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.116 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.150 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.154 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.193 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.215 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.233 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.234 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.235 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.66 any $HOME_NET any (msg:"ads.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.81 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.82 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.85 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.86 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.106.87 any $HOME_NET any (msg:"imageads.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.66.226 any $HOME_NET any (msg:"imageads.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.253.66.230 any $HOME_NET any (msg:"ads5.canoe.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.30.7.31 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.34.202.4 any $HOME_NET any (msg:"casinorewards.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.38.0.58 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.38.1.120 any $HOME_NET any (msg:"adcontent.gamespy.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.38.10.100 any $HOME_NET any (msg:"adcontent.gamespy.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.38.10.58 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.38.104.86 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.38.109.133 any $HOME_NET any (msg:"namimedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.119 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.129 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.137 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.142 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.145 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.152 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.176 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.191 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.198 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.224 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.40.149.247 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.142.38 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.144.10 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.156.26 any $HOME_NET any (msg:"yesadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.156.66 any $HOME_NET any (msg:"advertising.se"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.168.28 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.180.107 any $HOME_NET any (msg:"monsterpops.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.180.96 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.198.26 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.198.27 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.208.104 any $HOME_NET any (msg:"i-clicks.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.210.4 any $HOME_NET any (msg:"impressionz.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.210.76 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.230.81 any $HOME_NET any (msg:"ads.gaming-universe.de"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.234.51 any $HOME_NET any (msg:"ads.kinobox.cz"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.240.113 any $HOME_NET any (msg:"e-bannerx.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.242.110 any $HOME_NET any (msg:"banner.casino.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.242.21 any $HOME_NET any (msg:"adrevolver.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.248.17 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.249.93 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.44.250.116 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.46.0.87 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.46.132.59 any $HOME_NET any (msg:"clicktrade.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.46.140.60 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.46.202.23 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.46.222.15 any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.46.222.36 any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.46.234.126 any $HOME_NET any (msg:"clicktrade.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.46.31.61 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.57.118.69 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.57.97.233 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.57.97.241 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.58.130.150 any $HOME_NET any (msg:"ads.whoishostingthis.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.58.130.153 any $HOME_NET any (msg:"ads.whoishostingthis.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.58.150.206 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.58.150.207 any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.58.150.210 any $HOME_NET any (msg:"bullseye.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.58.150.216 any $HOME_NET any (msg:"backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.58.177.252 any $HOME_NET any (msg:"takru.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.58.181.66 any $HOME_NET any (msg:"topsafelist.net"; classtype:trojan-activity; priority:1;)
alert tcp 207.65.74.1 any $HOME_NET any (msg:"wetrack.it"; classtype:trojan-activity; priority:1;)
alert tcp 207.65.74.55 any $HOME_NET any (msg:"roia.biz"; classtype:trojan-activity; priority:1;)
alert tcp 207.65.74.65 any $HOME_NET any (msg:"trackingsoft.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.66.130.100 any $HOME_NET any (msg:"mbs.megaroticlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.66.130.101 any $HOME_NET any (msg:"mbs.megaroticlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.66.182.20 any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.66.182.21 any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.66.182.35 any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.66.182.36 any $HOME_NET any (msg:"banners.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.67.0.117 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.67.0.157 any $HOME_NET any (msg:"onenetworkdirect.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.67.0.192 any $HOME_NET any (msg:"affiliate.mercola.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.67.0.2 any $HOME_NET any (msg:"affiliates.babylon.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.67.0.233 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.67.0.69 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.67.50.23 any $HOME_NET any (msg:"affiliates.digitalriver.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.67.50.30 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.165.40 any $HOME_NET any (msg:"linkexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.119 any $HOME_NET any (msg:"ads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.12 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.123 any $HOME_NET any (msg:"ads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.134 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.153 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.16 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.237 any $HOME_NET any (msg:"ads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.238 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.239 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.251 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.45 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.56 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.178.61 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.179.220 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.68.179.221 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.8.198.5 any $HOME_NET any (msg:"hypertracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.8.198.8 any $HOME_NET any (msg:"hypertracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.96.133.40 any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.96.160.181 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.96.160.182 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.96.160.66 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.96.160.67 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 207.97.204.179 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 207.97.227.31 any $HOME_NET any (msg:"displayadsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.100.1.161 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;)
alert tcp 208.100.2.160 any $HOME_NET any (msg:"nitroclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.100.23.178 any $HOME_NET any (msg:"cjbmanagement.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.100.23.181 any $HOME_NET any (msg:"bannerexchange.cjb.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.100.48.100 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.101.22.159 any $HOME_NET any (msg:"arcadebanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.101.52.101 any $HOME_NET any (msg:"e-planning.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.106.213.166 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.107.61 any $HOME_NET any (msg:"adverticus.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.108.133 any $HOME_NET any (msg:"www.banner-link.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.110.189 any $HOME_NET any (msg:"www.banner-link.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.138.107 any $HOME_NET any (msg:"therichkids.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.138.55 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.181.114 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.181.173 any $HOME_NET any (msg:"malwaredomains.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.181.201 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.202.169 any $HOME_NET any (msg:"therichkids.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.78.40 any $HOME_NET any (msg:"e-bannerx.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.78.86 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.109.87.174 any $HOME_NET any (msg:"www.banner-link.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 208.110.213.154 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.110.213.157 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.113.133.168 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.113.180.250 any $HOME_NET any (msg:"oxen.hillcountrytexas.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.113.199.30 any $HOME_NET any (msg:"oxen.hillcountrytexas.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.113.204.166 any $HOME_NET any (msg:"ads.hideyourarms.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.115.111.151 any $HOME_NET any (msg:"banners.dine.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.115.111.152 any $HOME_NET any (msg:"banners.dine.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.115.111.153 any $HOME_NET any (msg:"banners.dine.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.122.50.176 any $HOME_NET any (msg:"projectwonderful.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.131.156.251 any $HOME_NET any (msg:"blast4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.131.164.131 any $HOME_NET any (msg:"ads.sptimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.149.147.204 any $HOME_NET any (msg:"ads.allsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.156.32.230 any $HOME_NET any (msg:"www.postmasterbannernet.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.166.55.20 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.167.241.150 any $HOME_NET any (msg:"protraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.167.252.184 any $HOME_NET any (msg:"banners.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.167.252.30 any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.167.252.31 any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.167.252.32 any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.17.81.156 any $HOME_NET any (msg:"oas.salon.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.176.250.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.178.167.254 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.178.18.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.178.203.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.178.235.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.178.29.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.179.133.69 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.179.16.161 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.179.9.135 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.179.9.152 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.179.9.48 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.138.100 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.139.109 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.224.88 any $HOME_NET any (msg:"clickability.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.29.210 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.39.135 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.39.137 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.6.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.6.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.184.6.69 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.101.167 any $HOME_NET any (msg:"tribalfusion.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.101.168 any $HOME_NET any (msg:"a.tribalfusion.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.127.162 any $HOME_NET any (msg:"www.freestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.127.163 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.127.166 any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.127.180 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.127.185 any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.211.70 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.211.71 any $HOME_NET any (msg:"ezula.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.211.80 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.247.210 any $HOME_NET any (msg:"clickhype.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.54.38 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.54.44 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.54.51 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.185.54.71 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.187.162.11 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.197.4.115 any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.197.94.28 any $HOME_NET any (msg:"adsmart.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.202.9.29 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.223.206.160 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.223.207.110 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.234.169.72 any $HOME_NET any (msg:"ads.elitetrader.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.237.254.136 any $HOME_NET any (msg:"ads.websiteservices.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.237.254.40 any $HOME_NET any (msg:"7search.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.239.225.244 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.253.9.126 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;)
alert tcp 208.253.92.71 any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.0.32 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.0.9 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.18.144 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.18.150 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.26.132 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.3.160 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.3.166 any $HOME_NET any (msg:"seeq.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.63.114 any $HOME_NET any (msg:"iwin.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.63.69 any $HOME_NET any (msg:"ad.iwin.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.63.86 any $HOME_NET any (msg:"trafficmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.254.75.139 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.255.131.199 any $HOME_NET any (msg:"newdata.box.sk"; classtype:trojan-activity; priority:1;)
alert tcp 208.29.69.194 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.29.69.218 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.3.90.89 any $HOME_NET any (msg:"ads.eagletribune.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.31.170.43 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.31.170.8 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.37.177.41 any $HOME_NET any (msg:"dynamic.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.37.177.42 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.37.24.10 any $HOME_NET any (msg:"clicksor.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.38.134.211 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.38.59.181 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.40.148.152 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.10.3 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.111.162 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.115.200 any $HOME_NET any (msg:"advertisingbox.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.117.131 any $HOME_NET any (msg:"admax.nexage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.121.150 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.211.232 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.215.131 any $HOME_NET any (msg:"gostats.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.220.250 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.220.251 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.225.3 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.239.180 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.244.136 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.65.206 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.79.58 any $HOME_NET any (msg:"servedbyopenx.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.89.147 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.90.233 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.92.159 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.43.92.218 any $HOME_NET any (msg:"a.collective-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.45.133.11 any $HOME_NET any (msg:"ads.iwon.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.45.133.12 any $HOME_NET any (msg:"ads.iwon.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.45.133.132 any $HOME_NET any (msg:"i1img.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.45.172.87 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.48.156.106 any $HOME_NET any (msg:"adnetinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.48.156.18 any $HOME_NET any (msg:"adnetinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.48.156.200 any $HOME_NET any (msg:"shoppingads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.48.156.201 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.48.156.211 any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.48.81.132 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.48.81.133 any $HOME_NET any (msg:"adsoldier.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.48.81.134 any $HOME_NET any (msg:"adsoldier.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.49.12.164 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.49.12.165 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.49.12.183 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.51.27.221 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.51.99.82 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 208.51.99.83 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 208.51.99.84 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 208.51.99.85 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 208.52.146.6 any $HOME_NET any (msg:"displayadsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.161 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.168 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.176 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.217 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.218 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.219 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.240 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.244 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.64 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.53.158.65 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.62.62.102 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.64.124.162 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.64.44.65 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.64.44.74 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.65.130.26 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.65.130.27 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.65.130.28 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.65.130.29 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.65.130.30 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.65.201.194 any $HOME_NET any (msg:"ads.amdmb.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.65.201.196 any $HOME_NET any (msg:"ads.amdmb.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.66.204.153 any $HOME_NET any (msg:"clicktracks.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.66.66.114 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.66.97.56 any $HOME_NET any (msg:"ad.nozonedata.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.66.99.155 any $HOME_NET any (msg:"peer39.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.67.183.100 any $HOME_NET any (msg:"cetrk.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.67.195.100 any $HOME_NET any (msg:"ads.geekswithblogs.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.67.195.47 any $HOME_NET any (msg:"ads.geekswithblogs.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.67.28.20 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.67.66.24 any $HOME_NET any (msg:"yieldmanager.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.67.70.27 any $HOME_NET any (msg:"ad.media-servers.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.67.70.3 any $HOME_NET any (msg:"ad.media-servers.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.68.156.124 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.68.156.61 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.68.157.148 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.68.157.153 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.68.59.12 any $HOME_NET any (msg:"quigo.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.68.59.16 any $HOME_NET any (msg:"adsonar.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.69.181.200 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.69.181.201 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.69.181.202 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.7.160.124 any $HOME_NET any (msg:"adserver.nydailynews.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.70.72.204 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.70.73.143 any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.70.73.35 any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.70.73.36 any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.70.73.37 any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.70.79.137 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.104.181 any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.120.75 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.121.19 any $HOME_NET any (msg:"ads.belointeractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.121.24 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.121.27 any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.121.3 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.121.30 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.121.6 any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.121.61 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.122.13 any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.122.19 any $HOME_NET any (msg:"ads.belointeractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.122.24 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.122.3 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.122.30 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.122.61 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.122.75 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.122.77 any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.101 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.111 any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.59 any $HOME_NET any (msg:"ads.belointeractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.66 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.72 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.76 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.81 any $HOME_NET any (msg:"ads.visitbritain.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.86 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.123.95 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.124.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.124.26 any $HOME_NET any (msg:"a.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.124.75 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.125.101 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.125.59 any $HOME_NET any (msg:"ads.belointeractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.125.66 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.125.72 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.125.81 any $HOME_NET any (msg:"ads.visitbritain.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.125.86 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.71.125.95 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.0.7 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.192.133 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.2.178 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.2.179 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.2.18 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.2.180 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.2.186 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.2.187 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.2.19 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.72.2.20 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.102 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.128 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.147 any $HOME_NET any (msg:"popups.infostart.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.152 any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.155 any $HOME_NET any (msg:"zenzuu.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.162 any $HOME_NET any (msg:"maximumcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.171 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.200 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.201 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.202 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.203 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.204 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.205 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.206 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.208 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.209 any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.216 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.233 any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.48 any $HOME_NET any (msg:"identads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.50 any $HOME_NET any (msg:"identads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.76 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.84 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.210.85 any $HOME_NET any (msg:"popups.infostart.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.165 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.169 any $HOME_NET any (msg:"banner.orb.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.173 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.179 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.180 any $HOME_NET any (msg:"banner.orb.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.184 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.187 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.188 any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.189 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.191 any $HOME_NET any (msg:"banner.orb.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.192 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.193 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.194 any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.197 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.198 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.230 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.233 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.234 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.239 any $HOME_NET any (msg:"banner.orb.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.247 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.249 any $HOME_NET any (msg:"liquidad.narrowcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.250 any $HOME_NET any (msg:"banner.orb.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.67 any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.69 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.211.70 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.214.9 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.51.100 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.73.51.101 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.75.170.1 any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.75.170.35 any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.75.250.50 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.75.252.106 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.75.252.107 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.75.252.108 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.75.252.109 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.77.165.232 any $HOME_NET any (msg:"optimost.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.169.230 any $HOME_NET any (msg:"dynamic.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.169.231 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.242.184 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.43.138 any $HOME_NET any (msg:"chitika.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.93.118 any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.93.67 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.93.68 any $HOME_NET any (msg:"hostedads.realitykings.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.94.100 any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.94.101 any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.94.73 any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.78.94.96 any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.79.78.230 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.80.4.106 any $HOME_NET any (msg:"ads.epltalk.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.80.56.11 any $HOME_NET any (msg:"clickability.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.201.12 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.201.14 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.233.74 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.233.75 any $HOME_NET any (msg:"oascentral.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.233.77 any $HOME_NET any (msg:"ads.mgnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.234.108 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.234.117 any $HOME_NET any (msg:"oas.repubblica.it"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.234.123 any $HOME_NET any (msg:"ad.eurosport.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.234.17 any $HOME_NET any (msg:"ads.trinitymirror.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.234.21 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 208.81.234.97 any $HOME_NET any (msg:"ads.trinitymirror.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 208.82.241.18 any $HOME_NET any (msg:"counters.honesty.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.83.240.70 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.83.240.71 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.83.241.15 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.83.241.70 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.83.243.15 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.83.243.215 any $HOME_NET any (msg:"ads.okcimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.83.243.71 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.84.244.62 any $HOME_NET any (msg:"ads.ole.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.84.50.37 any $HOME_NET any (msg:"ads.datinggold.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.86.184.106 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.149.250 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.32.69 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.32.71 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.32.75 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.33.150 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.33.151 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.34.18 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.34.65 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.34.69 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.34.70 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.34.71 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.35.100 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.35.101 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.35.103 any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.35.105 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.35.106 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.87.35.107 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.176.118 any $HOME_NET any (msg:"banners.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.176.7 any $HOME_NET any (msg:"geobanner.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.177.195 any $HOME_NET any (msg:"ad.bondage.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.178.131 any $HOME_NET any (msg:"ads.slim.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.180.129 any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.180.81 any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.180.89 any $HOME_NET any (msg:"medleyads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.180.90 any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.180.91 any $HOME_NET any (msg:"affiliates.streamray.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.180.96 any $HOME_NET any (msg:"ads.gradfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.88.182.248 any $HOME_NET any (msg:"pop6.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.135.45 any $HOME_NET any (msg:"avpa.javalobby.org"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.196.123 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.196.138 any $HOME_NET any (msg:"adcept.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.196.19 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.196.4 any $HOME_NET any (msg:"cnomy.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.196.49 any $HOME_NET any (msg:"180searchassistant.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.196.6 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.196.81 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.196.94 any $HOME_NET any (msg:"bestsearch.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.108 any $HOME_NET any (msg:"ru-traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.132 any $HOME_NET any (msg:"affiliates.digitalriver.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.160 any $HOME_NET any (msg:"lop.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.163 any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.19 any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.197 any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.198 any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.235 any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.239 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.27 any $HOME_NET any (msg:"ewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.46 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.49 any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.197.64 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.91.207.10 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.92.238.150 any $HOME_NET any (msg:"reinvigorate.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.93.154.82 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 208.93.170.12 any $HOME_NET any (msg:"as.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.93.170.15 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.94.146.70 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.94.146.71 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.94.146.80 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.94.146.81 any $HOME_NET any (msg:"metaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.94.147.64 any $HOME_NET any (msg:"bizographics.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.94.147.65 any $HOME_NET any (msg:"bizographics.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.94.234.219 any $HOME_NET any (msg:"cjlog.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.96.4.68 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.96.56.194 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.96.60.21 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.97.171.74 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.97.187.156 any $HOME_NET any (msg:"ads.newdream.net"; classtype:trojan-activity; priority:1;)
alert tcp 208.99.115.30 any $HOME_NET any (msg:"ads.kelbymediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp 208.99.65.140 any $HOME_NET any (msg:"ads.4tube.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.10.215.36 any $HOME_NET any (msg:"rightmedia.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.10.222.113 any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.100.120.162 any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.36.190 any $HOME_NET any (msg:"ads.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.39.100 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.45.249 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.52.75 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.53.100 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.53.200 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.54.75 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.58.249 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.60.21 any $HOME_NET any (msg:"ads.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.63.100 any $HOME_NET any (msg:"ads.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.104.63.50 any $HOME_NET any (msg:"ads.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.11.107.14 any $HOME_NET any (msg:"ads.linuxsecurity.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.11.131.36 any $HOME_NET any (msg:"counters.honesty.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.11.158.51 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.11.45.139 any $HOME_NET any (msg:"whenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.11.51.41 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.112.246.109 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.112.44.10 any $HOME_NET any (msg:"ac.rnm.ca"; classtype:trojan-activity; priority:1;)
alert tcp 209.114.36.39 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.12.183.116 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.120.187.164 any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.120.187.245 any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.123.16.29 any $HOME_NET any (msg:"popups.infostart.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.123.16.48 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.123.16.9 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.123.93.133 any $HOME_NET any (msg:"sharepointads.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.126.131.118 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.126.137.252 any $HOME_NET any (msg:"101order.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.126.144.13 any $HOME_NET any (msg:"ads.linuxjournal.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.126.180.114 any $HOME_NET any (msg:"ads.linuxjournal.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.126.229.49 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.128.119.142 any $HOME_NET any (msg:"visistat.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.128.76.107 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.128.96.136 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.205.101 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.205.220 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.205.221 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.205.222 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.205.75 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.205.76 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.212.132 any $HOME_NET any (msg:"casalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.218.66 any $HOME_NET any (msg:"adserv.internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.218.69 any $HOME_NET any (msg:"nitrous.internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.218.74 any $HOME_NET any (msg:"exitfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.98.135 any $HOME_NET any (msg:"oas.uniontrib.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.98.141 any $HOME_NET any (msg:"oas.uniontrib.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.132.99.12 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.134.134.70 any $HOME_NET any (msg:"inboxdollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.134.134.76 any $HOME_NET any (msg:"inboxdollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.134.81.168 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.137.142.124 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.143.236.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.143.236.22 any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.143.243.200 any $HOME_NET any (msg:"ads.web21.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.144.102.30 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.15.13.155 any $HOME_NET any (msg:"revstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.15.209.201 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.15.247.16 any $HOME_NET any (msg:"casinorewards.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.151.66.66 any $HOME_NET any (msg:"advertpro.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.160.78.71 any $HOME_NET any (msg:"adtoll.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.163.251.92 any $HOME_NET any (msg:"adserver.sharewareonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.164.14.52 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.164.25.49 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.167.176.67 any $HOME_NET any (msg:"ads.totallyfreestuff.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.167.25.58 any $HOME_NET any (msg:"ads.techtv.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.170.119.70 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.170.119.71 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.170.120.39 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.170.120.40 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.170.120.41 any $HOME_NET any (msg:"start.freeze.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.170.120.42 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.170.75.186 any $HOME_NET any (msg:"i.xx.openx.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.171.44.235 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.172.48.247 any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.18.117.91 any $HOME_NET any (msg:"pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.185.12.38 any $HOME_NET any (msg:"banners.amigos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.185.12.42 any $HOME_NET any (msg:"banners.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.185.12.47 any $HOME_NET any (msg:"adserver.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.190.106.126 any $HOME_NET any (msg:"exelator.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.190.244.231 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.190.244.232 any $HOME_NET any (msg:"findcommerce.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.190.46.122 any $HOME_NET any (msg:"24log.de"; classtype:trojan-activity; priority:1;)
alert tcp 209.190.74.71 any $HOME_NET any (msg:"exelator.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.191.189.249 any $HOME_NET any (msg:"tracker.icerocket.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.196.28.153 any $HOME_NET any (msg:"scanscout.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.196.6.247 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.197.107.132 any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.197.109.60 any $HOME_NET any (msg:"myhq.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.197.4.228 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.197.79.97 any $HOME_NET any (msg:"promote.pair.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.197.86.5 any $HOME_NET any (msg:"globalismedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.114.220 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.15.203 any $HOME_NET any (msg:"blingbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.153.152 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.154.146 any $HOME_NET any (msg:"cashengines.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.154.207 any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.154.23 any $HOME_NET any (msg:"crowdgravity.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.154.30 any $HOME_NET any (msg:"cashengines.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.155.63 any $HOME_NET any (msg:"webtrackerplus.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.200.32.218 any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.136.69 any $HOME_NET any (msg:"admarvel.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.192.30 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.196.215 any $HOME_NET any (msg:"ads.tripod.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.216.190 any $HOME_NET any (msg:"adbuyer3.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.216.25 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.216.27 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.226.100 any $HOME_NET any (msg:"sidebar.angelfire.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.229.100 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.229.190 any $HOME_NET any (msg:"ratings.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.230.30 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.238.23 any $HOME_NET any (msg:"pennyweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.240.210 any $HOME_NET any (msg:"sidebar.angelfire.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.248.101 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.248.105 any $HOME_NET any (msg:"adbuyer3.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.248.202 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.252.49 any $HOME_NET any (msg:"ads.tripod.lycos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.252.50 any $HOME_NET any (msg:"sidebar.angelfire.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.254.12 any $HOME_NET any (msg:"ads.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.254.14 any $HOME_NET any (msg:"hit.webcentre.lycos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 209.202.254.61 any $HOME_NET any (msg:"ratings.lycos.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.207.137.253 any $HOME_NET any (msg:"www.banner-link.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 209.207.213.228 any $HOME_NET any (msg:"shareasale.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.1.189 any $HOME_NET any (msg:"ads.bonniercorp.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.1.59 any $HOME_NET any (msg:"ads.bonniercorp.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.186.68 any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.193.226 any $HOME_NET any (msg:"ad.yieldmanager.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.224.14 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.224.46 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.224.47 any $HOME_NET any (msg:"adtoll.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.224.48 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.224.54 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.224.72 any $HOME_NET any (msg:"abz.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.208.224.74 any $HOME_NET any (msg:"abz.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.210.82.54 any $HOME_NET any (msg:"ad.nozonedata.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.217.235.45 any $HOME_NET any (msg:"azfront.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.222.138.10 any $HOME_NET any (msg:"ads03.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.222.14.3 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.222.14.6 any $HOME_NET any (msg:"bannieres.acces-contenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.222.20.196 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.225.0.6 any $HOME_NET any (msg:"psstt.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.225.26.101 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.225.31.222 any $HOME_NET any (msg:"247media.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.225.4.72 any $HOME_NET any (msg:"adsdk.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.225.6.77 any $HOME_NET any (msg:"bannerfarm.ace.advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.234.225.12 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.234.225.242 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.234.225.243 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.234.225.9 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.234.234.12 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.234.234.16 any $HOME_NET any (msg:"ad.wsod.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.236.116.134 any $HOME_NET any (msg:"midnightclicking.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.236.116.50 any $HOME_NET any (msg:"midnightclicking.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.236.69.209 any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.237.150.20 any $HOME_NET any (msg:"checkm8.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.237.248.20 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.237.248.22 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.239.162.220 any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.239.235.92 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.240.140.3 any $HOME_NET any (msg:"123banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.240.140.50 any $HOME_NET any (msg:"123banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.240.144.110 any $HOME_NET any (msg:"123banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.244.156.19 any $HOME_NET any (msg:"insightexpressai.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.244.156.20 any $HOME_NET any (msg:"insightexpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.249.123.17 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.249.123.18 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.249.142.8 any $HOME_NET any (msg:"revsci.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.249.20.150 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.249.222.13 any $HOME_NET any (msg:"cashcrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.249.222.15 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.25.170.74 any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.25.195.13 any $HOME_NET any (msg:"tangerinenet.biz"; classtype:trojan-activity; priority:1;)
alert tcp 209.25.203.42 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.31.10.36 any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.31.10.55 any $HOME_NET any (msg:"hydramedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.34.255.54 any $HOME_NET any (msg:"adorigin.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.35.17.16 any $HOME_NET any (msg:"zeus.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.40.194.228 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.40.194.254 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.40.195.251 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.40.196.238 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.40.202.254 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.40.206.130 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.40.206.249 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.40.206.57 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.43.36.178 any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.43.95.155 any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.43.95.210 any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.47.15.100 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.47.169.169 any $HOME_NET any (msg:"banners.sexsearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.47.169.170 any $HOME_NET any (msg:"textad.sexsearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.47.169.99 any $HOME_NET any (msg:"banners.sexsearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.47.223.20 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 209.47.244.100 any $HOME_NET any (msg:"reliablebanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.47.46.153 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.47.46.171 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.50.238.162 any $HOME_NET any (msg:"topsafelist.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.50.243.18 any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.50.243.20 any $HOME_NET any (msg:"its-that-easy.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.50.243.21 any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.51.178.50 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.51.178.60 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.51.178.70 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.51.211.43 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.51.211.45 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.51.211.66 any $HOME_NET any (msg:"24log.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.58.234.202 any $HOME_NET any (msg:"hitslink.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.142.50 any $HOME_NET any (msg:"ads.justhungry.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.169.42 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.169.43 any $HOME_NET any (msg:"tubemogul.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.174.254 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.194.181 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.194.182 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.194.20 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.194.229 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.195.20 any $HOME_NET any (msg:"clickadz.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.206.58 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.207.239 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.209.212 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.59.209.213 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.61.129.10 any $HOME_NET any (msg:"topstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.61.159.92 any $HOME_NET any (msg:"start.freeze.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.61.194.46 any $HOME_NET any (msg:"adapt.tv"; classtype:trojan-activity; priority:1;)
alert tcp 209.61.208.39 any $HOME_NET any (msg:"adcept.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.61.208.77 any $HOME_NET any (msg:"adcept.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.105.12 any $HOME_NET any (msg:"lop.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.105.19 any $HOME_NET any (msg:"iconadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.116.154 any $HOME_NET any (msg:"buysellads.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.126.2 any $HOME_NET any (msg:"gtop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.176.188 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.176.73 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.20.192 any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.20.205 any $HOME_NET any (msg:"iconadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.20.238 any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.20.241 any $HOME_NET any (msg:"iconadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.21.204 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.58.226 any $HOME_NET any (msg:"topmmorpgsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.62.70.114 any $HOME_NET any (msg:"gamesitestop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.63.57.3 any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.66.83.100 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.66.88.60 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.67.1.131 any $HOME_NET any (msg:"bannersgomlm.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.67.16.10 any $HOME_NET any (msg:"ch.questionmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.67.27.19 any $HOME_NET any (msg:"ch.questionmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.71.233.226 any $HOME_NET any (msg:"adcentriconline.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.73.171.102 any $HOME_NET any (msg:"adserver.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.73.203.226 any $HOME_NET any (msg:"rightmedia.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.73.249.108 any $HOME_NET any (msg:"viewpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.8.166.155 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.8.166.168 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.80.46.10 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.80.46.30 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.80.46.90 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.81.12.134 any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.81.12.135 any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.81.12.144 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.81.12.145 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.81.82.112 any $HOME_NET any (msg:"linkstorms.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.81.83.165 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.82.116.163 any $HOME_NET any (msg:"www1.gto-media.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.82.48.20 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.0.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.11.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.12.126 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.13.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.24.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.3.126 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.6.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.7.124 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.7.125 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 209.84.7.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.100.27 any $HOME_NET any (msg:"xtremetop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.107.195 any $HOME_NET any (msg:"neoffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.113.107 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.113.7 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.129.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.129.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.129.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.129.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.133.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.133.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.133.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.133.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.135.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.135.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.135.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.135.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.135.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.137.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.137.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.137.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.139.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.139.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.139.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.139.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.139.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.139.99 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.143.100 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.143.101 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.143.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.143.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.143.164 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.143.165 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.143.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.148 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.149 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.164 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.165 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.166 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.167 any $HOME_NET any (msg:"partnerad.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.146.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.147.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.159.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.159.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.159.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.161.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.161.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.161.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.161.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.169.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.171.99 any $HOME_NET any (msg:"google-analytics.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.173.118 any $HOME_NET any (msg:"wintricksbanner.googlepages.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.173.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.225.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.106 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.227.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.100 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.101 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.102 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.103 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.104 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.105 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.113 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.138 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.139 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.147 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.164 any $HOME_NET any (msg:"pagead.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.165 any $HOME_NET any (msg:"pagead.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.166 any $HOME_NET any (msg:"pagead.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.229.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.48.90 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.51.171 any $HOME_NET any (msg:"anahtars.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.51.226 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.51.229 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.85.51.47 any $HOME_NET any (msg:"cnomy.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.87.178.183 any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.87.178.246 any $HOME_NET any (msg:"ads.simtel.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.87.178.92 any $HOME_NET any (msg:"regnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.87.181.211 any $HOME_NET any (msg:"esellerate.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.87.181.34 any $HOME_NET any (msg:"ad1.gamezone.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.94.144.214 any $HOME_NET any (msg:"jumptap.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.97.213.94 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.97.46.7 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.97.50.10 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.97.50.34 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.97.61.49 any $HOME_NET any (msg:"ads.desmoinesregister.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.97.63.247 any $HOME_NET any (msg:"ads.infi.net"; classtype:trojan-activity; priority:1;)
alert tcp 209.97.63.66 any $HOME_NET any (msg:"ads.desmoinesregister.com"; classtype:trojan-activity; priority:1;)
alert tcp 209.99.96.15 any $HOME_NET any (msg:"fleshlightcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.109.98.11 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.136.232.196 any $HOME_NET any (msg:"valuecommerce.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.153.88.114 any $HOME_NET any (msg:"xrea.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.155.159.25 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.155.159.26 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.155.159.27 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.155.159.40 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.155.159.41 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.155.159.43 any $HOME_NET any (msg:"banners.freett.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.157.1.211 any $HOME_NET any (msg:"adjustnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.160.201.29 any $HOME_NET any (msg:"ad.nttnavi.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp 210.173.168.41 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.173.168.46 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.173.168.49 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.173.168.53 any $HOME_NET any (msg:"adnet.asahi.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.184.179.24 any $HOME_NET any (msg:"adx.atnext.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.188.206.225 any $HOME_NET any (msg:"clicktrack.ziyu.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.190.124.196 any $HOME_NET any (msg:"ad.nttnavi.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp 210.193.114.160 any $HOME_NET any (msg:"ad.nttnavi.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp 210.193.135.195 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.198.12.132 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;)
alert tcp 210.245.164.145 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.245.166.132 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.245.166.133 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.245.166.139 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.245.166.144 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.1 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.11 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.12 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.13 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.16 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.17 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.2 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.21 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.26 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.27 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.28 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.29 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.6 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.7 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.247.196.8 any $HOME_NET any (msg:"adsfac.net"; classtype:trojan-activity; priority:1;)
alert tcp 210.4.86.54 any $HOME_NET any (msg:"ads.betfair.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 210.48.127.22 any $HOME_NET any (msg:"webads.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 210.48.49.77 any $HOME_NET any (msg:"ads.nzcity.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 210.59.224.178 any $HOME_NET any (msg:"hotrank.com.tw"; classtype:trojan-activity; priority:1;)
alert tcp 210.73.210.155 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp 210.83.80.118 any $HOME_NET any (msg:"ip193.cn"; classtype:trojan-activity; priority:1;)
alert tcp 211.115.216.227 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp 211.115.71.50 any $HOME_NET any (msg:"counter.nowlinux.com"; classtype:trojan-activity; priority:1;)
alert tcp 211.128.99.12 any $HOME_NET any (msg:"ba.afl.rakuten.co.jp"; classtype:trojan-activity; priority:1;)
alert tcp 211.13.223.60 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;)
alert tcp 211.147.222.95 any $HOME_NET any (msg:"ads.datingyes.com"; classtype:trojan-activity; priority:1;)
alert tcp 211.151.90.109 any $HOME_NET any (msg:"ads.datingyes.com"; classtype:trojan-activity; priority:1;)
alert tcp 211.233.15.102 any $HOME_NET any (msg:"counter.nowlinux.com"; classtype:trojan-activity; priority:1;)
alert tcp 211.233.58.252 any $HOME_NET any (msg:"c1.nowlinux.com"; classtype:trojan-activity; priority:1;)
alert tcp 211.43.204.69 any $HOME_NET any (msg:"counter.nowlinux.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.0.126.131 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.0.126.132 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.100.224.141 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.100.224.98 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.100.228.39 any $HOME_NET any (msg:"adserver.43plc.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.100.230.160 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.100.232.211 any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.100.242.131 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 212.100.244.217 any $HOME_NET any (msg:"ads.virtualcountries.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.100.248.114 any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.105.63.50 any $HOME_NET any (msg:"banner.ad.nu"; classtype:trojan-activity; priority:1;)
alert tcp 212.106.140.178 any $HOME_NET any (msg:"adprojekt.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.109.32.239 any $HOME_NET any (msg:"a-counter.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp 212.109.44.40 any $HOME_NET any (msg:"a-counter.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp 212.110.12.189 any $HOME_NET any (msg:"adv.hwupgrade.it"; classtype:trojan-activity; priority:1;)
alert tcp 212.111.40.5 any $HOME_NET any (msg:"cpays.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.111.40.6 any $HOME_NET any (msg:"cpays.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.128.242 any $HOME_NET any (msg:"ads.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.128.54 any $HOME_NET any (msg:"ads.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.131.20 any $HOME_NET any (msg:"ads2.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.131.8 any $HOME_NET any (msg:"ads2.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.144.157 any $HOME_NET any (msg:"ads.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.188.33 any $HOME_NET any (msg:"admeta.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.189.62 any $HOME_NET any (msg:"ads.nordichardware.se"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.225.4 any $HOME_NET any (msg:"pagerank-submitter.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.231.112 any $HOME_NET any (msg:"ranking-charts.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.231.43 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.51.22 any $HOME_NET any (msg:"a2.tp-media.se"; classtype:trojan-activity; priority:1;)
alert tcp 212.112.53.9 any $HOME_NET any (msg:"a2.tp-media.se"; classtype:trojan-activity; priority:1;)
alert tcp 212.113.23.142 any $HOME_NET any (msg:"as1.advfn.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.113.31.51 any $HOME_NET any (msg:"oas.repubblica.it"; classtype:trojan-activity; priority:1;)
alert tcp 212.113.31.55 any $HOME_NET any (msg:"pub.realmedia.fr"; classtype:trojan-activity; priority:1;)
alert tcp 212.122.64.2 any $HOME_NET any (msg:"ads.5ci.lt"; classtype:trojan-activity; priority:1;)
alert tcp 212.122.64.6 any $HOME_NET any (msg:"ads.5ci.lt"; classtype:trojan-activity; priority:1;)
alert tcp 212.122.94.13 any $HOME_NET any (msg:"ads.5ci.lt"; classtype:trojan-activity; priority:1;)
alert tcp 212.123.106.142 any $HOME_NET any (msg:"adserv.gamezone.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.123.93.226 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.123.93.230 any $HOME_NET any (msg:"ads.filmup.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.124.126.15 any $HOME_NET any (msg:"adshost1.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.124.126.6 any $HOME_NET any (msg:"adshost1.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.124.126.9 any $HOME_NET any (msg:"adshost1.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.130.209.231 any $HOME_NET any (msg:"ads.edbindex.dk"; classtype:trojan-activity; priority:1;)
alert tcp 212.135.93.136 any $HOME_NET any (msg:"media.ftv-publicite.fr"; classtype:trojan-activity; priority:1;)
alert tcp 212.135.93.144 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.135.93.145 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 212.135.93.152 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.135.93.153 any $HOME_NET any (msg:"a32.g.a.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.143.22.63 any $HOME_NET any (msg:"ads10.speedbit.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.144.5.1 any $HOME_NET any (msg:"levelrate.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.146.105.199 any $HOME_NET any (msg:"adbanner.ro"; classtype:trojan-activity; priority:1;)
alert tcp 212.146.105.218 any $HOME_NET any (msg:"clickmedia.ro"; classtype:trojan-activity; priority:1;)
alert tcp 212.147.135.170 any $HOME_NET any (msg:"statistik-gallup.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.158.163.252 any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;)
alert tcp 212.160.67.149 any $HOME_NET any (msg:"stat.webmedia.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.160.67.252 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.160.67.4 any $HOME_NET any (msg:"stat.webmedia.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.160.67.5 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.161.99.150 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.161.99.161 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.161.99.179 any $HOME_NET any (msg:"as1.advfn.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.162.1.201 any $HOME_NET any (msg:"stat.livejournal.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.176.41.3 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;)
alert tcp 212.176.41.4 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;)
alert tcp 212.176.41.5 any $HOME_NET any (msg:"count.rin.ru"; classtype:trojan-activity; priority:1;)
alert tcp 212.178.133.162 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.178.133.163 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.178.133.185 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.179.107.203 any $HOME_NET any (msg:"media-servers.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.179.38.71 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.179.42.132 any $HOME_NET any (msg:"targetpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.187.153.203 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 212.187.153.37 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 212.187.163.235 any $HOME_NET any (msg:"profero.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.187.213.142 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.187.241.144 any $HOME_NET any (msg:"z5x.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.19.46.100 any $HOME_NET any (msg:"banner.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.19.46.102 any $HOME_NET any (msg:"adserver1.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.19.46.106 any $HOME_NET any (msg:"adserver2.mindshare.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.19.46.97 any $HOME_NET any (msg:"adserver1.ogilvy-interactive.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.199.125.58 any $HOME_NET any (msg:"adonspot.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.199.30.107 any $HOME_NET any (msg:"bans.adserver.co.il"; classtype:trojan-activity; priority:1;)
alert tcp 212.203.28.217 any $HOME_NET any (msg:"ads.addesktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.209.91.203 any $HOME_NET any (msg:"tradedoubler.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.30 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.32 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.34 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.35 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.36 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.38 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.39 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.40 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.41 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.42 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.43 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.44 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.45 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.51.46 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.17 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.18 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.19 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.20 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.21 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.22 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.23 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.24 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.25 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.26 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.27 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.28 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.29 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.30 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.31 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.32 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.33 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.34 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.35 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.36 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.37 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.38 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.39 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.40 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.41 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.42 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.43 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.44 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.45 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.222.52.46 any $HOME_NET any (msg:"api.intensifier.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.223.100.132 any $HOME_NET any (msg:"ad.onad.eu"; classtype:trojan-activity; priority:1;)
alert tcp 212.223.100.249 any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.227.114.50 any $HOME_NET any (msg:"bannercommunity.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.227.248.55 any $HOME_NET any (msg:"adrotate.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.227.253.147 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.227.34.3 any $HOME_NET any (msg:"webangel.ru"; classtype:trojan-activity; priority:1;)
alert tcp 212.227.57.148 any $HOME_NET any (msg:"muwmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.227.67.37 any $HOME_NET any (msg:"adclient.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.227.82.159 any $HOME_NET any (msg:"ads.resoom.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.227.94.49 any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.23.166.76 any $HOME_NET any (msg:"mediaplazza.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.23.180.18 any $HOME_NET any (msg:"ad.eurosport.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.23.181.22 any $HOME_NET any (msg:"ad.eurosport.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.23.57.18 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.23.57.22 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.239.14.211 any $HOME_NET any (msg:"adserver.break-even.it"; classtype:trojan-activity; priority:1;)
alert tcp 212.24.129.14 any $HOME_NET any (msg:"ad.way.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.24.155.211 any $HOME_NET any (msg:"ads2.xnet.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.242.252.93 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.25.58.202 any $HOME_NET any (msg:"exchange.bg"; classtype:trojan-activity; priority:1;)
alert tcp 212.250.162.55 any $HOME_NET any (msg:"adserver.virginmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.254.206.50 any $HOME_NET any (msg:"banner.buempliz-online.ch"; classtype:trojan-activity; priority:1;)
alert tcp 212.27.48.10 any $HOME_NET any (msg:"proxad.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.27.63.127 any $HOME_NET any (msg:"pub.chez.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.3.243.139 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.3.243.141 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.3.243.142 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.3.247.176 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.36.131.151 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.36.57.170 any $HOME_NET any (msg:"grapeshot.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 212.37.4.242 any $HOME_NET any (msg:"reklam.rfsl.se"; classtype:trojan-activity; priority:1;)
alert tcp 212.39.15.2 any $HOME_NET any (msg:"pro-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.39.26.19 any $HOME_NET any (msg:"pro-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.4.171.51 any $HOME_NET any (msg:"webmasterplan.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.4.174.108 any $HOME_NET any (msg:"banners.webmasterplan.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.4.174.80 any $HOME_NET any (msg:"partners.webmasterplan.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.4.174.88 any $HOME_NET any (msg:"webmasterplan.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.40.120.246 any $HOME_NET any (msg:"stat.dyna.ultraweb.hu"; classtype:trojan-activity; priority:1;)
alert tcp 212.40.34.158 any $HOME_NET any (msg:"a-counter.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp 212.40.96.109 any $HOME_NET any (msg:"img.prohardver.hu"; classtype:trojan-activity; priority:1;)
alert tcp 212.42.163.201 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.43.196.30 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.43.218.207 any $HOME_NET any (msg:"pub.hardware.fr"; classtype:trojan-activity; priority:1;)
alert tcp 212.43.221.21 any $HOME_NET any (msg:"ads.adverline.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.46.144.72 any $HOME_NET any (msg:"utarget.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 212.47.7.226 any $HOME_NET any (msg:"banner.penguin.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.50.1.100 any $HOME_NET any (msg:"counter.search.bg"; classtype:trojan-activity; priority:1;)
alert tcp 212.53.89.138 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.53.95.124 any $HOME_NET any (msg:"adpepper.dk"; classtype:trojan-activity; priority:1;)
alert tcp 212.59.22.98 any $HOME_NET any (msg:"click.absoluteagency.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.61.16.196 any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;)
alert tcp 212.62.19.199 any $HOME_NET any (msg:"ads.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.62.90.209 any $HOME_NET any (msg:"coupling-media.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.63.148.10 any $HOME_NET any (msg:"ranking-liste.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.63.205.177 any $HOME_NET any (msg:"advertising.se"; classtype:trojan-activity; priority:1;)
alert tcp 212.64.134.185 any $HOME_NET any (msg:"au2m8.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.65.220.211 any $HOME_NET any (msg:"adrenaline.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.66.15.204 any $HOME_NET any (msg:"banner.media-system.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.66.3.39 any $HOME_NET any (msg:"mediascale.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.67.190.137 any $HOME_NET any (msg:"banners.resultonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.67.202.17 any $HOME_NET any (msg:"hits4me.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.69.36.82 any $HOME_NET any (msg:"adsmin.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.69.36.85 any $HOME_NET any (msg:"adsmin.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.71.128.31 any $HOME_NET any (msg:"ad.wz.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.71.156.26 any $HOME_NET any (msg:"first.nova.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.184.115 any $HOME_NET any (msg:"cash4popup.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.38.140 any $HOME_NET any (msg:"sitestat.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.38.44 any $HOME_NET any (msg:"nedstatpro.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.38.60 any $HOME_NET any (msg:"nedstat.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.38.61 any $HOME_NET any (msg:"nedstat.nl"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.38.63 any $HOME_NET any (msg:"nedstatpro.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.38.70 any $HOME_NET any (msg:"nedstatbasic.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.38.74 any $HOME_NET any (msg:"www.nedstat.nl"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.48.41 any $HOME_NET any (msg:"nedstatbasic.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.51.165 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.51.170 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.72.57.246 any $HOME_NET any (msg:"netdirect.nl"; classtype:trojan-activity; priority:1;)
alert tcp 212.75.130.203 any $HOME_NET any (msg:"adverticum.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.75.96.241 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.75.96.242 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.77.100.127 any $HOME_NET any (msg:"adv.wp.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.77.226.32 any $HOME_NET any (msg:"ads.wwe.biz"; classtype:trojan-activity; priority:1;)
alert tcp 212.77.99.8 any $HOME_NET any (msg:"adv.wp.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.78.200.116 any $HOME_NET any (msg:"ads2.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp 212.78.204.110 any $HOME_NET any (msg:"ads.tripod.lycos.nl"; classtype:trojan-activity; priority:1;)
alert tcp 212.78.206.117 any $HOME_NET any (msg:"hit.webcentre.lycos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 212.79.243.206 any $HOME_NET any (msg:"phpadsnew.new.natuurpark.nl"; classtype:trojan-activity; priority:1;)
alert tcp 212.80.128.26 any $HOME_NET any (msg:"ads.recoletos.es"; classtype:trojan-activity; priority:1;)
alert tcp 212.80.177.160 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.80.177.231 any $HOME_NET any (msg:"ads.prisacom.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.80.70.76 any $HOME_NET any (msg:"ireklama.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.80.76.154 any $HOME_NET any (msg:"toplist.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.80.76.21 any $HOME_NET any (msg:"ad.seznam.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.80.76.58 any $HOME_NET any (msg:"1.im.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.80.76.72 any $HOME_NET any (msg:"ad.seznam.cz"; classtype:trojan-activity; priority:1;)
alert tcp 212.82.120.52 any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.82.212.206 any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 212.82.212.211 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp 212.83.144.135 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.83.144.21 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.85.117.210 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.85.120.147 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.85.126.24 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.85.33.17 any $HOME_NET any (msg:"adserver.barrapunto.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.85.34.51 any $HOME_NET any (msg:"adserver.barrapunto.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.85.34.52 any $HOME_NET any (msg:"adserver.barrapunto.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.87.11.134 any $HOME_NET any (msg:"hit.gemius.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.87.11.135 any $HOME_NET any (msg:"hit.gemius.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.87.11.153 any $HOME_NET any (msg:"hit.gemius.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.88.149.166 any $HOME_NET any (msg:"sponsorads.de"; classtype:trojan-activity; priority:1;)
alert tcp 212.91.6.58 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.91.7.33 any $HOME_NET any (msg:"adserver.pl"; classtype:trojan-activity; priority:1;)
alert tcp 212.92.23.237 any $HOME_NET any (msg:"reklamcsere.hu"; classtype:trojan-activity; priority:1;)
alert tcp 212.93.228.5 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.93.228.8 any $HOME_NET any (msg:"ads.centraliprom.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.95.67.18 any $HOME_NET any (msg:"mediaplazza.com"; classtype:trojan-activity; priority:1;)
alert tcp 212.95.67.92 any $HOME_NET any (msg:"pubs.lemonde.fr"; classtype:trojan-activity; priority:1;)
alert tcp 212.95.70.114 any $HOME_NET any (msg:"media.ftv-publicite.fr"; classtype:trojan-activity; priority:1;)
alert tcp 212.95.74.5 any $HOME_NET any (msg:"media.ftv-publicite.fr"; classtype:trojan-activity; priority:1;)
alert tcp 213.115.231.140 any $HOME_NET any (msg:"netpool.netbookia.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.121.143.197 any $HOME_NET any (msg:"log.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.121.143.205 any $HOME_NET any (msg:"admanager.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.121.143.206 any $HOME_NET any (msg:"staticads.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.121.143.236 any $HOME_NET any (msg:"log.btopenworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.128.138.236 any $HOME_NET any (msg:"pr-star.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.13.145.12 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp 213.13.146.170 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp 213.13.65.100 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp 213.13.65.101 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp 213.130.46.221 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.130.63.232 any $HOME_NET any (msg:"adimages.been.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.130.63.233 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.130.63.235 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.131.245.218 any $HOME_NET any (msg:"ads5.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.131.245.220 any $HOME_NET any (msg:"ads2.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.131.245.221 any $HOME_NET any (msg:"ads.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.131.245.222 any $HOME_NET any (msg:"ads.virtual-nights.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.131.252.240 any $HOME_NET any (msg:"ads.mmania.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.132.171.130 any $HOME_NET any (msg:"hollandbusinessadvertising.nl"; classtype:trojan-activity; priority:1;)
alert tcp 213.132.171.32 any $HOME_NET any (msg:"hollandbusinessadvertising.nl"; classtype:trojan-activity; priority:1;)
alert tcp 213.132.197.114 any $HOME_NET any (msg:"promo1.webcams.nl"; classtype:trojan-activity; priority:1;)
alert tcp 213.132.198.26 any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;)
alert tcp 213.132.198.34 any $HOME_NET any (msg:"popupmoney.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.136.0.188 any $HOME_NET any (msg:"bannermarkt.nl"; classtype:trojan-activity; priority:1;)
alert tcp 213.136.34.36 any $HOME_NET any (msg:"adext.inkclub.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.136.34.39 any $HOME_NET any (msg:"adext.inkclub.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.136.35.39 any $HOME_NET any (msg:"tailsweep.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.137.75.20 any $HOME_NET any (msg:"emarketer.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.142.91.158 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.143.91.141 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.143.91.158 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.147.97.248 any $HOME_NET any (msg:"webcounter.goweb.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.150.61.61 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.152.246.10 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.152.246.49 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.152.246.50 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.152.246.52 any $HOME_NET any (msg:"connextra.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.102 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.103 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.104 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.105 any $HOME_NET any (msg:"media.ftv-publicite.fr"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.110 any $HOME_NET any (msg:"creatives.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.111 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.112 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.113 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.118 any $HOME_NET any (msg:"an.tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.120 any $HOME_NET any (msg:"media.ftv-publicite.fr"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.86 any $HOME_NET any (msg:"eur.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.88 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.89 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.95 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.151.96 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.104 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.112 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.113 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.115 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.25 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.49 any $HOME_NET any (msg:"affiliate.offgamers.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.50 any $HOME_NET any (msg:"affiliate.offgamers.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.75 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.91 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.97 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.98 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.154.99 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.156.170 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.156.188 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.155.156.189 any $HOME_NET any (msg:"de17a.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.156.62.144 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;)
alert tcp 213.156.62.167 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;)
alert tcp 213.160.98.232 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.162.50.10 any $HOME_NET any (msg:"comclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.162.50.236 any $HOME_NET any (msg:"veille-referencement.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.163.8.234 any $HOME_NET any (msg:"ctnetwork.hu"; classtype:trojan-activity; priority:1;)
alert tcp 213.163.89.242 any $HOME_NET any (msg:"adskape.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.165.94.88 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;)
alert tcp 213.168.229.44 any $HOME_NET any (msg:"ota.cartrawler.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.174.142.148 any $HOME_NET any (msg:"clicktrace.info"; classtype:trojan-activity; priority:1;)
alert tcp 213.174.148.228 any $HOME_NET any (msg:"ads.kinxxx.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.130.201 any $HOME_NET any (msg:"republika.onet.pl"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.132.66 any $HOME_NET any (msg:"republika.onet.pl"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.141.5 any $HOME_NET any (msg:"republika.onet.pl"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.193.90 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.194.113 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.204.190 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.204.7 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.204.8 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.204.90 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.204.92 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.180.214.31 any $HOME_NET any (msg:"bs.yandex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.116.227 any $HOME_NET any (msg:"reklamer.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.34.38 any $HOME_NET any (msg:"advertstream.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.40.138 any $HOME_NET any (msg:"geovisite.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.44.128 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.44.146 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.44.174 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.44.206 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.44.207 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.50.130 any $HOME_NET any (msg:"directivepub.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.50.133 any $HOME_NET any (msg:"directivepub.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.50.144 any $HOME_NET any (msg:"directivepub.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.52.194 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.52.195 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.52.196 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.52.197 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.52.199 any $HOME_NET any (msg:"promobenef.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.53.195 any $HOME_NET any (msg:"advertstream.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.53.231 any $HOME_NET any (msg:"advertstream.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.186.57.159 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.187.76.38 any $HOME_NET any (msg:"adserver.dotcommedia.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.189.203.88 any $HOME_NET any (msg:"reklamr.hitlist.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.191.147.162 any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.191.74.144 any $HOME_NET any (msg:"ads.isoftmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.193.0.48 any $HOME_NET any (msg:"ads.multimania.lycos.fr"; classtype:trojan-activity; priority:1;)
alert tcp 213.193.4.14 any $HOME_NET any (msg:"ads.tripod.lycos.nl"; classtype:trojan-activity; priority:1;)
alert tcp 213.193.8.112 any $HOME_NET any (msg:"ads2.jubii.dk"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.141.139 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.141.140 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.141.141 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.148.196 any $HOME_NET any (msg:"ads.eu.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.154.22 any $HOME_NET any (msg:"ads.eu.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.181.50 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.181.60 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.186.202 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.186.203 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.199.202.88 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 213.200.112.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.202.100.12 any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.202.100.8 any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.202.193.130 any $HOME_NET any (msg:"adserver.ngz-network.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.202.225.23 any $HOME_NET any (msg:"media.funpic.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.202.233.11 any $HOME_NET any (msg:"adserver.ngz-network.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.202.240.124 any $HOME_NET any (msg:"ads2004.treiberupdate.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.202.244.192 any $HOME_NET any (msg:"ads2004.treiberupdate.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.203.193.99 any $HOME_NET any (msg:"hollandbusinessadvertising.nl"; classtype:trojan-activity; priority:1;)
alert tcp 213.203.200.2 any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.203.200.3 any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.203.202.181 any $HOME_NET any (msg:"adxvalue.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.203.222.26 any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.205.137.165 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.205.137.166 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.205.36.33 any $HOME_NET any (msg:"ad.tiscali.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.206.254.75 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.207.92.236 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.209.100.206 any $HOME_NET any (msg:"mediavantage.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.215.116.33 any $HOME_NET any (msg:"mas.sector.sk"; classtype:trojan-activity; priority:1;)
alert tcp 213.215.116.44 any $HOME_NET any (msg:"partner.pelikan.cz"; classtype:trojan-activity; priority:1;)
alert tcp 213.218.116.147 any $HOME_NET any (msg:"ad.prv.pl"; classtype:trojan-activity; priority:1;)
alert tcp 213.218.165.17 any $HOME_NET any (msg:"adaction.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.218.166.14 any $HOME_NET any (msg:"adaction.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.219.14.80 any $HOME_NET any (msg:"ads.foxkidseurope.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.219.245.120 any $HOME_NET any (msg:"ru-traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.219.245.208 any $HOME_NET any (msg:"ru-traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.219.36.108 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.219.43.121 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.221.39.8 any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.221.39.9 any $HOME_NET any (msg:"adnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.222.12.130 any $HOME_NET any (msg:"banners.resultonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.233.121.17 any $HOME_NET any (msg:"clickmedia.ro"; classtype:trojan-activity; priority:1;)
alert tcp 213.239.195.12 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.239.203.8 any $HOME_NET any (msg:"adboost.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.239.204.218 any $HOME_NET any (msg:"ads.beenetworks.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.239.225.74 any $HOME_NET any (msg:"witch-counter.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.239.234.66 any $HOME_NET any (msg:"boersego-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.239.234.69 any $HOME_NET any (msg:"boersego-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.239.234.94 any $HOME_NET any (msg:"boersego-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.242.96.4 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.242.96.7 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.243.1.5 any $HOME_NET any (msg:"ad.e-kolay.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.243.126.65 any $HOME_NET any (msg:"count.rbc.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.174.25 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.183.201 any $HOME_NET any (msg:"extreme-dm.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.12 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.16 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.17 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.19 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.21 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.24 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.26 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.28 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.29 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.30 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.31 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.32 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.37 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.38 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.39 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.40 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.46 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.49 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.5 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.51 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.53 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.55 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.56 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.57 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.58 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.59 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.6 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.60 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.66 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.69 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.71 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.185.8 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.188.8 any $HOME_NET any (msg:"cash4members.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.244.191.98 any $HOME_NET any (msg:"banners.babylon-x.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.246.55.165 any $HOME_NET any (msg:"popub.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.247.251.91 any $HOME_NET any (msg:"webangel.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.248.112.114 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp 213.248.112.115 any $HOME_NET any (msg:"adimgs.sapo.pt"; classtype:trojan-activity; priority:1;)
alert tcp 213.248.36.100 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp 213.251.136.24 any $HOME_NET any (msg:"x-traceur.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.251.136.41 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.251.138.68 any $HOME_NET any (msg:"engine.espace.netavenir.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.251.152.8 any $HOME_NET any (msg:"ads.eatinparis.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.251.178.69 any $HOME_NET any (msg:"netaffiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.252.12.126 any $HOME_NET any (msg:"tfag.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.10 any $HOME_NET any (msg:"an.tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.11 any $HOME_NET any (msg:"i.xx.openx.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.33 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.34 any $HOME_NET any (msg:"creatives.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.35 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.40 any $HOME_NET any (msg:"an.tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.41 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.42 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.43 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.48 any $HOME_NET any (msg:"creatives.as4x.tmcs.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.71 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.72 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.73 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.8 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.253.9.9 any $HOME_NET any (msg:"fastclick.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.254.229.3 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.254.248.3 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.27.145.100 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 213.27.145.101 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 213.27.145.102 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 213.29.194.4 any $HOME_NET any (msg:"bm.annonce.cz"; classtype:trojan-activity; priority:1;)
alert tcp 213.29.7.142 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;)
alert tcp 213.29.7.251 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;)
alert tcp 213.36.127.85 any $HOME_NET any (msg:"pub.chez.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.4.105.36 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 213.4.105.37 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 213.4.105.38 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 213.4.130.80 any $HOME_NET any (msg:"ads.ole.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.4.144.64 any $HOME_NET any (msg:"adserver.terra.es"; classtype:trojan-activity; priority:1;)
alert tcp 213.41.76.72 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.41.76.73 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.42.1.108 any $HOME_NET any (msg:"ads.emirates.net.ae"; classtype:trojan-activity; priority:1;)
alert tcp 213.52.134.126 any $HOME_NET any (msg:"au2m8.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.52.219.34 any $HOME_NET any (msg:"touchclarity.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.52.227.196 any $HOME_NET any (msg:"rightmedia.net"; classtype:trojan-activity; priority:1;)
alert tcp 213.52.230.212 any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.52.252.205 any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.52.252.74 any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.61.105.210 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.61.105.212 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.61.105.215 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.61.220.33 any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.61.220.84 any $HOME_NET any (msg:"flashtalking.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.65.216.241 any $HOME_NET any (msg:"ads.gamershell.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.73.255.137 any $HOME_NET any (msg:"ads.gamershell.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.76.165.135 any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;)
alert tcp 213.76.165.15 any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;)
alert tcp 213.76.165.9 any $HOME_NET any (msg:"banners.iq.pl"; classtype:trojan-activity; priority:1;)
alert tcp 213.80.84.139 any $HOME_NET any (msg:"reklam.rfsl.se"; classtype:trojan-activity; priority:1;)
alert tcp 213.86.173.180 any $HOME_NET any (msg:"adverts.carltononline.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.86.246.22 any $HOME_NET any (msg:"advertwizard.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.86.246.27 any $HOME_NET any (msg:"as1.advfn.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.86.55.146 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.86.55.161 any $HOME_NET any (msg:"cdn2.adsdk.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.86.59.1 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.91.8.215 any $HOME_NET any (msg:"comclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.92.100.171 any $HOME_NET any (msg:"adserver.break-even.it"; classtype:trojan-activity; priority:1;)
alert tcp 213.92.80.5 any $HOME_NET any (msg:"pro-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 213.95.1.41 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp 213.95.1.55 any $HOME_NET any (msg:"layer-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp 216.105.161.54 any $HOME_NET any (msg:"mediamgr.ugo.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.105.166.67 any $HOME_NET any (msg:"mediamgr.ugo.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.105.86.3 any $HOME_NET any (msg:"banners.sexsearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.105.86.4 any $HOME_NET any (msg:"textad.sexsearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.105.94.65 any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.105.94.81 any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.109.125.112 any $HOME_NET any (msg:"adserver.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.109.213.232 any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;)
alert tcp 216.115.239.51 any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.116.224.133 any $HOME_NET any (msg:"ads.savannahnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.116.224.47 any $HOME_NET any (msg:"ads.savannahnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.116.226.12 any $HOME_NET any (msg:"ads.savannahnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.116.232.33 any $HOME_NET any (msg:"ads.savannahnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.117.189.232 any $HOME_NET any (msg:"british-banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.12.133.68 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.12.136.92 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.12.136.93 any $HOME_NET any (msg:"bidclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.12.202.115 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.12.213.206 any $HOME_NET any (msg:"joetec.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.12.39.100 any $HOME_NET any (msg:"oas.roanoke.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.120.103.124 any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.120.27.21 any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.120.60.183 any $HOME_NET any (msg:"ads.specificclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.121.97.66 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.122.72.93 any $HOME_NET any (msg:"checkm8.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.126.73.9 any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.32.74 any $HOME_NET any (msg:"porntrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.38.105 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.40.150 any $HOME_NET any (msg:"gamehouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.43.36 any $HOME_NET any (msg:"adzones.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.43.37 any $HOME_NET any (msg:"adzones.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.47.200 any $HOME_NET any (msg:"servedbyadbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.47.205 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.50.34 any $HOME_NET any (msg:"adserver.spankaway.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.52.241 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.52.242 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.52.249 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.52.250 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.62.29 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.62.30 any $HOME_NET any (msg:"ifa.tube8live.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.80.137 any $HOME_NET any (msg:"admedia.ro"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.86.119 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.94.117 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;)
alert tcp 216.127.94.127 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;)
alert tcp 216.128.22.158 any $HOME_NET any (msg:"havamedia.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.129.106.70 any $HOME_NET any (msg:"ads.jiwire.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.130.163.21 any $HOME_NET any (msg:"xponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.130.163.22 any $HOME_NET any (msg:"xponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.130.177.124 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.130.197.236 any $HOME_NET any (msg:"banners.babylon-x.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.130.218.43 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.136.232.177 any $HOME_NET any (msg:"adserver.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.136.30.31 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.45.11 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.45.155 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.45.171 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.45.179 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.45.235 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.45.247 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.45.3 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.45.95 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.1 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.10 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.100 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.101 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.103 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.104 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.105 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.106 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.107 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.108 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.109 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.11 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.110 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.111 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.113 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.114 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.115 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.116 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.117 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.119 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.12 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.120 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.121 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.123 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.124 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.125 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.126 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.128 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.129 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.13 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.130 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.131 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.132 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.133 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.135 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.136 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.137 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.138 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.139 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.14 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.140 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.141 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.142 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.145 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.146 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.147 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.148 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.149 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.15 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.150 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.151 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.152 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.154 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.155 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.156 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.157 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.158 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.159 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.16 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.160 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.161 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.162 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.163 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.165 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.166 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.167 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.169 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.17 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.170 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.171 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.172 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.173 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.176 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.177 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.178 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.18 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.181 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.182 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.185 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.186 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.187 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.188 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.19 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.190 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.191 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.192 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.193 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.194 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.197 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.198 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.199 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.2 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.201 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.202 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.204 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.205 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.206 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.207 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.208 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.209 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.21 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.210 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.211 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.212 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.213 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.214 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.215 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.216 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.217 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.218 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.219 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.22 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.220 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.221 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.222 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.223 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.224 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.225 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.226 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.227 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.228 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.229 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.23 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.230 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.232 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.233 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.234 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.235 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.236 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.237 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.238 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.239 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.24 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.240 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.241 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.243 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.244 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.245 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.246 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.249 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.25 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.250 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.251 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.252 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.253 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.254 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.26 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.27 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.29 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.30 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.31 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.32 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.33 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.34 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.35 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.36 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.37 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.39 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.4 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.40 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.41 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.42 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.43 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.45 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.46 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.48 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.49 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.5 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.51 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.52 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.53 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.55 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.56 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.57 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.59 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.6 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.60 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.61 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.62 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.63 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.65 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.66 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.68 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.69 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.70 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.73 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.75 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.77 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.78 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.8 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.81 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.82 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.85 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.86 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.89 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.9 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.90 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.91 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.93 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.95 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.97 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.57.98 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.119 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.127 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.129 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.154 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.167 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.170 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.186 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.194 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.200 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.21 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.22 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.227 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.230 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.246 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.248 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.249 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.254 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.4 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.50 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.53 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.57 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.62 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.63 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.64 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.69 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.71 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.78 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.81 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.87 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.88 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.89 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.90 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.93 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.59.94 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.1 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.10 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.100 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.101 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.102 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.103 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.104 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.105 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.106 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.107 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.108 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.109 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.11 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.110 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.111 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.112 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.114 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.115 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.116 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.117 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.118 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.119 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.12 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.120 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.121 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.122 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.123 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.124 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.125 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.126 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.127 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.128 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.129 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.13 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.130 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.131 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.132 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.133 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.135 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.136 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.137 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.138 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.139 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.14 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.140 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.141 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.142 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.144 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.146 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.147 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.148 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.149 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.15 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.150 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.151 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.152 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.153 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.154 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.155 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.156 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.157 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.158 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.159 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.16 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.160 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.161 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.162 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.163 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.164 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.165 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.166 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.167 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.168 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.169 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.17 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.170 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.171 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.172 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.173 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.174 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.175 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.176 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.177 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.178 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.18 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.181 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.182 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.183 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.184 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.185 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.186 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.187 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.19 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.190 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.192 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.193 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.194 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.195 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.196 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.197 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.198 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.199 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.2 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.20 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.200 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.201 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.202 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.204 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.205 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.206 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.207 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.208 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.21 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.210 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.211 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.212 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.213 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.215 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.216 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.217 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.218 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.219 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.22 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.220 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.221 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.222 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.223 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.224 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.225 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.226 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.227 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.228 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.229 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.23 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.230 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.231 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.232 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.233 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.234 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.235 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.236 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.237 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.238 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.239 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.24 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.240 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.241 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.242 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.243 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.244 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.245 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.246 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.247 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.248 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.25 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.250 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.251 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.252 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.253 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.254 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.26 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.27 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.28 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.29 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.3 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.30 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.31 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.32 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.33 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.34 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.35 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.36 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.37 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.38 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.39 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.4 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.40 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.41 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.42 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.43 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.44 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.45 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.46 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.48 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.49 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.5 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.50 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.51 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.52 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.53 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.54 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.55 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.56 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.57 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.58 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.6 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.60 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.61 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.62 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.64 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.65 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.66 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.67 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.68 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.69 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.70 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.71 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.72 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.73 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.74 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.75 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.76 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.77 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.78 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.8 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.80 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.81 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.82 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.83 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.84 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.85 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.86 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.87 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.89 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.90 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.91 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.92 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.93 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.94 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.95 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.96 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.97 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.98 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.137.63.99 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 216.138.240.196 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.138.240.197 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.139.206.21 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.139.218.83 any $HOME_NET any (msg:"liverail.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.139.226.142 any $HOME_NET any (msg:"pepperjamnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.139.226.67 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.139.235.162 any $HOME_NET any (msg:"banners.audioholics.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.140.182.70 any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;)
alert tcp 216.140.182.72 any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;)
alert tcp 216.142.92.178 any $HOME_NET any (msg:"ads2.clearchannel.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.144.229.172 any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;)
alert tcp 216.144.239.46 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.146.38.125 any $HOME_NET any (msg:"mopub.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.146.39.125 any $HOME_NET any (msg:"mopub.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.146.46.10 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.146.46.11 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.148.231.82 any $HOME_NET any (msg:"affiliates.allposters.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.144.105 any $HOME_NET any (msg:"ads.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.144.108 any $HOME_NET any (msg:"ads4.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.144.64 any $HOME_NET any (msg:"ads3.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.211.80 any $HOME_NET any (msg:"ad1.gamezone.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.212.197 any $HOME_NET any (msg:"free-banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.250.120 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.250.140 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.250.147 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.250.148 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.250.149 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.250.160 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.250.180 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.251.110 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.251.130 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.251.135 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.251.136 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.251.137 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.251.150 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.15.251.170 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.150.13.94 any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.150.135.40 any $HOME_NET any (msg:"ads.wineenthusiast.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.150.15.88 any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.150.21.62 any $HOME_NET any (msg:"vericlick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.150.213.151 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.150.214.58 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.151.210.122 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.152.130.58 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.152.135.89 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.128.51 any $HOME_NET any (msg:"ads.kinxxx.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.128.58 any $HOME_NET any (msg:"ads03.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.128.59 any $HOME_NET any (msg:"ads.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.128.61 any $HOME_NET any (msg:"ads03.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.128.62 any $HOME_NET any (msg:"ads.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.130.244 any $HOME_NET any (msg:"ad.slutload.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.130.246 any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.133.68 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.137.146 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.137.147 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.139.14 any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.141.164 any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.141.165 any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.141.69 any $HOME_NET any (msg:"ads.4tube.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.143.86 any $HOME_NET any (msg:"ad.abum.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.147.70 any $HOME_NET any (msg:"ads.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.152.12 any $HOME_NET any (msg:"ads.ztod.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.152.13 any $HOME_NET any (msg:"ads.ztod.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.155.152.14 any $HOME_NET any (msg:"ads.ztod.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.156.244.187 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.157.128.128 any $HOME_NET any (msg:"precisioncounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.157.25.98 any $HOME_NET any (msg:"advertserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.157.75.145 any $HOME_NET any (msg:"adbuyer.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.157.8.158 any $HOME_NET any (msg:"adbuyer.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.162.102.101 any $HOME_NET any (msg:"ads2.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.162.102.150 any $HOME_NET any (msg:"ads7.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.167.104.116 any $HOME_NET any (msg:"bannerpower.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.167.32.64 any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.168.224.53 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.168.224.64 any $HOME_NET any (msg:"bannermall.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.168.229.54 any $HOME_NET any (msg:"phoenix-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.168.229.63 any $HOME_NET any (msg:"superstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.168.60.39 any $HOME_NET any (msg:"ads.neoseeker.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.17.193.108 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.172.104.3 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.172.182.9 any $HOME_NET any (msg:"slickaffiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.174.98.1 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.177.145.14 any $HOME_NET any (msg:"zeusclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.178.176.15 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.178.176.16 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.178.38.123 any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.178.41.162 any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.178.41.26 any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.178.47.61 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.179.149.163 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.18.178.216 any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.18.183.102 any $HOME_NET any (msg:"toplist.pornhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.18.202.198 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.18.227.124 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.180.106.60 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.180.236.62 any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.1 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.10 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.11 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.12 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.13 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.14 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.15 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.16 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.17 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.18 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.19 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.2 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.20 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.21 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.3 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.4 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.5 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.6 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.7 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.8 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.214.9 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.201 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.202 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.203 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.204 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.205 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.206 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.207 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.208 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.209 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.210 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.218.211 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.1 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.10 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.2 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.3 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.4 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.5 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.6 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.7 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.8 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.222.9 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.185.223.104 any $HOME_NET any (msg:"adq.nextag.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.187.103.168 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.187.103.169 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.187.103.170 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.187.79.35 any $HOME_NET any (msg:"hentaicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.187.97.26 any $HOME_NET any (msg:"banner.noblepoker.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.188.26.161 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.188.26.162 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.189.0.240 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.189.1.20 any $HOME_NET any (msg:"class-act-clicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.189.1.220 any $HOME_NET any (msg:"shareadspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.193.201.138 any $HOME_NET any (msg:"affiliates.globat.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.193.201.162 any $HOME_NET any (msg:"affiliates.globat.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.193.215.146 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.194.70.2 any $HOME_NET any (msg:"cjbmanagement.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.194.70.4 any $HOME_NET any (msg:"bannerexchange.cjb.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.194.70.6 any $HOME_NET any (msg:"bannerexchange.cjb.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.194.70.9 any $HOME_NET any (msg:"bannerexchange.cjb.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.195.33.114 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.195.33.42 any $HOME_NET any (msg:"webangel.ru"; classtype:trojan-activity; priority:1;)
alert tcp 216.195.78.39 any $HOME_NET any (msg:"ads.co.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.197.111.13 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.197.111.198 any $HOME_NET any (msg:"eyewonder.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.198.221.166 any $HOME_NET any (msg:"worldwide-cash.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.198.226.35 any $HOME_NET any (msg:"colonize.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.200.123.15 any $HOME_NET any (msg:"revsci.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.200.145.8 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.200.199.35 any $HOME_NET any (msg:"ads20.bpath.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.200.199.38 any $HOME_NET any (msg:"ads18.bpath.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.200.199.56 any $HOME_NET any (msg:"hyperbanner.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.200.199.57 any $HOME_NET any (msg:"hyperbanner.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.201.83.161 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.205.149.100 any $HOME_NET any (msg:"bluelithium.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.205.150.13 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.21.215.52 any $HOME_NET any (msg:"cubics.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.21.222.7 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.217.57.23 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.218.159.170 any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.218.185.146 any $HOME_NET any (msg:"hitcents.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.218.185.148 any $HOME_NET any (msg:"ads.hitcents.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.218.211.56 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.218.211.57 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.218.223.227 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.218.255.25 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.22.4.2 any $HOME_NET any (msg:"ad.nozonedata.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.22.4.5 any $HOME_NET any (msg:"ad.nozonedata.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.22.45.38 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.22.45.39 any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.22.45.40 any $HOME_NET any (msg:"backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.22.45.47 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.22.45.48 any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.220.40.243 any $HOME_NET any (msg:"banners.easydns.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.220.40.247 any $HOME_NET any (msg:"banners.easydns.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.220.45.146 any $HOME_NET any (msg:"incentaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.220.45.147 any $HOME_NET any (msg:"incentaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.220.45.148 any $HOME_NET any (msg:"incentaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.220.45.159 any $HOME_NET any (msg:"incentaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.220.45.160 any $HOME_NET any (msg:"incentaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.220.63.250 any $HOME_NET any (msg:"optmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.221.138.77 any $HOME_NET any (msg:"supertop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.223.0.230 any $HOME_NET any (msg:"revsci.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.224.113.10 any $HOME_NET any (msg:"clicksor.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.224.121.130 any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.224.121.146 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.227.220.4 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.23.173.250 any $HOME_NET any (msg:"affiliatefuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.23.185.99 any $HOME_NET any (msg:"clickxchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.237.118.170 any $HOME_NET any (msg:"www.banner-link.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 216.237.118.26 any $HOME_NET any (msg:"www.banner-link.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 216.237.154.98 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.113.101 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.113.131 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.113.224 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.113.41 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.113.43 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.115.143 any $HOME_NET any (msg:"dw.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.115.148 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.116.160 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.116.49 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.116.50 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.116.64 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.116.65 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.120.226 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.120.248 any $HOME_NET any (msg:"ads.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.120.39 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.122.102 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.122.190 any $HOME_NET any (msg:"ads.zdnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.122.193 any $HOME_NET any (msg:"ads.zdnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.122.197 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.122.33 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.122.36 any $HOME_NET any (msg:"mads.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.122.38 any $HOME_NET any (msg:"adimg.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.122.54 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.32.21 any $HOME_NET any (msg:"adgardener.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.35.119 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.37.100 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.37.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.37.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.37.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.39.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.39.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.51.119 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.51.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.57.100 any $HOME_NET any (msg:"pagead.googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.57.103 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.57.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.57.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.57.99 any $HOME_NET any (msg:"google-analytics.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.239.59.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.24.32.37 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.24.32.39 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.24.32.40 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.24.32.41 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.24.32.43 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.132.150 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.158.3 any $HOME_NET any (msg:"banner.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.102 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.103 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.143 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.144 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.148 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.151 any $HOME_NET any (msg:"popups.infostart.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.153 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.158 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.167 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.175 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.208 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.240.187.211 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.243.12.11 any $HOME_NET any (msg:"servedbyadbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.243.12.14 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.243.12.16 any $HOME_NET any (msg:"counter.sparklit.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.244.123.6 any $HOME_NET any (msg:"insightexpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.244.123.9 any $HOME_NET any (msg:"insightexpressai.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.246.14.17 any $HOME_NET any (msg:"wetrack.it"; classtype:trojan-activity; priority:1;)
alert tcp 216.246.14.19 any $HOME_NET any (msg:"trackingsoft.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.246.14.25 any $HOME_NET any (msg:"roia.biz"; classtype:trojan-activity; priority:1;)
alert tcp 216.246.45.17 any $HOME_NET any (msg:"clickfinders.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.246.7.174 any $HOME_NET any (msg:"marketing.osijek031.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.247.121.177 any $HOME_NET any (msg:"z5x.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.141.189 any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.141.190 any $HOME_NET any (msg:"ah-ha.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.177.230 any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.177.233 any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.177.235 any $HOME_NET any (msg:"shoppingads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.48.198 any $HOME_NET any (msg:"citi.bridgetrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.52.65 any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.59.111 any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.250.61.65 any $HOME_NET any (msg:"bridgetrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.251.114.50 any $HOME_NET any (msg:"ads.expedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.251.120.226 any $HOME_NET any (msg:"ads.expedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.251.121.216 any $HOME_NET any (msg:"ads.expedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.251.126.246 any $HOME_NET any (msg:"affiliate.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.27.89.28 any $HOME_NET any (msg:"searchmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.27.9.98 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.27.93.100 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.27.93.64 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.27.93.7 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.27.93.8 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.27.94.40 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.27.94.76 any $HOME_NET any (msg:"images.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.131.135 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.131.156 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.131.162 any $HOME_NET any (msg:"dbbsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.131.173 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.131.174 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.207.131 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.207.134 any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.207.135 any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.207.176 any $HOME_NET any (msg:"adfarm.mediaplex.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.207.60 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.207.61 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.207.74 any $HOME_NET any (msg:"adfarm.mediaplex.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.209.10 any $HOME_NET any (msg:"commission-junction.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.209.13 any $HOME_NET any (msg:"tkqlhce.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.209.14 any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.32.118 any $HOME_NET any (msg:"banners.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.32.124 any $HOME_NET any (msg:"banners.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.38.106 any $HOME_NET any (msg:"ads.slim.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.38.116 any $HOME_NET any (msg:"adserver.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.38.65 any $HOME_NET any (msg:"banners.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.38.81 any $HOME_NET any (msg:"adserver.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.38.92 any $HOME_NET any (msg:"banners.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.38.96 any $HOME_NET any (msg:"ads.gradfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.38.97 any $HOME_NET any (msg:"pop6.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.7.188 any $HOME_NET any (msg:"stats.blogger.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.77.66 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.77.90 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.88.111 any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.88.201 any $HOME_NET any (msg:"click.avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.34.88.202 any $HOME_NET any (msg:"click.avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.123.68 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.123.81 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.15.236 any $HOME_NET any (msg:"adserver.sharewareonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.197.148 any $HOME_NET any (msg:"offerforge.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.197.40 any $HOME_NET any (msg:"offerforge.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.207.209 any $HOME_NET any (msg:"offerforge.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.71.105 any $HOME_NET any (msg:"ad.linksynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.71.113 any $HOME_NET any (msg:"click.linksynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.71.120 any $HOME_NET any (msg:"ad.linksynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.71.96 any $HOME_NET any (msg:"linksynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.35.79.46 any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.36.248.128 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.37.13.152 any $HOME_NET any (msg:"radiate.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.38.135.198 any $HOME_NET any (msg:"adprofile.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.38.192.53 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.38.222.30 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.38.58.11 any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.38.58.23 any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.57.106 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.57.107 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.58.114 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.58.184 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.58.249 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.58.250 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.58.251 any $HOME_NET any (msg:"xtendmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.58.95 any $HOME_NET any (msg:"bigclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.69.146 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.39.86.59 any $HOME_NET any (msg:"affiliate.gamestop.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.196.15 any $HOME_NET any (msg:"monsterpops.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.201.212 any $HOME_NET any (msg:"specificpop.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.226.220 any $HOME_NET any (msg:"compactbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.233.212 any $HOME_NET any (msg:"e-bannerx.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.247.45 any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.32.140 any $HOME_NET any (msg:"vs.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.32.31 any $HOME_NET any (msg:"counts.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.32.34 any $HOME_NET any (msg:"counts.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.32.38 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.32.39 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.32.40 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.32.50 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.32.60 any $HOME_NET any (msg:"adclient1.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.33.117 any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.33.251 any $HOME_NET any (msg:"eadexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.40.33.252 any $HOME_NET any (msg:"lop.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.41.16.183 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.46.167.93 any $HOME_NET any (msg:"british-banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.49.88.130 any $HOME_NET any (msg:"ads.mcafee.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.49.88.68 any $HOME_NET any (msg:"ads.mcafee.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.117.102 any $HOME_NET any (msg:"lightningcast.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.121.177 any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.167.130 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.17.110 any $HOME_NET any (msg:"superstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.17.111 any $HOME_NET any (msg:"media.superstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.17.120 any $HOME_NET any (msg:"media-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.17.122 any $HOME_NET any (msg:"phoenix-adrunner.mycomputer.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.17.96 any $HOME_NET any (msg:"instadia.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.175.142 any $HOME_NET any (msg:"adgardener.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.175.144 any $HOME_NET any (msg:"adgardener.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.184.240 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.184.243 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.221.248 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.223.238 any $HOME_NET any (msg:"ad.reunion.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.244.254 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.245.20 any $HOME_NET any (msg:"ads.aceweb.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.245.7 any $HOME_NET any (msg:"ads.aceweb.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.252.1 any $HOME_NET any (msg:"adserver.matchcraft.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.56.37 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.52.56.52 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.53.188.52 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.54.194.5 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.54.223.113 any $HOME_NET any (msg:"primaryads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.54.223.53 any $HOME_NET any (msg:"primaryads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.101.194 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.101.197 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.133.28 any $HOME_NET any (msg:"grafstat.ro"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.143.51 any $HOME_NET any (msg:"newtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.161.37 any $HOME_NET any (msg:"adtology.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.162.16 any $HOME_NET any (msg:"grafstat.ro"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.169.33 any $HOME_NET any (msg:"grafstat.ro"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.97.243 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.97.68 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.55.98.244 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.58.166.148 any $HOME_NET any (msg:"ad-tech.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.59.17.56 any $HOME_NET any (msg:"midnightclicking.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.59.38.122 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.65.1.200 any $HOME_NET any (msg:"counter.fateback.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.65.1.254 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.65.3.213 any $HOME_NET any (msg:"cashfiesta.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.65.86.38 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.13.90 any $HOME_NET any (msg:"adbard.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.13.93 any $HOME_NET any (msg:"adbard.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.18.210 any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.18.44 any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.18.47 any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.18.48 any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.21.120 any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.21.35 any $HOME_NET any (msg:"avsads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.21.85 any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.66.21.89 any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.67.228.67 any $HOME_NET any (msg:"ads.flooble.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.67.232.70 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.67.245.30 any $HOME_NET any (msg:"realtechnetwork.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.69.174.61 any $HOME_NET any (msg:"matchcraft.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.69.190.149 any $HOME_NET any (msg:"checkm8.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.7.89.11 any $HOME_NET any (msg:"evidencecleanergold.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.7.89.12 any $HOME_NET any (msg:"adwareremovergold.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.7.89.13 any $HOME_NET any (msg:"datashreddergold.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.7.89.16 any $HOME_NET any (msg:"extractorandburner.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.7.89.220 any $HOME_NET any (msg:"topbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.70.104.229 any $HOME_NET any (msg:"liveintent.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.70.114.126 any $HOME_NET any (msg:"trafficleader.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.71.161.96 any $HOME_NET any (msg:"primaryads.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.108.13 any $HOME_NET any (msg:"acsseo.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.115.130 any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.80.149 any $HOME_NET any (msg:"ads.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.80.160 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.85.29 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.86.13 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.86.188 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.86.58 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.87.13 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.87.188 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.87.58 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.92.112 any $HOME_NET any (msg:"doubleclick.de"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.92.126 any $HOME_NET any (msg:"tangozebra.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.93.169 any $HOME_NET any (msg:"ads.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.93.170 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.73.93.8 any $HOME_NET any (msg:"doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.74.133.195 any $HOME_NET any (msg:"tribalfusion.speedera.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.74.21.227 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.74.21.229 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.74.21.235 any $HOME_NET any (msg:"ads.digitalmedianet.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.74.32.80 any $HOME_NET any (msg:"rlcdn.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.74.41.5 any $HOME_NET any (msg:"flurry.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.74.57.38 any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.8.179.26 any $HOME_NET any (msg:"ndparking.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.83.147.78 any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.86.144.101 any $HOME_NET any (msg:"ad.nozonedata.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.86.146.46 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.86.150.237 any $HOME_NET any (msg:"ads.satyamonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.87.174.29 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.87.184.108 any $HOME_NET any (msg:"adultadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.9.35.50 any $HOME_NET any (msg:"ads.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.9.35.57 any $HOME_NET any (msg:"ads.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.9.35.58 any $HOME_NET any (msg:"geo.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.9.35.59 any $HOME_NET any (msg:"geo.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.9.35.60 any $HOME_NET any (msg:"ads.digitalpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.90.130.47 any $HOME_NET any (msg:"conversionruler.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.131.172 any $HOME_NET any (msg:"ads.simtel.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.187.245 any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.21.16 any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.210.177 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.211.171 any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.223.3 any $HOME_NET any (msg:"globalismedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.3.101 any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.3.102 any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.3.110 any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.92.53.131 any $HOME_NET any (msg:"bannerhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.93.168.144 any $HOME_NET any (msg:"aim4media.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.93.177.101 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.93.179.77 any $HOME_NET any (msg:"trackalyzer.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.93.251.199 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.93.251.207 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.93.251.211 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.94.0.33 any $HOME_NET any (msg:"casinopays.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.98.129.37 any $HOME_NET any (msg:"ads.linuxjournal.com"; classtype:trojan-activity; priority:1;)
alert tcp 216.98.141.250 any $HOME_NET any (msg:"chartbeat.net"; classtype:trojan-activity; priority:1;)
alert tcp 216.98.225.3 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.10.42.13 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.107.216.13 any $HOME_NET any (msg:"pbnet.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.100.83 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.235.108 any $HOME_NET any (msg:"ad1.kde.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.235.110 any $HOME_NET any (msg:"e.kde.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.235.117 any $HOME_NET any (msg:"ad1.kde.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.237.201 any $HOME_NET any (msg:"ads.kinobox.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.237.37 any $HOME_NET any (msg:"adv.yo.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.237.42 any $HOME_NET any (msg:"adv.yo.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.242.178 any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.242.179 any $HOME_NET any (msg:"stats.hyperinzerce.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.242.91 any $HOME_NET any (msg:"imonitor.nethost.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.251.225 any $HOME_NET any (msg:"ads.cybersales.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.251.227 any $HOME_NET any (msg:"ads.cybersales.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.251.237 any $HOME_NET any (msg:"ads.cybersales.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.11.254.86 any $HOME_NET any (msg:"ceskydomov.alias.ngs.modry.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.110.110.229 any $HOME_NET any (msg:"zanox-affiliate.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.110.110.231 any $HOME_NET any (msg:"ad.zanox.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.110.110.251 any $HOME_NET any (msg:"zanox.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.110.115.76 any $HOME_NET any (msg:"www.cash4banner.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.110.119.145 any $HOME_NET any (msg:"www.megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.110.64.201 any $HOME_NET any (msg:"statistik.motorpresse.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.110.73.163 any $HOME_NET any (msg:"ranking-links.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.100.10 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.100.101 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.100.210 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.100.212 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.100.213 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.100.214 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.100.216 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.100.219 any $HOME_NET any (msg:"megacash.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.111.22.101 any $HOME_NET any (msg:"ads.berlinonline.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.114.87.66 any $HOME_NET any (msg:"tradedoubler.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.115.142.110 any $HOME_NET any (msg:"180hits.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.115.198.5 any $HOME_NET any (msg:"adserver.hardwareanalysis.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.115.205.106 any $HOME_NET any (msg:"stats4all.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.116.46.155 any $HOME_NET any (msg:"ads.deltha.hu"; classtype:trojan-activity; priority:1;)
alert tcp 217.117.154.3 any $HOME_NET any (msg:"perf.weborama.fr"; classtype:trojan-activity; priority:1;)
alert tcp 217.117.154.30 any $HOME_NET any (msg:"weborama.fr"; classtype:trojan-activity; priority:1;)
alert tcp 217.118.128.31 any $HOME_NET any (msg:"utarget.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.118.128.68 any $HOME_NET any (msg:"utarget.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.118.134.148 any $HOME_NET any (msg:"utarget.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.118.135.100 any $HOME_NET any (msg:"utarget.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.13.124.101 any $HOME_NET any (msg:"dialerporn.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.13.124.102 any $HOME_NET any (msg:"dialerporn.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.13.201.134 any $HOME_NET any (msg:"ads.forium.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.144.113.67 any $HOME_NET any (msg:"ads.kompass.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.146.185.193 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.147.120.106 any $HOME_NET any (msg:"marketing.888.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.148.161.16 any $HOME_NET any (msg:"hollandbusinessadvertising.nl"; classtype:trojan-activity; priority:1;)
alert tcp 217.149.242.99 any $HOME_NET any (msg:"adstat.4u.pl"; classtype:trojan-activity; priority:1;)
alert tcp 217.149.36.50 any $HOME_NET any (msg:"ads.addesktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.15.42.28 any $HOME_NET any (msg:"ademails.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.151.107.46 any $HOME_NET any (msg:"af-ad.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.154.105.226 any $HOME_NET any (msg:"zencudo.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.154.117.222 any $HOME_NET any (msg:"ad-tech.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.103.15 any $HOME_NET any (msg:"trafic.ro"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.103.22 any $HOME_NET any (msg:"boom.ro"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.103.51 any $HOME_NET any (msg:"a.boom.ro"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.138 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.139 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.144 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.145 any $HOME_NET any (msg:"i.xx.openx.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.146 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.147 any $HOME_NET any (msg:"eur.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.152 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.161 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.162 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.163 any $HOME_NET any (msg:"realmedia-a800.d4p.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.170 any $HOME_NET any (msg:"a32.g.a.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.176 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.178 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.184 any $HOME_NET any (msg:"Adsatt.go.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.185 any $HOME_NET any (msg:"eur.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.186 any $HOME_NET any (msg:"iad.anm.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.187 any $HOME_NET any (msg:"ads.ak.facebook.com.edgesuite.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.192 any $HOME_NET any (msg:"an.tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.193 any $HOME_NET any (msg:"i.xx.openx.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.194 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.195 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.201 any $HOME_NET any (msg:"an.tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.202 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.203 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.208 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.209 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.210 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.156.169.211 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.157.7.11 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.157.7.12 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.157.7.26 any $HOME_NET any (msg:"hitlounge.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.157.7.4 any $HOME_NET any (msg:"autohits.dk"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.16.110 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.16.130 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.16.143 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.16.153 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.19.225 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.19.235 any $HOME_NET any (msg:"ad.yadro.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.19.237 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.19.245 any $HOME_NET any (msg:"counter.yadro.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.16.20.81 any $HOME_NET any (msg:"top100.mafia.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.126.13 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.129.56 any $HOME_NET any (msg:"adtrading.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.175.94 any $HOME_NET any (msg:"spezialreporte.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.176.55 any $HOME_NET any (msg:"adrotate.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.215.102 any $HOME_NET any (msg:"stats.unwired-i.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.215.86 any $HOME_NET any (msg:"layer-ad.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.226.136 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.31.64 any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.51.160 any $HOME_NET any (msg:"werbung.meteoxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.78.175 any $HOME_NET any (msg:"deloo.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.95.137 any $HOME_NET any (msg:"visitbox.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.160.95.94 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.163.21.36 any $HOME_NET any (msg:"ads.olivebrandresponse.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.163.21.41 any $HOME_NET any (msg:"ads.olivebrandresponse.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.17.139.174 any $HOME_NET any (msg:"webads.nl"; classtype:trojan-activity; priority:1;)
alert tcp 217.17.35.146 any $HOME_NET any (msg:"hit.gemius.pl"; classtype:trojan-activity; priority:1;)
alert tcp 217.17.36.162 any $HOME_NET any (msg:"stat24.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.17.36.200 any $HOME_NET any (msg:"stat24.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.17.36.236 any $HOME_NET any (msg:"stat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 217.17.36.244 any $HOME_NET any (msg:"gemius.pl"; classtype:trojan-activity; priority:1;)
alert tcp 217.170.3.140 any $HOME_NET any (msg:"m4n.nl"; classtype:trojan-activity; priority:1;)
alert tcp 217.170.3.231 any $HOME_NET any (msg:"mbuyu.nl"; classtype:trojan-activity; priority:1;)
alert tcp 217.170.3.96 any $HOME_NET any (msg:"m4n.nl"; classtype:trojan-activity; priority:1;)
alert tcp 217.170.71.36 any $HOME_NET any (msg:"ads.adshareware.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.160.232 any $HOME_NET any (msg:"spezialreporte.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.161.38 any $HOME_NET any (msg:"adserver.dotcommedia.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.180.33 any $HOME_NET any (msg:"abacho.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.181.14 any $HOME_NET any (msg:"www.bannerads.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.185.188 any $HOME_NET any (msg:"targad.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.186.86 any $HOME_NET any (msg:"ads.dazoot.ro"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.44.13 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.44.138 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.44.145 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.44.15 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.44.70 any $HOME_NET any (msg:"go-rank.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.49.66 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.172.49.72 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.173.129.62 any $HOME_NET any (msg:"www.money4exit.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.173.137.4 any $HOME_NET any (msg:"banner.titan-dsl.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.173.149.40 any $HOME_NET any (msg:"www.money4exit.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.173.149.64 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.174.193.155 any $HOME_NET any (msg:"f5biz.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.174.222.215 any $HOME_NET any (msg:"phpmyvisites.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.188.32.35 any $HOME_NET any (msg:"adbutler.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.188.32.37 any $HOME_NET any (msg:"adbutler.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.19.248.132 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.19.248.133 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.194.102.5 any $HOME_NET any (msg:"webcash.nl"; classtype:trojan-activity; priority:1;)
alert tcp 217.197.114.32 any $HOME_NET any (msg:"click.kmindex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.197.114.33 any $HOME_NET any (msg:"counting.kmindex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.197.114.8 any $HOME_NET any (msg:"counting.kmindex.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.197.152.188 any $HOME_NET any (msg:"ad.nwt.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.10 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.101 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.102 any $HOME_NET any (msg:"a.ucoz.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.11 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.12 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.14 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.15 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.16 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.3 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.4 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.5 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.6 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.8 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.199.217.9 any $HOME_NET any (msg:"a.ucoz.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.20.130.17 any $HOME_NET any (msg:"sher.index.hu"; classtype:trojan-activity; priority:1;)
alert tcp 217.20.131.7 any $HOME_NET any (msg:"sher.index.hu"; classtype:trojan-activity; priority:1;)
alert tcp 217.20.163.19 any $HOME_NET any (msg:"banner.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp 217.20.163.221 any $HOME_NET any (msg:"topping.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 217.20.163.67 any $HOME_NET any (msg:"topping.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 217.20.17.70 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.206.223.62 any $HOME_NET any (msg:"alclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.21.132.24 any $HOME_NET any (msg:"travis.bosscasinos.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.21.147.17 any $HOME_NET any (msg:"hollandbusinessadvertising.nl"; classtype:trojan-activity; priority:1;)
alert tcp 217.21.149.155 any $HOME_NET any (msg:"hollandbusinessadvertising.nl"; classtype:trojan-activity; priority:1;)
alert tcp 217.22.65.24 any $HOME_NET any (msg:"onestat.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.237.190.224 any $HOME_NET any (msg:"ads.quoka.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.237.190.46 any $HOME_NET any (msg:"ads.quoka.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.237.190.47 any $HOME_NET any (msg:"ads.quoka.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.29.32.152 any $HOME_NET any (msg:"ecircle-ag.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.29.42.23 any $HOME_NET any (msg:"ecircle-ag.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.30.188.12 any $HOME_NET any (msg:"snoobi.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.31.57.86 any $HOME_NET any (msg:"ad.hyena.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.31.58.76 any $HOME_NET any (msg:"ads.kinobox.cz"; classtype:trojan-activity; priority:1;)
alert tcp 217.6.164.162 any $HOME_NET any (msg:"ads.t-online.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.65.6.5 any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.68.21.37 any $HOME_NET any (msg:"ads.guardianunlimited.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 217.68.23.221 any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.68.70.69 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.144 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.145 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.146 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.147 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.148 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.149 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.46 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.47 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.48 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.133.49 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.134.212 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.135.1 any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.135.129 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.135.131 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.136.176 any $HOME_NET any (msg:"top.list.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.69.136.185 any $HOME_NET any (msg:"top.mail.ru"; classtype:trojan-activity; priority:1;)
alert tcp 217.70.184.38 any $HOME_NET any (msg:"techclicks.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.71.160.16 any $HOME_NET any (msg:"advertmedia.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.195.151 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.195.152 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.195.84 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.195.85 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.199.180 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.200.153 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.204.116 any $HOME_NET any (msg:"adclient.uimserv.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.240.204 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.66.227 any $HOME_NET any (msg:"ad.httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.66.230 any $HOME_NET any (msg:"ad.httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.66.231 any $HOME_NET any (msg:"ad.httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.72.66.239 any $HOME_NET any (msg:"httpool.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.73.201.37 any $HOME_NET any (msg:"rose.ixbt.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.73.3.70 any $HOME_NET any (msg:"travis.bosscasinos.com"; classtype:trojan-activity; priority:1;)
alert tcp 217.77.34.216 any $HOME_NET any (msg:"ad1.hardware.no"; classtype:trojan-activity; priority:1;)
alert tcp 217.78.34.225 any $HOME_NET any (msg:"ads.nordichardware.se"; classtype:trojan-activity; priority:1;)
alert tcp 217.79.177.10 any $HOME_NET any (msg:"bannercommunity.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.79.177.100 any $HOME_NET any (msg:"bannercommunity.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.79.177.14 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.79.177.197 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.79.177.27 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.79.187.93 any $HOME_NET any (msg:"advolution.de"; classtype:trojan-activity; priority:1;)
alert tcp 217.79.188.6 any $HOME_NET any (msg:"adition.net"; classtype:trojan-activity; priority:1;)
alert tcp 217.97.243.217 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.105 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.11 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.12 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.129 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.14 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.141 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.142 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.155 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.167 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.18 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.19 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.74 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.75 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.76 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.145.28.82 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.191.97.98 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 218.206.201.252 any $HOME_NET any (msg:"99count.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.233.240.143 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.233.240.148 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp 218.29.177.19 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 218.76.201.231 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 218.76.201.238 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 218.76.201.241 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 218.76.78.8 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.118.191.53 any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp 219.129.21.253 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.129.237.43 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.129.237.46 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.129.237.47 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.129.237.50 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.129.237.54 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.130 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.132 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.133 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.134 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.135 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.136 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.139 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.141 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.142 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.143 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.144 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.145 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.147 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.148 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.174 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.186 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.187 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.241.192 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.10 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.24 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.3 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.38 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.39 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.4 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.42 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.45 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.5 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.55 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.56 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.6 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.7 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.8 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.88 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.232.243.9 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.238.148.83 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.238.157.142 any $HOME_NET any (msg:"ads.datingyes.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.238.238.245 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.240.39.67 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.240.39.71 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.240.39.95 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp 219.94.225.104 any $HOME_NET any (msg:"clicklink.jp"; classtype:trojan-activity; priority:1;)
alert tcp 220.170.143.151 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 220.181.78.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 220.226.195.22 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 220.226.198.20 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 220.85.46.2 any $HOME_NET any (msg:"pro.i-doctor.co.kr"; classtype:trojan-activity; priority:1;)
alert tcp 221.116.73.99 any $HOME_NET any (msg:"tatsumi-sys.jp"; classtype:trojan-activity; priority:1;)
alert tcp 221.126.92.237 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.1.227 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.10.15 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.10.161 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.10.179 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.13.242 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.14.229 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.15.204 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.48.103 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.48.201 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.48.66 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.49.12 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.49.18 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.50.1 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.50.248 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.50.96 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.51.106 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.51.153 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.51.207 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.51.40 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.52.216 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.52.63 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.52.82 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.53.254 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.53.50 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.53.95 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.54.137 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.54.79 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.55.0 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.76.116 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.76.63 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.76.99 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.77.122 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.77.208 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.77.235 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.77.246 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.77.251 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.77.57 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.77.98 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.78.174 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.78.65 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.78.75 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.79.249 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.79.76 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.79.79 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.9.102 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.96.148 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.96.72 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.96.93 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.97.196 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.98.22 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.98.36 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.98.4 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.98.8 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.127.99.197 any $HOME_NET any (msg:"fxstyle.net"; classtype:trojan-activity; priority:1;)
alert tcp 221.13.128.164 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 221.13.128.166 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 221.13.128.167 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 221.13.128.173 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 221.13.128.174 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 221.13.128.190 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 221.141.0.159 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 221.141.0.74 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 221.141.0.75 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 221.192.135.66 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 221.4.254.121 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 222.122.209.102 any $HOME_NET any (msg:"adimg1.chosun.com"; classtype:trojan-activity; priority:1;)
alert tcp 222.186.33.155 any $HOME_NET any (msg:"51yes.com"; classtype:trojan-activity; priority:1;)
alert tcp 222.186.36.58 any $HOME_NET any (msg:"51yes.com"; classtype:trojan-activity; priority:1;)
alert tcp 222.187.221.28 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 222.236.44.131 any $HOME_NET any (msg:"linkprice.com"; classtype:trojan-activity; priority:1;)
alert tcp 222.73.205.6 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 222.88.77.204 any $HOME_NET any (msg:"99count.com"; classtype:trojan-activity; priority:1;)
alert tcp 222.88.95.2 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 222.88.95.5 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 222.89.164.11 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 223.165.25.36 any $HOME_NET any (msg:"ads.indiatimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 223.165.31.15 any $HOME_NET any (msg:"ads.indiatimes.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.105.103 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.105.51 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.109.1 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.109.41 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.114.7 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.118.41 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.121.47 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.124.212 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.131.103 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.137.147 any $HOME_NET any (msg:"servedbyopenx.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.142.221 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.145.197 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.164.157 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.171.3 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.182.206 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.182.46 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.195.13 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.209.206 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.213.197 any $HOME_NET any (msg:"adapt.tv"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.222.53 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.223.100 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.229.219 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.231.58 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.238.203 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.242.35 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.242.94 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.249.214 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.251.245 any $HOME_NET any (msg:"hopfeed.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.251.51 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.53.78 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.73.157 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.75.33 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.76.157 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.78.9 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.80.205 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.89.135 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.90.188 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.90.220 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.90.222 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.90.80 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.90.87 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.92.173 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.93.59 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.95.12 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.21.95.94 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.100.157 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.101.121 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.103.48 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.110.236 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.110.58 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.110.81 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.115.199 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.116.187 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.121.42 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.122.198 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.129.32 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.131.158 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.136.102 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.137.168 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.137.192 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.139.12 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.139.214 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.139.249 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.141.52 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.141.62 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.142.198 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.146.11 any $HOME_NET any (msg:"extreme-dm.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.149.214 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.159.252 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.172.134 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.174.168 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.199.178 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.204.128 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.210.22 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.217.72 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.224.27 any $HOME_NET any (msg:"swordfishdc.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.236.93 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.249.2 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.254.86 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.86.226 any $HOME_NET any (msg:"buyhitscheap.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.88.230 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.92.97 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.23.97.186 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.3.68.137 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 23.3.68.138 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 23.38.101.234 any $HOME_NET any (msg:"ads.web.de"; classtype:trojan-activity; priority:1;)
alert tcp 23.38.115.153 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.38.3.171 any $HOME_NET any (msg:"subscribe.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.43.19.153 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.43.35.153 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.43.83.153 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.43.99.153 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.43.99.93 any $HOME_NET any (msg:"ads.fairfax.com.au"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.251.99 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.254.232 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.254.251 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.255.217 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.255.218 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.255.227 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.255.240 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.255.242 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.255.56 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.61.255.80 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.62.53.112 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 23.62.53.59 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 23.62.53.66 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.62.53.67 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.62.53.73 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.62.53.80 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.62.53.98 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.62.53.99 any $HOME_NET any (msg:"ads.telegraph.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 23.63.98.152 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.63.98.202 any $HOME_NET any (msg:"di1.shopping.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.74.118.8 any $HOME_NET any (msg:"www8.glam.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.74.120.241 any $HOME_NET any (msg:"services.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.74.125.95 any $HOME_NET any (msg:"ads.undertone.com"; classtype:trojan-activity; priority:1;)
alert tcp 23.74.83.153 any $HOME_NET any (msg:"ads.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.130.54.168 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.138.22.101 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.152.163.130 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.152.163.157 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.152.170.36 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.152.191.10 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.152.191.9 any $HOME_NET any (msg:"sinoa.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.168.156.120 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;)
alert tcp 24.19.185.244 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 24.19.187.214 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 24.196.79.133 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.196.79.142 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.222.75.238 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.244.141.248 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.249.226.22 any $HOME_NET any (msg:"spywarelabs.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.43.169.7 any $HOME_NET any (msg:"ads.aceweb.net"; classtype:trojan-activity; priority:1;)
alert tcp 24.6.156.162 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 24.75.17.150 any $HOME_NET any (msg:"kanoodle.com"; classtype:trojan-activity; priority:1;)
alert tcp 31.172.244.123 any $HOME_NET any (msg:"adnet-media.net"; classtype:trojan-activity; priority:1;)
alert tcp 31.192.112.192 any $HOME_NET any (msg:"cash4members.com"; classtype:trojan-activity; priority:1;)
alert tcp 31.222.181.117 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;)
alert tcp 31.24.80.120 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 32.107.37.11 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 32.107.45.11 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 32.107.56.11 any $HOME_NET any (msg:"adsatt.abc.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.157.6.226 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.157.6.227 any $HOME_NET any (msg:"track.adform.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.17.224.8 any $HOME_NET any (msg:"top-casting-termine.de"; classtype:trojan-activity; priority:1;)
alert tcp 37.221.192.47 any $HOME_NET any (msg:"adisfy.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.1 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.10 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.100 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.103 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.104 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.106 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.11 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.116 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.119 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.12 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.120 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.128 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.13 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.132 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.14 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.141 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.146 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.15 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.150 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.151 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.152 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.153 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.154 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.155 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.156 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.157 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.158 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.159 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.16 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.160 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.161 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.162 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.163 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.166 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.167 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.168 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.169 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.170 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.171 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.172 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.195 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.2 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.202 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.206 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.207 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.212 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.218 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.221 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.222 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.224 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.225 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.228 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.229 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.3 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.4 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.46 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.49 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.5 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.54 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.56 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.58 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.59 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.6 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.60 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.63 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.7 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.70 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.71 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.72 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.73 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.75 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.8 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.84 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.86 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.87 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.88 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.89 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.9 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.95 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.96 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.97 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.98 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.162.99 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.11 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.12 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.15 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.17 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.18 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.2 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.20 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.21 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.22 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.24 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.28 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.29 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.30 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.38 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.39 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.4 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.40 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.43 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.52 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.53 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.54 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.55 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.57 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.58 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.6 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.60 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.62 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.63 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.64 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.65 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.66 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.68 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.69 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.70 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.72 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.74 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.75 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.78 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.8 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.252.170.82 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.59.49.39 any $HOME_NET any (msg:"popub.com"; classtype:trojan-activity; priority:1;)
alert tcp 37.59.58.45 any $HOME_NET any (msg:"ads.y-0.net"; classtype:trojan-activity; priority:1;)
alert tcp 38.100.208.18 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.100.208.8 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.101.169.38 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.101.43.14 any $HOME_NET any (msg:"adserver.finditquick.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.102.136.101 any $HOME_NET any (msg:"banners.wunderground.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.102.137.128 any $HOME_NET any (msg:"as5000.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.102.153.141 any $HOME_NET any (msg:"ads.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.102.153.144 any $HOME_NET any (msg:"ads.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.102.228.27 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.102.228.56 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.106.67.11 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.106.67.7 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.107.128.88 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.107.129.2 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.107.129.3 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.107.231.10 any $HOME_NET any (msg:"enoratraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.108.74.201 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.108.74.238 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.109.201.100 any $HOME_NET any (msg:"crispads.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.114.129.148 any $HOME_NET any (msg:"ads.techtv.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.114.159.35 any $HOME_NET any (msg:"ads.financialcontent.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.114.159.36 any $HOME_NET any (msg:"ads.financialcontent.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.114.159.37 any $HOME_NET any (msg:"ads.financialcontent.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.114.16.250 any $HOME_NET any (msg:"ad.choiceradio.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.115.177.158 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.115.177.159 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.117.74.204 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.117.74.205 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.117.90.29 any $HOME_NET any (msg:"reduxmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.118.144.180 any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.118.144.185 any $HOME_NET any (msg:"spywarenuker.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.118.144.186 any $HOME_NET any (msg:"spywarenuker.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.118.147.41 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.118.195.117 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.118.199.152 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.118.69.130 any $HOME_NET any (msg:"ad.choiceradio.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.118.85.23 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.119.130.60 any $HOME_NET any (msg:"ads.newgrounds.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.119.96.124 any $HOME_NET any (msg:"updated.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.126.9.134 any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.73.66.104 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.91.109.5 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.91.110.74 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.97.225.135 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 38.97.225.144 any $HOME_NET any (msg:"itsptp.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.97.225.166 any $HOME_NET any (msg:"itsptp.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.97.225.206 any $HOME_NET any (msg:"itsptp.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.97.225.209 any $HOME_NET any (msg:"itsptp.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.98.118.226 any $HOME_NET any (msg:"start.freeze.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.99.105.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.99.105.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.99.105.55 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp 38.99.115.242 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.99.133.20 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 38.99.186.205 any $HOME_NET any (msg:"yesadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 38.99.186.212 any $HOME_NET any (msg:"clicksor.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.43.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.43.254 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.48.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.49.126 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.50.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.50.252 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.50.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.53.254 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.54.126 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.23.56.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.226.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.227.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.227.253 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.228.254 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.229.254 any $HOME_NET any (msg:"adserver.oddschecker.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.230.125 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.231.254 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.232.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.232.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.232.254 any $HOME_NET any (msg:"adimage.guardian.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.233.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.233.254 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.234.126 any $HOME_NET any (msg:"ad.71i.de"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.235.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.235.254 any $HOME_NET any (msg:"richmedia.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.236.126 any $HOME_NET any (msg:"ads1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.236.253 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.237.126 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.242.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.26.244.125 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.102 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.103 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.104 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.105 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.106 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.107 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.108 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.109 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.110 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.111 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.112 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.113 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.114 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.115 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.71.22.116 any $HOME_NET any (msg:"adsfac.us"; classtype:trojan-activity; priority:1;)
alert tcp 4.78.20.11 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.78.243.21 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.78.243.22 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.78.243.26 any $HOME_NET any (msg:"quantcast.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.78.243.32 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.78.243.33 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.78.243.34 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 4.79.216.200 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.120.219.6 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.120.59.19 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.120.59.20 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.120.59.21 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.120.59.22 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.120.59.24 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.120.59.26 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.121.103.168 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.121.103.235 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 42.156.140.11 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.101.198 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.101.46 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.101.49 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.101.95 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.102.234 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.105.115 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.105.185 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.107.225 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.117.148 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.117.151 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.122.100 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.125.51 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.127.167 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.156.168 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.156.219 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.164.209 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.182.222 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.183.174 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.190.95 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.191.37 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.219.168 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.222.11 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.227.76 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.228.250 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.231.61 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.233.31 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.237.251 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.253.156 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.6.200 any $HOME_NET any (msg:"casinopays.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.72.151 any $HOME_NET any (msg:"casinopays.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.72.85 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.73.49 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.75.27 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.78.16 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.78.84 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.79.230 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.81.221 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.82.237 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.83.15 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.84.205 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.87.207 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.88.167 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.88.4 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.89.120 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.91.187 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.93.113 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.95.113 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.95.239 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.96.197 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.96.57 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.137.99.147 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.149.113.131 any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp 46.149.113.145 any $HOME_NET any (msg:"add.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp 46.163.78.186 any $HOME_NET any (msg:"adxvalue.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.182.85.54 any $HOME_NET any (msg:"hit.ua"; classtype:trojan-activity; priority:1;)
alert tcp 46.188.23.8 any $HOME_NET any (msg:"hitlist.ru"; classtype:trojan-activity; priority:1;)
alert tcp 46.20.32.41 any $HOME_NET any (msg:"yieldlab.net"; classtype:trojan-activity; priority:1;)
alert tcp 46.22.70.12 any $HOME_NET any (msg:"payserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.22.70.50 any $HOME_NET any (msg:"banners.clubseventeen.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.22.70.90 any $HOME_NET any (msg:"banners.clubseventeen.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.229.161.230 any $HOME_NET any (msg:"adyea.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.229.161.231 any $HOME_NET any (msg:"adyea.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.236.13.145 any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.248.162.115 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 46.252.178.23 any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.252.178.29 any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.252.178.30 any $HOME_NET any (msg:"ebuzzing.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.255.224.67 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;)
alert tcp 46.255.225.114 any $HOME_NET any (msg:"ad.centrum.cz"; classtype:trojan-activity; priority:1;)
alert tcp 46.28.107.134 any $HOME_NET any (msg:"imprese.cz"; classtype:trojan-activity; priority:1;)
alert tcp 46.38.178.127 any $HOME_NET any (msg:"dc-storm.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.38.226.12 any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;)
alert tcp 46.38.50.138 any $HOME_NET any (msg:"ad.f1cd.ru"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.100.213 any $HOME_NET any (msg:"ad.altervista.org"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.132.207 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.212.152 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.212.29 any $HOME_NET any (msg:"sponsorpro.de"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.231.8 any $HOME_NET any (msg:"ad2flash.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.4.5 any $HOME_NET any (msg:"adcell.de"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.44.157 any $HOME_NET any (msg:"hits.europuls.eu"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.77.42 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.80.107 any $HOME_NET any (msg:"best-top.ro"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.80.238 any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.4.86.222 any $HOME_NET any (msg:"warlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.168.31 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.170.198 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.170.246 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.171.64 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.174.228 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.175.57 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.177.155 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.179.59 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.181.243 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 46.51.184.149 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 49.212.20.135 any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp 49.212.20.190 any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp 49.212.63.71 any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp 49.212.78.150 any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp 49.212.78.152 any $HOME_NET any (msg:"banner.blogranking.net"; classtype:trojan-activity; priority:1;)
alert tcp 5.100.225.198 any $HOME_NET any (msg:"kliks.nl"; classtype:trojan-activity; priority:1;)
alert tcp 5.35.248.18 any $HOME_NET any (msg:"express-submit.de"; classtype:trojan-activity; priority:1;)
alert tcp 5.57.226.200 any $HOME_NET any (msg:"miarroba.com"; classtype:trojan-activity; priority:1;)
alert tcp 5.63.148.140 any $HOME_NET any (msg:"zeusclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 5.77.48.224 any $HOME_NET any (msg:"ads.uknetguide.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 5.79.39.140 any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;)
alert tcp 5.79.58.175 any $HOME_NET any (msg:"tcads.net"; classtype:trojan-activity; priority:1;)
alert tcp 5.9.138.168 any $HOME_NET any (msg:"mediaarea.eu"; classtype:trojan-activity; priority:1;)
alert tcp 5.9.42.218 any $HOME_NET any (msg:"ads.gsm-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 5.9.90.81 any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;)
alert tcp 5.9.90.85 any $HOME_NET any (msg:"baypops.com"; classtype:trojan-activity; priority:1;)
alert tcp 5.9.97.114 any $HOME_NET any (msg:"madvertise.de"; classtype:trojan-activity; priority:1;)
alert tcp 50.116.23.169 any $HOME_NET any (msg:"veruta.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.116.49.145 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.116.53.176 any $HOME_NET any (msg:"vervewireless.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.116.6.162 any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.116.73.22 any $HOME_NET any (msg:"adtology.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.135.6.184 any $HOME_NET any (msg:"ads.cheapflights.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.125.86 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.187.45 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.196.189 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.197.64 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.203.102 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.210.6 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.211.251 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.220.203 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.222.156 any $HOME_NET any (msg:"ad-up.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.222.246 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.226.43 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.242.194 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.242.223 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.242.86 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.245.26 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.39.84 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.16.67.67 any $HOME_NET any (msg:"krxd.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.168.26 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.183.23 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.184.173 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.186.126 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.199.173 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.199.228 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.200.93 any $HOME_NET any (msg:"mystat.pl"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.204.139 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.207.222 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.214.103 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.214.118 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.215.47 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.218.235 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.218.42 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.221.240 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.221.248 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.224.79 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.226.222 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.231.23 any $HOME_NET any (msg:"advertpro.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.235.66 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.237.150 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.238.126 any $HOME_NET any (msg:"ads.slim.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.238.198 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.246.206 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.17.251.180 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.106.4 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.109.12 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.112.219 any $HOME_NET any (msg:"adsymptotic.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.113.145 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.120.116 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.120.45 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.122.140 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.125.132 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.125.136 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.127.126 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.152.144 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.153.4 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.154.217 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.154.247 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.154.64 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.156.11 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.172.19 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.174.208 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.174.255 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.175.121 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.177.215 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.185.85 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.191.97 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.250.71 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.255.84 any $HOME_NET any (msg:"adsymptotic.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.50.209 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.52.165 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.53.253 any $HOME_NET any (msg:"playhaven.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.54.177 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.54.195 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.57.37 any $HOME_NET any (msg:"adsymptotic.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.59.165 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.18.60.174 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.102.80 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.104.123 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.2.70 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.209.45 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.210.143 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.210.205 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.211.89 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.224.141 any $HOME_NET any (msg:"ads.slim.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.229.39 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.234.112 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.241.28 any $HOME_NET any (msg:"viewpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.244.1 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.247.24 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.250.227 any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.43.39 any $HOME_NET any (msg:"ads.appsgeyser.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.84.135 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.19.89.136 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.22.192.15 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.22.200.242 any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.22.200.243 any $HOME_NET any (msg:"spot.fitness.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.22.220.164 any $HOME_NET any (msg:"freeonlineusers.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.22.224.67 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.22.230.132 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.22.244.242 any $HOME_NET any (msg:"yabuka.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.22.55.114 any $HOME_NET any (msg:"adreactor.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.23.151.122 any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.23.200.230 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.23.200.238 any $HOME_NET any (msg:"adserver.twitpic.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.23.235.6 any $HOME_NET any (msg:"cpmstar.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.23.249.68 any $HOME_NET any (msg:"ads.uncrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.23.28.130 any $HOME_NET any (msg:"adconion.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.23.72.4 any $HOME_NET any (msg:"ads.abovetopsecret.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.28.24.79 any $HOME_NET any (msg:"adgridwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.28.35.167 any $HOME_NET any (msg:"dealdotcom.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.28.8.229 any $HOME_NET any (msg:"blogrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.31.138.216 any $HOME_NET any (msg:"best-pr.info"; classtype:trojan-activity; priority:1;)
alert tcp 50.31.74.155 any $HOME_NET any (msg:"tangerinenet.biz"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.111.173 any $HOME_NET any (msg:"at-adserver.alltop.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.122.129 any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.166.184 any $HOME_NET any (msg:"metanetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.183.225 any $HOME_NET any (msg:"theadhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.2.223 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.212.61 any $HOME_NET any (msg:"ads.gplusmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.233.134 any $HOME_NET any (msg:"rubiconproject.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.244.236 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.48.64 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.49.130 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.56.253 any $HOME_NET any (msg:"bannieres.acces-contenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.56.56.8 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.57.201.228 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.57.203.17 any $HOME_NET any (msg:"bannieres.acces-contenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.57.27.26 any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.57.31.71 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.57.34.52 any $HOME_NET any (msg:"abz.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.57.97.175 any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.10.222 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.197.206 any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.127 any $HOME_NET any (msg:"images-pw.secureserver.net"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.13 any $HOME_NET any (msg:"displayadsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.3 any $HOME_NET any (msg:"adserverplus.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.38 any $HOME_NET any (msg:"7bpeople.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.39 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.4 any $HOME_NET any (msg:"percentmobile.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.40 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.51 any $HOME_NET any (msg:"realcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.72 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.80 any $HOME_NET any (msg:"thruport.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.82 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.85 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.87 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.202.89 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.70.1 any $HOME_NET any (msg:"imarketservices.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.63.72.1 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.77.15.165 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.87.150.12 any $HOME_NET any (msg:"slickaffiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.97.139.218 any $HOME_NET any (msg:"liverail.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.97.247.210 any $HOME_NET any (msg:"top-site-list.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.97.37.201 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.97.37.203 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.97.51.90 any $HOME_NET any (msg:"yabuka.com"; classtype:trojan-activity; priority:1;)
alert tcp 50.97.51.92 any $HOME_NET any (msg:"yabuka.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.194.131.241 any $HOME_NET any (msg:"ero-advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.204.1.241 any $HOME_NET any (msg:"ad-tech.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.204.26.237 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.208.229.237 any $HOME_NET any (msg:"information.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.208.99.166 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.209.58.18 any $HOME_NET any (msg:"bannerexchange.cjb.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.213.145.14 any $HOME_NET any (msg:"hitslink.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.213.189.1 any $HOME_NET any (msg:"pheedo.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.215.185.33 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.209.161 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.210.178 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.211.82 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.216.165 any $HOME_NET any (msg:"partnercash.de"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.221.45 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.241.197 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.241.239 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.241.255 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.217.242.2 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.221.218.251 any $HOME_NET any (msg:"advertpro.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.221.222.248 any $HOME_NET any (msg:"advertpro.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.224.152.221 any $HOME_NET any (msg:"lucidmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.131.82 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.136.74 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.159.253 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.169.193 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.174.248 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.200.71 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.204.38 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.209.204 any $HOME_NET any (msg:"adk2.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.239.173 any $HOME_NET any (msg:"ads.shopstyle.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.225.243.191 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.181.61 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.194.211 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.197.226 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.202.78 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.203.213 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.211.193 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.211.198 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.225.105 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.228.107 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.228.234.222 any $HOME_NET any (msg:"ads.p161.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.229.177.63 any $HOME_NET any (msg:"ad.caradisiac.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.229.22.95 any $HOME_NET any (msg:"ads.blog.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.1.246 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.102 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.114 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.115 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.125 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.127 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.13 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.132 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.137 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.140 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.141 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.144 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.156 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.161 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.165 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.183 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.196 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.199 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.20 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.204 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.211 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.216 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.220 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.232 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.245 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.249 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.250 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.3 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.35 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.41 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.46 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.48 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.5 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.51 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.54 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.56 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.57 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.6 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.63 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.64 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.68 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.69 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.75 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.80 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.83 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.86 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.10.93 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.106 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.109 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.121 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.123 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.128 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.13 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.136 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.137 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.148 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.159 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.16 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.168 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.17 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.175 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.177 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.190 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.193 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.197 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.21 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.210 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.215 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.222 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.225 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.226 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.236 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.24 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.25 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.250 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.31 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.37 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.42 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.56 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.57 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.61 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.65 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.71 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.76 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.11.77 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.2.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.2.53 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.3.134 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.3.240 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.3.241 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.3.5 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.3.86 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.101 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.103 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.104 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.106 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.109 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.111 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.114 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.123 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.124 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.125 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.126 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.127 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.130 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.131 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.134 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.135 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.138 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.139 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.140 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.142 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.149 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.151 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.153 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.16 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.166 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.167 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.171 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.173 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.178 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.181 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.192 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.197 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.2 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.201 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.202 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.206 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.207 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.213 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.217 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.227 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.238 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.24 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.240 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.244 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.253 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.254 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.28 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.36 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.52 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.61 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.64 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.66 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.68 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.8 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.88 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.90 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.95 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.8.99 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.108 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.11 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.113 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.120 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.121 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.124 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.142 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.148 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.161 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.168 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.177 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.179 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.180 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.183 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.187 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.189 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.19 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.194 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.196 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.200 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.209 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.21 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.210 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.216 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.231 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.234 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.238 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.32 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.49 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.51 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.58 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.63 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.66 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.7 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.8 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.83 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.89 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.9 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.230.9.94 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.235.145.185 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.235.165.206 any $HOME_NET any (msg:"openx.blindferret.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.235.187.238 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.235.198.123 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.235.88.170 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.235.99.186 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.238.184.140 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.238.248.55 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.103 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.107 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.11 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.111 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.115 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.123 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.127 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.131 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.135 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.139 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.143 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.15 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.151 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.155 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.159 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.163 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.183 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.187 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.19 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.195 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.203 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.207 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.211 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.219 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.223 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.227 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.231 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.235 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.239 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.247 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.25 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.251 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.3 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.35 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.39 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.43 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.47 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.59 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.67 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.7 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.71 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.75 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.79 any $HOME_NET any (msg:"ads.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.83 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.91 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.95 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.240.166.99 any $HOME_NET any (msg:"ads.tso.dennisnet.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 54.241.13.29 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.241.22.126 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.241.28.198 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.241.31.48 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.241.4.163 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.242.139.165 any $HOME_NET any (msg:"advertisespace.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.242.14.80 any $HOME_NET any (msg:"adzerk.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.105.88 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.106.253 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.107.53 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.116.121 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.126.7 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.128.92 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.138.158 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.141.56 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.145.78 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.150.2 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.150.40 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.151.220 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.175.52 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.185.58 any $HOME_NET any (msg:"netshelter.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.192.207 any $HOME_NET any (msg:"adminder.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.206.51 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.207.151 any $HOME_NET any (msg:"advertisespace.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.230.67 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.252.123 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.252.249 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.255.164 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.36.7 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.49.231 any $HOME_NET any (msg:"leadboltads.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.58.183 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.58.194 any $HOME_NET any (msg:"ads.supplyframe.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.75.78 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.80.64 any $HOME_NET any (msg:"ad.leadbolt.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.81.191 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.86.240 any $HOME_NET any (msg:"hightrafficads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.90.185 any $HOME_NET any (msg:"kissmetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.92.121 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.243.99.220 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.244.108.172 any $HOME_NET any (msg:"smowtion.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.246.105.116 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.246.105.136 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.246.106.239 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.246.113.255 any $HOME_NET any (msg:"mediax.angloinfo.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.246.169.172 any $HOME_NET any (msg:"ad.crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.246.196.221 any $HOME_NET any (msg:"ad.crwdcntrl.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.246.82.130 any $HOME_NET any (msg:"ad.wavu.hu"; classtype:trojan-activity; priority:1;)
alert tcp 54.246.88.99 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.110.50 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.161.53 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.168.118 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.168.30 any $HOME_NET any (msg:"gbanners.hornymatches.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.171.12 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.171.42 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.171.52 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.186.197 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.186.212 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.186.217 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.186.236 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.186.40 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.187.243 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.187.69 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.187.70 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.188.6 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.73.86 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.79.195 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.82.36 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.82.49 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.82.52 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.83.224 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.247.88.42 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.249.100.171 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.249.93.126 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 54.251.127.128 any $HOME_NET any (msg:"s2d6.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.251.5.219 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.251.67.197 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.251.71.55 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.251.77.190 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 54.251.77.247 any $HOME_NET any (msg:"tpnads.com"; classtype:trojan-activity; priority:1;)
alert tcp 58.64.171.133 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 58.64.171.138 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 58.82.102.228 any $HOME_NET any (msg:"ads8.com"; classtype:trojan-activity; priority:1;)
alert tcp 59.106.65.72 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 59.106.92.168 any $HOME_NET any (msg:"ad.a8.net"; classtype:trojan-activity; priority:1;)
alert tcp 59.188.26.72 any $HOME_NET any (msg:"valuesponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 60.12.231.36 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 60.190.113.12 any $HOME_NET any (msg:"51yes.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.111.9.66 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 61.111.9.67 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 61.111.9.68 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 61.111.9.69 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 61.111.9.70 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 61.111.9.71 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 61.111.9.72 any $HOME_NET any (msg:"ad.pandora.tv"; classtype:trojan-activity; priority:1;)
alert tcp 61.129.52.198 any $HOME_NET any (msg:"topsir.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.135.162.26 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.135.163.221 any $HOME_NET any (msg:"eiv.baidu.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.139.126.56 any $HOME_NET any (msg:"count.west263.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.155.199.240 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.155.199.250 any $HOME_NET any (msg:"v1.cnzz.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.187.235.110 any $HOME_NET any (msg:"js.users.51.la"; classtype:trojan-activity; priority:1;)
alert tcp 61.213.12.16 any $HOME_NET any (msg:"x6.yakiuchi.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.213.167.185 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.54.28.14 any $HOME_NET any (msg:"99count.com"; classtype:trojan-activity; priority:1;)
alert tcp 61.54.28.25 any $HOME_NET any (msg:"99count.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.1.1.114 any $HOME_NET any (msg:"bannergrabber.internet.gr"; classtype:trojan-activity; priority:1;)
alert tcp 62.1.43.178 any $HOME_NET any (msg:"interactive.forthnet.gr"; classtype:trojan-activity; priority:1;)
alert tcp 62.1.43.180 any $HOME_NET any (msg:"interactive.forthnet.gr"; classtype:trojan-activity; priority:1;)
alert tcp 62.101.68.209 any $HOME_NET any (msg:"ilbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.103.124.14 any $HOME_NET any (msg:"adman.gr"; classtype:trojan-activity; priority:1;)
alert tcp 62.103.124.7 any $HOME_NET any (msg:"adman.gr"; classtype:trojan-activity; priority:1;)
alert tcp 62.104.22.50 any $HOME_NET any (msg:"adview.ppro.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.104.23.13 any $HOME_NET any (msg:"adview.ppro.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.104.23.14 any $HOME_NET any (msg:"adview.ppro.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.104.23.88 any $HOME_NET any (msg:"adview.ppro.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.109.129.29 any $HOME_NET any (msg:"banner.tanto.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.113.203.2 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.113.203.242 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.113.203.66 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.130.8 any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.10 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.12 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.13 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.15 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.16 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.17 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.18 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.19 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.143.21 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.181.25 any $HOME_NET any (msg:"richwebmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.116.181.27 any $HOME_NET any (msg:"webtraxx.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.118.240.27 any $HOME_NET any (msg:"supertop.ru"; classtype:trojan-activity; priority:1;)
alert tcp 62.118.240.36 any $HOME_NET any (msg:"hotlog.ru"; classtype:trojan-activity; priority:1;)
alert tcp 62.118.248.72 any $HOME_NET any (msg:"supertop.ru"; classtype:trojan-activity; priority:1;)
alert tcp 62.118.249.30 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 62.118.249.35 any $HOME_NET any (msg:"lbn.ru"; classtype:trojan-activity; priority:1;)
alert tcp 62.121.6.136 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.121.6.137 any $HOME_NET any (msg:"y.ibsys.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.121.6.138 any $HOME_NET any (msg:"us.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.128.39.101 any $HOME_NET any (msg:"adonspot.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.128.56.34 any $HOME_NET any (msg:"z5x.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.129.129.17 any $HOME_NET any (msg:"payserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.129.129.27 any $HOME_NET any (msg:"payserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.129.129.41 any $HOME_NET any (msg:"banners.clubseventeen.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.129.136.113 any $HOME_NET any (msg:"ad.preferances.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.129.141.3 any $HOME_NET any (msg:"totemcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.129.243.50 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;)
alert tcp 62.133.211.163 any $HOME_NET any (msg:"bannerconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.138.114.35 any $HOME_NET any (msg:"adscale.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.140.213.218 any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.140.213.243 any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.141.44.24 any $HOME_NET any (msg:"adbroker.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.141.52.18 any $HOME_NET any (msg:"aidu-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.141.52.51 any $HOME_NET any (msg:"banner-exchange-24.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.141.54.44 any $HOME_NET any (msg:"aidu-ads.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.141.55.111 any $HOME_NET any (msg:"anahtars.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.104.132 any $HOME_NET any (msg:"adserv.gamezone.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.104.191 any $HOME_NET any (msg:"adserv.gamezone.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.108.194 any $HOME_NET any (msg:"adserv.gamezone.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.112.122 any $HOME_NET any (msg:"rankingscout.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.124.101 any $HOME_NET any (msg:"adpepper.dk"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.13.247 any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.13.253 any $HOME_NET any (msg:"adtiger.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.14.6 any $HOME_NET any (msg:"adserver01.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.141.29 any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.198.130 any $HOME_NET any (msg:"adserver01.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.198.133 any $HOME_NET any (msg:"adserver01.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.219.156 any $HOME_NET any (msg:"ranking-charts.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.223.8 any $HOME_NET any (msg:"advertmedia.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.24.132 any $HOME_NET any (msg:"interreklame.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.24.133 any $HOME_NET any (msg:"ad.interreklame.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.24.134 any $HOME_NET any (msg:"interreklame.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.31.200 any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.88.103 any $HOME_NET any (msg:"adpepper.nl"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.88.105 any $HOME_NET any (msg:"ilead.itrack.it"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.88.110 any $HOME_NET any (msg:"static.itrack.it"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.88.111 any $HOME_NET any (msg:"static.itrack.it"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.88.121 any $HOME_NET any (msg:"webstats4u.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.88.122 any $HOME_NET any (msg:"m1.webstats4u.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.88.88 any $HOME_NET any (msg:"ads.krawall.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.146.91.26 any $HOME_NET any (msg:"superclix.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.149.0.215 any $HOME_NET any (msg:"mycounter.ua"; classtype:trojan-activity; priority:1;)
alert tcp 62.149.128.40 any $HOME_NET any (msg:"scambiobanner.aruba.it"; classtype:trojan-activity; priority:1;)
alert tcp 62.149.13.65 any $HOME_NET any (msg:"top.proext.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.149.198.69 any $HOME_NET any (msg:"ads.mariuana.it"; classtype:trojan-activity; priority:1;)
alert tcp 62.149.26.52 any $HOME_NET any (msg:"top.proext.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.151.2.150 any $HOME_NET any (msg:"advertpro.ya.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.153.159.92 any $HOME_NET any (msg:"ads.t-online.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.161.94.10 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.161.94.11 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.161.94.117 any $HOME_NET any (msg:"xiti.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.168.116.101 any $HOME_NET any (msg:"mas.sector.sk"; classtype:trojan-activity; priority:1;)
alert tcp 62.168.62.4 any $HOME_NET any (msg:"webcounter.cz"; classtype:trojan-activity; priority:1;)
alert tcp 62.169.0.50 any $HOME_NET any (msg:"zanox.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.190.153.21 any $HOME_NET any (msg:"ads.contactmusic.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.190.8.171 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.201.170.65 any $HOME_NET any (msg:"hit.webcentre.lycos.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.205.10.76 any $HOME_NET any (msg:"adv.freeonline.it"; classtype:trojan-activity; priority:1;)
alert tcp 62.206.114.244 any $HOME_NET any (msg:"ads.forium.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.206.222.70 any $HOME_NET any (msg:"levelrate.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.209.196.111 any $HOME_NET any (msg:"impressionmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp 62.209.220.7 any $HOME_NET any (msg:"ads.newmedia.cz"; classtype:trojan-activity; priority:1;)
alert tcp 62.210.120.230 any $HOME_NET any (msg:"ad.caradisiac.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.210.148.2 any $HOME_NET any (msg:"gold.weborama.fr"; classtype:trojan-activity; priority:1;)
alert tcp 62.210.175.4 any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.210.241.1 any $HOME_NET any (msg:"ad.caradisiac.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.210.241.23 any $HOME_NET any (msg:"ad.caradisiac.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.212.68.168 any $HOME_NET any (msg:"readserver.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.212.74.30 any $HOME_NET any (msg:"logua.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.212.83.1 any $HOME_NET any (msg:"ads03.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.212.83.2 any $HOME_NET any (msg:"ads.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.212.84.35 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.212.84.50 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.212.84.73 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.213.240.131 any $HOME_NET any (msg:"belstat.nl"; classtype:trojan-activity; priority:1;)
alert tcp 62.214.98.26 any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.216.237.122 any $HOME_NET any (msg:"affiliatewindow.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.216.237.124 any $HOME_NET any (msg:"awin1.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.216.239.139 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.219.199.210 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.219.199.213 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.219.199.215 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.219.199.218 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.219.199.219 any $HOME_NET any (msg:"predictad.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.219.78.105 any $HOME_NET any (msg:"all4spy.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.219.78.118 any $HOME_NET any (msg:"all4spy.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.219.82.68 any $HOME_NET any (msg:"direct-xxx-access.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.23.10.253 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.23.137.170 any $HOME_NET any (msg:"ad.eurosport.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.23.26.150 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.23.30.168 any $HOME_NET any (msg:"smartadserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.114.106 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.114.107 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.114.109 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.114.110 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.114.118 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.114.121 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.114.165 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.114.166 any $HOME_NET any (msg:"ads.newsquest.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.233.121.4 any $HOME_NET any (msg:"banner.easyspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.24.64.42 any $HOME_NET any (msg:"ads.nyx.cz"; classtype:trojan-activity; priority:1;)
alert tcp 62.241.34.234 any $HOME_NET any (msg:"view4cash.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.241.34.236 any $HOME_NET any (msg:"go-clicks.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.243.72.6 any $HOME_NET any (msg:"ads.dk"; classtype:trojan-activity; priority:1;)
alert tcp 62.245.139.30 any $HOME_NET any (msg:"quisma.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.245.236.178 any $HOME_NET any (msg:"adserv.gamezone.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.25.101.120 any $HOME_NET any (msg:"ads.ft.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.25.103.200 any $HOME_NET any (msg:"ads.ft.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.25.74.216 any $HOME_NET any (msg:"ads.ft.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.26.68.51 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.27.11.76 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.27.11.98 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.32.97.9 any $HOME_NET any (msg:"vibrantmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.39.11.20 any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;)
alert tcp 62.39.11.50 any $HOME_NET any (msg:"oas.benchmark.fr"; classtype:trojan-activity; priority:1;)
alert tcp 62.4.66.20 any $HOME_NET any (msg:"popularix.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.4.66.222 any $HOME_NET any (msg:"popularix.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.4.85.251 any $HOME_NET any (msg:"play4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.40.85.155 any $HOME_NET any (msg:"itop.cz"; classtype:trojan-activity; priority:1;)
alert tcp 62.41.85.40 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.41.85.75 any $HOME_NET any (msg:"affiliate.offgamers.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.41.85.80 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.41.85.81 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.41.85.82 any $HOME_NET any (msg:"ads.hearstmags.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.41.85.90 any $HOME_NET any (msg:"affiliate.offgamers.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.44.69.219 any $HOME_NET any (msg:"stats.mirrorfootball.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 62.50.134.100 any $HOME_NET any (msg:"oxado.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.50.134.105 any $HOME_NET any (msg:"oxado.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.50.134.106 any $HOME_NET any (msg:"oxado.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.50.41.208 any $HOME_NET any (msg:"ads.berlinonline.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.51.0.35 any $HOME_NET any (msg:"adserver.aol.fr"; classtype:trojan-activity; priority:1;)
alert tcp 62.61.159.24 any $HOME_NET any (msg:"flexbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.61.159.73 any $HOME_NET any (msg:"flexbanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.65.11.160 any $HOME_NET any (msg:"adtrade.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.67.200.221 any $HOME_NET any (msg:"ad.domainfactory.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.70.15.11 any $HOME_NET any (msg:"primetime.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.131 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.132 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.133 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.134 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.135 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.136 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.137 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.138 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.139 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.140 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.141 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.142 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.143 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.144 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.145 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.146 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.148 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.149 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.184.150 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 62.73.185.77 any $HOME_NET any (msg:"entercasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.128.112 any $HOME_NET any (msg:"code-server.biz"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.134.91 any $HOME_NET any (msg:"ads.dazoot.ro"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.140.4 any $HOME_NET any (msg:"adbroker.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.181.40 any $HOME_NET any (msg:"adbroker.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.193.32 any $HOME_NET any (msg:"auto-bannertausch.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.206.58 any $HOME_NET any (msg:"ad.smartclip.net"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.216.20 any $HOME_NET any (msg:"layer-ad.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.216.68 any $HOME_NET any (msg:"surfmusik-adserver.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.222.99 any $HOME_NET any (msg:"links-ranking.de"; classtype:trojan-activity; priority:1;)
alert tcp 62.75.224.150 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.78.223.176 any $HOME_NET any (msg:"adserver.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp 62.78.223.178 any $HOME_NET any (msg:"adimages.sanomawsoy.fi"; classtype:trojan-activity; priority:1;)
alert tcp 62.80.178.134 any $HOME_NET any (msg:"banner.kiev.ua"; classtype:trojan-activity; priority:1;)
alert tcp 62.80.178.140 any $HOME_NET any (msg:"hit.ua"; classtype:trojan-activity; priority:1;)
alert tcp 62.80.2.70 any $HOME_NET any (msg:"sedotracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.84.129.156 any $HOME_NET any (msg:"ad.lupa.cz"; classtype:trojan-activity; priority:1;)
alert tcp 62.84.131.197 any $HOME_NET any (msg:"first.nova.cz"; classtype:trojan-activity; priority:1;)
alert tcp 62.84.131.44 any $HOME_NET any (msg:"banner.inyourpocket.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.84.209.151 any $HOME_NET any (msg:"au.a1.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 62.94.110.143 any $HOME_NET any (msg:"shinystat.it"; classtype:trojan-activity; priority:1;)
alert tcp 63.105.72.34 any $HOME_NET any (msg:"galaxien.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.108.181.204 any $HOME_NET any (msg:"ads.antionline.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.111.24.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.111.24.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.111.24.75 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.111.69.12 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.111.69.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.111.69.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.111.74.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.111.74.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.116.135.245 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.117.23.239 any $HOME_NET any (msg:"primaryads.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.117.23.30 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.117.23.90 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.119.44.197 any $HOME_NET any (msg:"seeq.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.121.29.55 any $HOME_NET any (msg:"adserver.monster.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.123.248.11 any $HOME_NET any (msg:"click.linksynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.123.248.7 any $HOME_NET any (msg:"ad.linksynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.123.248.8 any $HOME_NET any (msg:"ad.linksynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.135.80.61 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.138.120.113 any $HOME_NET any (msg:"hittail.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.140.35.160 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.140.35.161 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.140.35.162 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.140.35.28 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.140.42.71 any $HOME_NET any (msg:"touchclarity.natwest.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.141.223.2 any $HOME_NET any (msg:"ads.wikia.nocookie.net"; classtype:trojan-activity; priority:1;)
alert tcp 63.144.121.142 any $HOME_NET any (msg:"start.freeze.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.144.24.164 any $HOME_NET any (msg:"microticker.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.146.120.73 any $HOME_NET any (msg:"ad.musicmatch.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.149.176.12 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.156.206.202 any $HOME_NET any (msg:"mediacharger.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.156.206.38 any $HOME_NET any (msg:"identads.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.163.102.100 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.163.102.203 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.163.102.248 any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.171.166.66 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.171.166.75 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.208.196.110 any $HOME_NET any (msg:"gigya.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.208.235.31 any $HOME_NET any (msg:"ads.addynamix.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.208.235.8 any $HOME_NET any (msg:"pennyweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.208.77.220 any $HOME_NET any (msg:"affiliate.mercola.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.209.24.195 any $HOME_NET any (msg:"ad.bondage.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.209.5.150 any $HOME_NET any (msg:"counters.honesty.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.209.69.119 any $HOME_NET any (msg:"advertise.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.210.47.44 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.210.47.45 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.211.210.225 any $HOME_NET any (msg:"intellitxt.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.211.238.133 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.214.164.86 any $HOME_NET any (msg:"newnudecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.214.247.170 any $HOME_NET any (msg:"instantmadness.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.214.247.180 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.143.207 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.202.146 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.202.147 any $HOME_NET any (msg:"bn.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.202.48 any $HOME_NET any (msg:"adfarm.mediaplex.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.202.73 any $HOME_NET any (msg:"commission-junction.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.202.74 any $HOME_NET any (msg:"tkqlhce.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.202.9 any $HOME_NET any (msg:"fastclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.75.48 any $HOME_NET any (msg:"ads7.gamecity.net"; classtype:trojan-activity; priority:1;)
alert tcp 63.215.75.51 any $HOME_NET any (msg:"flowgo.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.216.0.251 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.216.0.252 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.216.0.253 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.216.0.254 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.217.26.120 any $HOME_NET any (msg:"newtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.218.129.146 any $HOME_NET any (msg:"protraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.218.13.196 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.218.65.10 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.219.151.20 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.219.179.142 any $HOME_NET any (msg:"ads.ign.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.231.252.74 any $HOME_NET any (msg:"cqcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.236.14.11 any $HOME_NET any (msg:"ad.musicmatch.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.236.72.243 any $HOME_NET any (msg:"thecounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.236.73.159 any $HOME_NET any (msg:"adres.internet.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.236.73.193 any $HOME_NET any (msg:"adres.internet.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.236.73.247 any $HOME_NET any (msg:"clickz.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.110.130 any $HOME_NET any (msg:"pepperjamnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.133.55 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.133.77 any $HOME_NET any (msg:"adsatt.espn.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.137.107 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.173.34 any $HOME_NET any (msg:"a.mktw.net"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.26.34 any $HOME_NET any (msg:"a.mktw.net"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.4.10 any $HOME_NET any (msg:"ads.forbes.net"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.4.141 any $HOME_NET any (msg:"ads.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.4.179 any $HOME_NET any (msg:"ads.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.4.212 any $HOME_NET any (msg:"ads.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.54.138 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.86.114 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.86.143 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.240.86.20 any $HOME_NET any (msg:"adv.webmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.241.10.45 any $HOME_NET any (msg:"Adsatt.ABCNews.starwave.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.241.205.207 any $HOME_NET any (msg:"affiliate.1800flowers.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.241.243.28 any $HOME_NET any (msg:"affiliate.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.241.7.24 any $HOME_NET any (msg:"therapistla.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.241.7.59 any $HOME_NET any (msg:"namimedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.243.169.136 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 63.243.169.208 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 63.243.188.108 any $HOME_NET any (msg:"cashengines.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.247.95.42 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.249.223.127 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.133.40 any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.163.109 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.163.112 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.171.80 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.171.81 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.183.201 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.183.212 any $HOME_NET any (msg:"adlegend.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.211.131 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.211.148 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.211.70 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.216.72 any $HOME_NET any (msg:"blast4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.216.9 any $HOME_NET any (msg:"ads.powweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.23.20 any $HOME_NET any (msg:"insightexpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.249.49 any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.51.247 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.57.198 any $HOME_NET any (msg:"ad.bondage.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.83.53 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.92.195 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.251.92.197 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.68.54.90 any $HOME_NET any (msg:"precisionclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.68.55.124 any $HOME_NET any (msg:"precisionclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.68.55.221 any $HOME_NET any (msg:"precisionclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.74.35.22 any $HOME_NET any (msg:"ads.scifi.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.77.84.10 any $HOME_NET any (msg:"secure.webconnect.net"; classtype:trojan-activity; priority:1;)
alert tcp 63.87.171.167 any $HOME_NET any (msg:"adserver.nydailynews.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.87.171.184 any $HOME_NET any (msg:"adserver.nydailynews.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.88.212.82 any $HOME_NET any (msg:"statse.webtrendslive.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.88.212.91 any $HOME_NET any (msg:"wtlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.94.64.83 any $HOME_NET any (msg:"ads.netmechanic.com"; classtype:trojan-activity; priority:1;)
alert tcp 63.99.210.223 any $HOME_NET any (msg:"oneandonlynetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.0.50.75 any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.1.16.14 any $HOME_NET any (msg:"ads.linuxsecurity.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.133.31 any $HOME_NET any (msg:"banners.sys-con.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.138.21 any $HOME_NET any (msg:"affiliate.doubleyourdating.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.138.41 any $HOME_NET any (msg:"affiliate.doubleyourdating.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.138.86 any $HOME_NET any (msg:"affiliate.doubleyourdating.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.154.189 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.190.145 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.190.146 any $HOME_NET any (msg:"traffiq.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.198.75 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.207.143 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.106.240.120 any $HOME_NET any (msg:"affiliate.doubleyourdating.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.111.123.92 any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.111.199.221 any $HOME_NET any (msg:"exoclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.111.199.222 any $HOME_NET any (msg:"exoclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.111.214.2 any $HOME_NET any (msg:"trafficholder.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.111.217.178 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.119.182.121 any $HOME_NET any (msg:"adserver.sciflicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.119.182.90 any $HOME_NET any (msg:"adserver.sciflicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.105.9 any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.106.9 any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.107.9 any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.152.2 any $HOME_NET any (msg:"ads.web.cs.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.166.9 any $HOME_NET any (msg:"tacoda.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.174.121 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.174.153 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.174.185 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.174.249 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.174.57 any $HOME_NET any (msg:"atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.184.121 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.184.25 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.184.57 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.184.89 any $HOME_NET any (msg:"ar.atwola.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.193.85 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.249.19 any $HOME_NET any (msg:"adsonar.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.46.10 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.46.11 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.46.23 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.46.24 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.50.151 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.68.16 any $HOME_NET any (msg:"adsonar.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.79.57 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.12.89.186 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.124.109.203 any $HOME_NET any (msg:"ad.weatherbug.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.124.125.2 any $HOME_NET any (msg:"bannerspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.124.130.139 any $HOME_NET any (msg:"cashpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.124.194.24 any $HOME_NET any (msg:"kontera.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.124.65.24 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.124.65.44 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.124.65.47 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.125.250.252 any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.125.250.26 any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.127.109.133 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.127.126.24 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.128.87.130 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.128.87.134 any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.128.87.135 any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.128.87.137 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.128.87.144 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.128.87.145 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.129.124.141 any $HOME_NET any (msg:"ads.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.13.247.198 any $HOME_NET any (msg:"reinvigorate.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.13.249.148 any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.130.13.57 any $HOME_NET any (msg:"scanscout.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.131.67.106 any $HOME_NET any (msg:"takru.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.131.69.251 any $HOME_NET any (msg:"adserver1.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.131.69.252 any $HOME_NET any (msg:"adserver1-images.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.131.69.253 any $HOME_NET any (msg:"bullseye.backbeatmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.131.72.164 any $HOME_NET any (msg:"topsafelist.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.131.74.171 any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.131.84.198 any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.20.37 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.20.58 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.20.60 any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.21.199 any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.24.162 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.24.185 any $HOME_NET any (msg:"ad.aboutwebservices.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.25.165 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.25.171 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.25.172 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.25.180 any $HOME_NET any (msg:"freestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.25.191 any $HOME_NET any (msg:"banner.northsky.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.29.191 any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.45.45 any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.136.53.45 any $HOME_NET any (msg:"untd.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.122.251 any $HOME_NET any (msg:"ads.bluemountain.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.173.202 any $HOME_NET any (msg:"ads.economist.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.42.111 any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.42.201 any $HOME_NET any (msg:"click.avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.44.124 any $HOME_NET any (msg:"www.targetshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.45.11 any $HOME_NET any (msg:"adsonar.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.45.12 any $HOME_NET any (msg:"quigo.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.56.11 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.56.13 any $HOME_NET any (msg:"ads.easy-forex.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.61.134 any $HOME_NET any (msg:"adsonar.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.61.136 any $HOME_NET any (msg:"quigo.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.81.141 any $HOME_NET any (msg:"s0b.bluestreak.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.86.82 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.86.87 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.86.88 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.14.87.35 any $HOME_NET any (msg:"chitika.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.141.2.216 any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.141.3.40 any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.66.163 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.84.49 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.84.66 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.94.18 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.94.19 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.94.201 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.94.203 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.94.204 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.94.205 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.94.206 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.145.94.207 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.146.132.15 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.146.132.19 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.146.132.20 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.146.132.25 any $HOME_NET any (msg:"ads.exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.146.132.45 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.146.132.46 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.146.132.47 any $HOME_NET any (msg:"exitexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.155.173 any $HOME_NET any (msg:"british-banners.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.100 any $HOME_NET any (msg:"adsoldier.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.101 any $HOME_NET any (msg:"adsoldier.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.103 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.132 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.139 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.145 any $HOME_NET any (msg:"roar.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.155 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.180 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.181 any $HOME_NET any (msg:"dbbsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.182 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.183 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.196 any $HOME_NET any (msg:"dbbsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.197 any $HOME_NET any (msg:"dbbsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.202 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.205 any $HOME_NET any (msg:"dbbsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.209 any $HOME_NET any (msg:"dbbsrv.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.231 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.232 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.233 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.235 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.236 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.240 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.241 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.205.97 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.229.66 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.251.199 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.15.251.216 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.151.102.165 any $HOME_NET any (msg:"trackalyzer.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.151.102.68 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.151.119.129 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.151.124.72 any $HOME_NET any (msg:"pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.151.74.209 any $HOME_NET any (msg:"aim4media.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.151.86.251 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.128.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.34.203 any $HOME_NET any (msg:"images.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.35.231 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.59.132 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.59.162 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.59.163 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.145 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.150 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.177 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.182 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.183 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.209 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.214 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.241 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.152.73.246 any $HOME_NET any (msg:"claria.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.154.80.72 any $HOME_NET any (msg:"hitbox.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.154.86.13 any $HOME_NET any (msg:"hitbox.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.156.11.200 any $HOME_NET any (msg:"pheedo.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.156.13.20 any $HOME_NET any (msg:"pgpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.156.13.50 any $HOME_NET any (msg:"pgpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.156.167.84 any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.156.167.85 any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.156.167.86 any $HOME_NET any (msg:"valueclickmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.156.240.38 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.156.26.74 any $HOME_NET any (msg:"adultadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.157.165.145 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.157.165.150 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.157.165.177 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.157.165.182 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.157.165.209 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.157.165.214 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.157.165.241 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.157.165.246 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.158.223.128 any $HOME_NET any (msg:"adfarm.mediaplex.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.158.223.150 any $HOME_NET any (msg:"adfarm.mediaplex.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.159.68.71 any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.159.93.205 any $HOME_NET any (msg:"oxcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.177.234.168 any $HOME_NET any (msg:"www.alladvantage.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.185.226.100 any $HOME_NET any (msg:"c.bigmir.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.185.226.101 any $HOME_NET any (msg:"bbn.img.com.ua"; classtype:trojan-activity; priority:1;)
alert tcp 64.185.237.17 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.186.56.73 any $HOME_NET any (msg:"popups.infostart.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.187.43.14 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.187.43.31 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.187.43.36 any $HOME_NET any (msg:"azoogleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.188.53.21 any $HOME_NET any (msg:"clickthruserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.188.59.165 any $HOME_NET any (msg:"blingbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.19.237.170 any $HOME_NET any (msg:"affiliatefuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.191.218.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.191.218.26 any $HOME_NET any (msg:"a.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.194.241.4 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.194.241.98 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.195.235.119 any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.33.115 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.33.131 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.33.3 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.33.4 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.43.107 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.49.210 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.54.67 any $HOME_NET any (msg:"adserver.startnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.60.106 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.60.98 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.60.99 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.20.62.35 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.202.167.128 any $HOME_NET any (msg:"images-pw.secureserver.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.202.167.192 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.202.167.3 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.202.189.110 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.202.189.170 any $HOME_NET any (msg:"twittad.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.207.133.96 any $HOME_NET any (msg:"reinvigorate.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.207.139.129 any $HOME_NET any (msg:"therichkids.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.137.250 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.137.251 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.192 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.193 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.194 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.195 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.196 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.197 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.198 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.199 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.200 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.201 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.202 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.203 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.206 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.207 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.208 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.209 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.214 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.215 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.216 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.217 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.218 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.219 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.220 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.221 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.223 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.224 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.225 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.226 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.227 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.228 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.229 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.23 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.24 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.27 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.28 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.29 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.138.30 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.178.22 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.42.55 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.208.42.56 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.209.230.200 any $HOME_NET any (msg:"adsoldier.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.209.232.100 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.209.232.207 any $HOME_NET any (msg:"ctxtads.overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.209.232.248 any $HOME_NET any (msg:"overture.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.21.150.123 any $HOME_NET any (msg:"www.photo-ads.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 64.21.174.250 any $HOME_NET any (msg:"crawlability.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.21.178.154 any $HOME_NET any (msg:"crazypopups.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.21.49.63 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.21.49.64 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.215.202.21 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 64.215.202.22 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 64.215.202.23 any $HOME_NET any (msg:"publicidad.elmundo.es"; classtype:trojan-activity; priority:1;)
alert tcp 64.22.121.100 any $HOME_NET any (msg:"prsitecheck.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.225.154.175 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.161.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.161.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.161.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.161.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.165.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.165.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.165.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.167.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.167.147 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.167.99 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.169.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.169.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.169.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.169.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.169.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.169.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.171.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.171.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.171.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.179.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.179.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.179.104 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.179.99 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.183.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.183.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.183.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.183.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.183.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.233.187.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.235.234.138 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.235.246.140 any $HOME_NET any (msg:"domainsponsor.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.235.246.143 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.235.246.160 any $HOME_NET any (msg:"information.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.235.246.234 any $HOME_NET any (msg:"revenue.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.235.246.61 any $HOME_NET any (msg:"information.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.235.246.62 any $HOME_NET any (msg:"revenue.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.101.13 any $HOME_NET any (msg:"adsonar.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.115.203 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.124.138 any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.124.21 any $HOME_NET any (msg:"adtech.de"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.124.228 any $HOME_NET any (msg:"adserver.aol.fr"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.124.229 any $HOME_NET any (msg:"adserver.aol.fr"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.79.207 any $HOME_NET any (msg:"advertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.88.203 any $HOME_NET any (msg:"perfiliate.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.92.59 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.236.92.67 any $HOME_NET any (msg:"ng3.ads.warnerbros.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.237.101.92 any $HOME_NET any (msg:"ads.raasnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.237.103.62 any $HOME_NET any (msg:"adjuggler.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.237.108.209 any $HOME_NET any (msg:"ad4game.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.237.59.105 any $HOME_NET any (msg:"adgoto.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.237.61.69 any $HOME_NET any (msg:"ads.silverdisc.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 64.237.99.81 any $HOME_NET any (msg:"adjuggler.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.239.183.120 any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.239.249.140 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.239.32.32 any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.241.74.201 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.243.174.101 any $HOME_NET any (msg:"banners.wunderground.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.243.175.108 any $HOME_NET any (msg:"as5000.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.243.175.128 any $HOME_NET any (msg:"as5000.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.244.29.120 any $HOME_NET any (msg:"ads.oneplace.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.244.29.201 any $HOME_NET any (msg:"ads2.oneplace.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.246.24.53 any $HOME_NET any (msg:"adserver.portalofevil.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.246.24.68 any $HOME_NET any (msg:"publishers.adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.246.25.209 any $HOME_NET any (msg:"i-clicks.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.246.26.16 any $HOME_NET any (msg:"rampidads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.246.44.60 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.246.46.107 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.246.46.90 any $HOME_NET any (msg:"impressionz.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 64.246.56.42 any $HOME_NET any (msg:"funpageexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.251.19.50 any $HOME_NET any (msg:"ads.vgchartz.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.254.227.23 any $HOME_NET any (msg:"adwitserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.255.164.20 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.255.166.7 any $HOME_NET any (msg:"ads.datinggold.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.255.172.197 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.255.172.50 any $HOME_NET any (msg:"cluster.adultworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.26.149.68 any $HOME_NET any (msg:"ads.totallyfreestuff.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.27.100.199 any $HOME_NET any (msg:"adblade.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.27.100.21 any $HOME_NET any (msg:"affiliate.doubleyourdating.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.27.100.214 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.27.100.254 any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.27.17.227 any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.27.17.233 any $HOME_NET any (msg:"clickhype.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.27.70.10 any $HOME_NET any (msg:"pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.27.90.240 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.28.86.230 any $HOME_NET any (msg:"ads.passion.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.29.137.108 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.29.138.105 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.29.211.69 any $HOME_NET any (msg:"findyourcasino.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.29.223.153 any $HOME_NET any (msg:"affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.29.223.70 any $HOME_NET any (msg:"ads.affiliates.match.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.29.29.36 any $HOME_NET any (msg:"top20free.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.30.224.111 any $HOME_NET any (msg:"bwp.download.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.30.224.114 any $HOME_NET any (msg:"adlog.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.30.224.117 any $HOME_NET any (msg:"rok.com.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.30.224.118 any $HOME_NET any (msg:"remotead.cnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.103.228 any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.105.163 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.110.179 any $HOME_NET any (msg:"ads.pof.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.119.12 any $HOME_NET any (msg:"ads.stackoverflow.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.165.238 any $HOME_NET any (msg:"adv.cooperhosting.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.173.229 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.174.159 any $HOME_NET any (msg:"ads.virtualcountries.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.174.26 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.177.59 any $HOME_NET any (msg:"ads.virtualcountries.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.182.22 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.182.23 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.184.26 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.194.75 any $HOME_NET any (msg:"ad1.emule-project.org"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.33.202 any $HOME_NET any (msg:"servedbyadbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.33.205 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.33.207 any $HOME_NET any (msg:"counter.sparklit.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.56.60 any $HOME_NET any (msg:"casinotraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.60.235 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.10 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.11 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.12 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.18 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.19 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.20 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.21 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.23 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.24 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.27 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.7 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.8 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.34.8.9 any $HOME_NET any (msg:"otto-images.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.37.114.86 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.37.199.107 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.20.21 any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.202.49 any $HOME_NET any (msg:"newnudecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.21.177 any $HOME_NET any (msg:"searchfeast.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.21.189 any $HOME_NET any (msg:"cbmall.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.226.6 any $HOME_NET any (msg:"maximumcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.232.180 any $HOME_NET any (msg:"newt1.adultworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.233.50 any $HOME_NET any (msg:"maximumcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.237.60 any $HOME_NET any (msg:"promo.ulust.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.239.26 any $HOME_NET any (msg:"maximumcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.29.126 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.31.201 any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.31.203 any $HOME_NET any (msg:"infolinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.41.20 any $HOME_NET any (msg:"searchfeast.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.41.57 any $HOME_NET any (msg:"advertising.guildlaunch.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.38.7.108 any $HOME_NET any (msg:"banners.isoftmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.4.18.40 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.4.62.121 any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.100.150 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.101.40 any $HOME_NET any (msg:"affiliates.thrixxx.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.102.41 any $HOME_NET any (msg:"exit76.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.102.44 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.102.46 any $HOME_NET any (msg:"hitfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.105.186 any $HOME_NET any (msg:"bidclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.105.187 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.108.17 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.111.23 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.114.128 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.116.35 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.40.118.59 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.41.191.100 any $HOME_NET any (msg:"ads.rediff.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.41.197.38 any $HOME_NET any (msg:"zedo.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.41.197.44 any $HOME_NET any (msg:"zedo.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.41.197.46 any $HOME_NET any (msg:"zedo.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.49.211.4 any $HOME_NET any (msg:"ads.einmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.49.214.42 any $HOME_NET any (msg:"spywarelabs.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.49.252.22 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.55.182.100 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.56.194.84 any $HOME_NET any (msg:"top20.travelzoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.56.205.73 any $HOME_NET any (msg:"affiliates.streamray.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.56.205.97 any $HOME_NET any (msg:"openads.friendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.56.67.229 any $HOME_NET any (msg:"neoffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.57.84.181 any $HOME_NET any (msg:"serv0.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.58.229.165 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.58.229.170 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.58.229.184 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.58.80.21 any $HOME_NET any (msg:"oascentral.chicagobusiness.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.58.80.26 any $HOME_NET any (msg:"a.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.58.80.28 any $HOME_NET any (msg:"ads.space.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.58.81.178 any $HOME_NET any (msg:"ads.rivals.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.6.17.5 any $HOME_NET any (msg:"partners.priceline.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.6.18.5 any $HOME_NET any (msg:"partners.priceline.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.6.28.5 any $HOME_NET any (msg:"partners.priceline.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.61.134.8 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.62.171.123 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.62.214.51 any $HOME_NET any (msg:"advertisespace.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.62.222.77 any $HOME_NET any (msg:"toprebates.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.62.232.32 any $HOME_NET any (msg:"cpxinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.62.232.4 any $HOME_NET any (msg:"budsinc.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.68.190.99 any $HOME_NET any (msg:"blast4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.216.107 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.219.119 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.219.123 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.35.191 any $HOME_NET any (msg:"avpa.javalobby.org"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.38.79 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.47.65 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.78.73 any $HOME_NET any (msg:"adbutler.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.79.206 any $HOME_NET any (msg:"ad-space.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.82.197 any $HOME_NET any (msg:"exitfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.86.199 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.86.200 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.86.201 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.69.86.203 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.7.192.236 any $HOME_NET any (msg:"yabuka.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.7.201.1 any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.7.203.60 any $HOME_NET any (msg:"nastydollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.7.203.69 any $HOME_NET any (msg:"hostedads.realitykings.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.7.203.70 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.7.207.114 any $HOME_NET any (msg:"clicks.equantum.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.70.42.47 any $HOME_NET any (msg:"ads.newdream.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.70.54.202 any $HOME_NET any (msg:"valueclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.70.54.44 any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.70.54.53 any $HOME_NET any (msg:"valueclickmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.70.54.71 any $HOME_NET any (msg:"zmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.70.54.78 any $HOME_NET any (msg:"cj.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.70.61.129 any $HOME_NET any (msg:"ads.ipowerweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.71.140.3 any $HOME_NET any (msg:"ads.virtualcountries.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.71.165.130 any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.71.165.157 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.71.187.181 any $HOME_NET any (msg:"sugoicounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.72.112.122 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.72.115.130 any $HOME_NET any (msg:"ads.kaktuz.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.108.71 any $HOME_NET any (msg:"mrskincash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.134.11 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.134.14 any $HOME_NET any (msg:"ads.vnumedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.134.61 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.134.64 any $HOME_NET any (msg:"ads.vnumedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.15.245 any $HOME_NET any (msg:"revsci.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.172.33 any $HOME_NET any (msg:"admedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.193.108 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.193.63 any $HOME_NET any (msg:"ads.itv.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.197.108 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.197.124 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.197.217 any $HOME_NET any (msg:"adsrv.bankrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.197.236 any $HOME_NET any (msg:"ads.cheapflights.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.197.63 any $HOME_NET any (msg:"ads.itv.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.210.12 any $HOME_NET any (msg:"stat.dealtime.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.210.13 any $HOME_NET any (msg:"stat.dealtime.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.1 any $HOME_NET any (msg:"bannerhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.10 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.103 any $HOME_NET any (msg:"onlinecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.11 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.30 any $HOME_NET any (msg:"pay-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.33 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.38 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.39 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.40 any $HOME_NET any (msg:"ad2flash.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.42 any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.7 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.223.9 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.96.241 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.74.96.243 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.77.50.10 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.161.69 any $HOME_NET any (msg:"specificpop.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.194.252 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.197.217 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.197.250 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.199.243 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.205.247 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.205.8 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.206.242 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.206.251 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.209.254 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.210.246 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.210.251 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.213.251 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.213.254 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.214.118 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.218.102 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.218.9 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.219.102 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.79.219.118 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.8.127.97 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.8.20.47 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.8.21.48 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.85.73.80 any $HOME_NET any (msg:"revenuedirect.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.86.101.22 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.86.101.6 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.87.9.107 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.247.114 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.247.58 any $HOME_NET any (msg:"ads.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.249.147 any $HOME_NET any (msg:"ads.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.249.50 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.249.51 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.250.156 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.250.157 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.250.173 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.250.37 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.251.39 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.158 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.160 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.163 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.165 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.166 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.167 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.168 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.169 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.178 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.179 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.181 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.217 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.252.227 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.254.18 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.254.53 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.254.54 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.88.254.55 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.89.19.145 any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.89.23.131 any $HOME_NET any (msg:"pimproll.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.90.175.199 any $HOME_NET any (msg:"marketing.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.90.175.2 any $HOME_NET any (msg:"marketing.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.90.175.200 any $HOME_NET any (msg:"ads.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.90.175.250 any $HOME_NET any (msg:"ads.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.90.186.67 any $HOME_NET any (msg:"ads.nyi.net"; classtype:trojan-activity; priority:1;)
alert tcp 64.93.77.223 any $HOME_NET any (msg:"content.ad"; classtype:trojan-activity; priority:1;)
alert tcp 64.93.77.226 any $HOME_NET any (msg:"content.ad"; classtype:trojan-activity; priority:1;)
alert tcp 64.93.79.195 any $HOME_NET any (msg:"matchcraft.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.11 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.12 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.13 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.14 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.15 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.16 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.17 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.18 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.19 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.20 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.21 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.22 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.23 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.24 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.25 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.26 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.27 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.28 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.29 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.30 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.31 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.32 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.33 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.34 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.35 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.36 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.37 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.38 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.39 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.40 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.41 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.42 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.43 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.44 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.45 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.46 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.47 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.48 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.49 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.50 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.51 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.52 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.53 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.54 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.55 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.56 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.57 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.58 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.59 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.60 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.61 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.62 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.63 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.64 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.65 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.107.66 any $HOME_NET any (msg:"quantserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.137.52 any $HOME_NET any (msg:"180searchassistant.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.137.63 any $HOME_NET any (msg:"180searchassistant.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.178.75 any $HOME_NET any (msg:"stat.dealtime.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.186.12 any $HOME_NET any (msg:"stat.dealtime.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.191.172 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.191.174 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.26.104 any $HOME_NET any (msg:"ads.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.26.113 any $HOME_NET any (msg:"click.fool.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.29.11 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.29.14 any $HOME_NET any (msg:"ads.vnumedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.29.61 any $HOME_NET any (msg:"newnet.qsrch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.29.64 any $HOME_NET any (msg:"casalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.94.89.201 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.116.148 any $HOME_NET any (msg:"ads.techtv.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.25.200 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.25.208 any $HOME_NET any (msg:"industrybrains.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.189 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.190 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.191 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.194 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.195 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.197 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.198 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.218 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.219 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.95.64.223 any $HOME_NET any (msg:"whispa.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.99.128.7 any $HOME_NET any (msg:"counts.tucows.com"; classtype:trojan-activity; priority:1;)
alert tcp 64.99.80.30 any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.105.124.118 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.105.124.60 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.108.78.72 any $HOME_NET any (msg:"alladvantage.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.110.169.132 any $HOME_NET any (msg:"optmd.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.110.6.8 any $HOME_NET any (msg:"ad-space.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.111.164.30 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 65.111.186.138 any $HOME_NET any (msg:"ads.vgchartz.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.113.112.23 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.118.76.5 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.119.213.35 any $HOME_NET any (msg:"tribalfusion.speedera.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.119.213.36 any $HOME_NET any (msg:"tribalfusion.speedera.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.120.124.135 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.120.124.151 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.120.124.167 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.121.237.200 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.124.207.42 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.126.3.40 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.127.237.162 any $HOME_NET any (msg:"justwebads.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.161.177.67 any $HOME_NET any (msg:"the-counter.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.165.64.131 any $HOME_NET any (msg:"adcomplete.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.167.65.100 any $HOME_NET any (msg:"clickserve.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.167.65.49 any $HOME_NET any (msg:"ads.cc-dt.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.169.109.12 any $HOME_NET any (msg:"kanoodle.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.169.109.22 any $HOME_NET any (msg:"kanoodle.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.169.109.23 any $HOME_NET any (msg:"partner1.kanoodle.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.17.196.170 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.17.198.120 any $HOME_NET any (msg:"adtrak.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.17.208.214 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.17.235.80 any $HOME_NET any (msg:"adnetinteractive.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.17.236.38 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.18.168.214 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.18.170.82 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.18.173.137 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 65.18.173.139 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 65.18.173.141 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.18.192.49 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 65.181.170.140 any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.198.115.19 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.199.10.123 any $HOME_NET any (msg:"adtegrity.thruport.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.203.229.118 any $HOME_NET any (msg:"avenuea.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.203.229.212 any $HOME_NET any (msg:"ads.apn.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 65.203.229.225 any $HOME_NET any (msg:"adsrv.bankrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.203.229.90 any $HOME_NET any (msg:"bidclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.203.232.12 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.203.232.9 any $HOME_NET any (msg:"ads.adultfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.203.241.137 any $HOME_NET any (msg:"ads.cheapflights.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.205.8.13 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.205.8.188 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.207.183.11 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.207.183.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.207.183.122 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.208.179.196 any $HOME_NET any (msg:"partner.topcities.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.209.3.232 any $HOME_NET any (msg:"partner1.kanoodle.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.212.118.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.212.118.21 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.212.118.22 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.212.121.121 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.212.121.21 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.212.121.22 any $HOME_NET any (msg:"adstest.weather.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.216.123.160 any $HOME_NET any (msg:"trafficmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.23.157.190 any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.241.50.20 any $HOME_NET any (msg:"pgpartner.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.242.27.119 any $HOME_NET any (msg:"ads.cheapflights.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.242.27.138 any $HOME_NET any (msg:"adsrv.bankrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.242.27.40 any $HOME_NET any (msg:"atdmt.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.245.193.28 any $HOME_NET any (msg:"trafficstrategies.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.248.62.160 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.254.229.220 any $HOME_NET any (msg:"affiliates.globat.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.254.248.135 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.254.248.137 any $HOME_NET any (msg:"therichkids.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.254.32.138 any $HOME_NET any (msg:"media-servers.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.254.37.222 any $HOME_NET any (msg:"easyhits4u.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.254.39.234 any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.255.32.5 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.36.152.16 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.38.107.197 any $HOME_NET any (msg:"admex.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.38.113.13 any $HOME_NET any (msg:"advertisingbanners.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.38.167.206 any $HOME_NET any (msg:"mypowermall.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.148.42 any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.148.43 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.148.50 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.176.100 any $HOME_NET any (msg:"bravenet.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.176.37 any $HOME_NET any (msg:"adserv2.bravenet.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.205.54 any $HOME_NET any (msg:"adsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.205.61 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.211.106 any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.39.243.210 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.49.35.141 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.49.35.158 any $HOME_NET any (msg:"snapads.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.50.210.132 any $HOME_NET any (msg:"ads.electrocelt.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.52.100.46 any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.52.107.149 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.54.192.248 any $HOME_NET any (msg:"popup.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.54.194.102 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.54.194.117 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.54.194.118 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.54.195.185 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.54.195.187 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.54.77.92 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.119.24 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.121.231 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.121.232 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.121.233 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.149.119 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.15.122 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.15.123 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.15.124 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.15.125 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.15.241 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.15.242 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.15.243 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.15.244 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.175.254 any $HOME_NET any (msg:"adserver.bing.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.192.10 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.197.114 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.197.115 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.197.125 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.197.126 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.197.247 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.197.248 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.197.254 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.239.161 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.239.189 any $HOME_NET any (msg:"analytics.live.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.249.222 any $HOME_NET any (msg:"adecn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.249.67 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.249.68 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.33.38 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.35.15 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.36.21 any $HOME_NET any (msg:"rmads.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.39.12 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.5.231 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.5.232 any $HOME_NET any (msg:"rad.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.55.5.233 any $HOME_NET any (msg:"arc1.msn.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.59.207.13 any $HOME_NET any (msg:"m.doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.60.52.90 any $HOME_NET any (msg:"all4spy.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.61.146.199 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.61.156.42 any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.61.156.44 any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.61.157.153 any $HOME_NET any (msg:"adserver.sharewareonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.61.157.55 any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.61.166.78 any $HOME_NET any (msg:"web-stat.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.74.135.110 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.74.156.180 any $HOME_NET any (msg:"bidclix.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.74.174.222 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.75.162.56 any $HOME_NET any (msg:"linkswaper.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.75.172.215 any $HOME_NET any (msg:""; classtype:trojan-activity; priority:1;)
alert tcp 65.98.53.169 any $HOME_NET any (msg:"discountclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 65.99.198.162 any $HOME_NET any (msg:"admotion.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp 65.99.198.180 any $HOME_NET any (msg:"admotion.com.ar"; classtype:trojan-activity; priority:1;)
alert tcp 65.99.207.66 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.99.253.170 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp 65.99.253.174 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.101.153.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.1.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.1.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.1.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.1.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.11.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.11.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.11.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.11.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.13.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.13.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.13.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.13.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.13.132 any $HOME_NET any (msg:"ads.gmodules.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.13.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.13.139 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.15.106 any $HOME_NET any (msg:"stats.blogger.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.138 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.102.9.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.103.147.146 any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.103.154.100 any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.11.114.254 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.11.12.154 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.11.129.254 any $HOME_NET any (msg:"4affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.11.147.69 any $HOME_NET any (msg:"ads.totallyfreestuff.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.11.150.24 any $HOME_NET any (msg:"ads.totallyfreestuff.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.11.225.247 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.111.40.193 any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.113.130.167 any $HOME_NET any (msg:"rapidcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.113.130.222 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.114.252.218 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.114.252.228 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.114.48.50 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.114.49.157 any $HOME_NET any (msg:"crtv.mate1.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.114.49.165 any $HOME_NET any (msg:"bannershotlink.perfectgonzo.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.130.28 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.133.96 any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.138.120 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.153.193 any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.173.14 any $HOME_NET any (msg:"spacash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.173.169 any $HOME_NET any (msg:"bannieres.acces-contenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.173.174 any $HOME_NET any (msg:"bannieres.acces-contenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.173.83 any $HOME_NET any (msg:"spacash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.176.170 any $HOME_NET any (msg:"bannieres.acces-contenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.115.189.227 any $HOME_NET any (msg:"lightspeedcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.101 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.103 any $HOME_NET any (msg:"adimages.been.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.109 any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.16 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.29 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.35 any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.36 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.39 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.41 any $HOME_NET any (msg:"actionsplash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.44 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.50 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.53 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.56 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.60 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.62 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.63 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.109.70 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.112 any $HOME_NET any (msg:"exchangeclicksonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.121 any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.150 any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.156 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.170 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.219 any $HOME_NET any (msg:"click2freemoney.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.225 any $HOME_NET any (msg:"starffa.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.228 any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.230 any $HOME_NET any (msg:"adimages.been.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.46 any $HOME_NET any (msg:"traffic-exchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.47 any $HOME_NET any (msg:"ads.smartclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.55 any $HOME_NET any (msg:"actionsplash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.116.125.90 any $HOME_NET any (msg:"link4ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.117.3.14 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.117.3.20 any $HOME_NET any (msg:"linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.117.3.40 any $HOME_NET any (msg:"banners.linkbuddies.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.117.38.114 any $HOME_NET any (msg:"mocean.mobi"; classtype:trojan-activity; priority:1;)
alert tcp 66.117.59.106 any $HOME_NET any (msg:"mocean.mobi"; classtype:trojan-activity; priority:1;)
alert tcp 66.117.59.148 any $HOME_NET any (msg:"mocean.mobi"; classtype:trojan-activity; priority:1;)
alert tcp 66.118.145.47 any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.118.157.192 any $HOME_NET any (msg:"adultadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.118.182.112 any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.118.182.73 any $HOME_NET any (msg:"addfreestats.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.119.14.145 any $HOME_NET any (msg:"affiliate.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.119.14.240 any $HOME_NET any (msg:"openad.travelnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.119.140.211 any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.119.142.95 any $HOME_NET any (msg:"webstat.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.119.39.133 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.128.155.138 any $HOME_NET any (msg:"adinjector.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.129.67.103 any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.129.68.152 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.129.71.126 any $HOME_NET any (msg:"ads.aspalliance.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.132.173.16 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.132.216.164 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.132.236.189 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.132.240.18 any $HOME_NET any (msg:"trafficswarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.135.32.7 any $HOME_NET any (msg:"supertop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.135.34.13 any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.135.39.135 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.135.39.32 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.135.40.162 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.139.79.94 any $HOME_NET any (msg:"supertop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.147.244.142 any $HOME_NET any (msg:"trafficsecrets.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.148.73.74 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.148.87.153 any $HOME_NET any (msg:"advertmedia.de"; classtype:trojan-activity; priority:1;)
alert tcp 66.15.159.242 any $HOME_NET any (msg:"adcycle.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.15.30.41 any $HOME_NET any (msg:"adcycle.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.114.21 any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.14.21 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.14.22 any $HOME_NET any (msg:"zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.14.49 any $HOME_NET any (msg:"zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.14.58 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.14.60 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.14.61 any $HOME_NET any (msg:"static.zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.161.135 any $HOME_NET any (msg:"banner.orb.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.161.140 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.161.141 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.161.44 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.167.152 any $HOME_NET any (msg:"ads.groundspeak.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.192.202 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.208.106 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.208.54 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.208.55 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.208.9 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.217.12 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.217.4 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.150.217.7 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.148.193 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.179.147 any $HOME_NET any (msg:"24pm-affiliation.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.181.32 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.181.33 any $HOME_NET any (msg:"premium-offers.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.183.102 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.183.43 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.183.66 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.183.67 any $HOME_NET any (msg:"rmedia.boston.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.244.162 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.244.166 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.244.210 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.244.211 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.244.212 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.244.27 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.244.28 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.244.29 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.151.61.53 any $HOME_NET any (msg:"rubiconproject.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.152.78.141 any $HOME_NET any (msg:"adxpansion.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.152.78.246 any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.152.85.202 any $HOME_NET any (msg:"whenu.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.152.88.186 any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.152.88.200 any $HOME_NET any (msg:"braincash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.152.93.130 any $HOME_NET any (msg:"mediatext.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.152.97.130 any $HOME_NET any (msg:"ads.powweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.154.105.183 any $HOME_NET any (msg:"cecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.154.16.118 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.154.69.157 any $HOME_NET any (msg:"fpctraffic2.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.155.11.250 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.155.9.250 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.159.17.64 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.161.20.33 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.161.36.111 any $HOME_NET any (msg:"hitslink.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.165.186.100 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.17.144.153 any $HOME_NET any (msg:"affiliate.viator.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.171.184.34 any $HOME_NET any (msg:"www.photo-ads.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 66.171.230.147 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 66.171.230.210 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 66.172.61.202 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.175.211.95 any $HOME_NET any (msg:"media6degrees.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.107.37 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.107.41 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.107.44 any $HOME_NET any (msg:"ads.mediaodyssey.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.152.120 any $HOME_NET any (msg:"ads.oneplace.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.152.121 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.152.184 any $HOME_NET any (msg:"ads.townhall.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.152.201 any $HOME_NET any (msg:"ads2.oneplace.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.17.187 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.188.1 any $HOME_NET any (msg:"directtrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.188.61 any $HOME_NET any (msg:"directleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.227.20 any $HOME_NET any (msg:"ads.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.230.76 any $HOME_NET any (msg:"images.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.48.110 any $HOME_NET any (msg:"spinbox.versiontracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.179.5.44 any $HOME_NET any (msg:"coremetrics.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.18.76.74 any $HOME_NET any (msg:"banner.img.co.za"; classtype:trojan-activity; priority:1;)
alert tcp 66.18.76.85 any $HOME_NET any (msg:"ads.img.co.za"; classtype:trojan-activity; priority:1;)
alert tcp 66.18.76.86 any $HOME_NET any (msg:"banner.img.co.za"; classtype:trojan-activity; priority:1;)
alert tcp 66.180.204.130 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.180.230.100 any $HOME_NET any (msg:"bravenet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.180.230.37 any $HOME_NET any (msg:"linktrack.bravenet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.181.160.131 any $HOME_NET any (msg:"sexcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.181.168.114 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.181.168.117 any $HOME_NET any (msg:"xq1.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.181.171.66 any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.186.10.196 any $HOME_NET any (msg:"partner.topcities.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.192.130.222 any $HOME_NET any (msg:"primaryads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.192.130.249 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.192.130.250 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.192.130.251 any $HOME_NET any (msg:"primaryads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.192.130.252 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.194.37.33 any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.194.38.206 any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.194.38.28 any $HOME_NET any (msg:"advnt.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.196.65.174 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.196.65.188 any $HOME_NET any (msg:"ads.yimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.197.222.5 any $HOME_NET any (msg:"midnightclicking.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.197.77.191 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.199.141.53 any $HOME_NET any (msg:"casalemedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.199.155.194 any $HOME_NET any (msg:"banner.casinodelrio.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.199.180.175 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.199.187.168 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.199.187.181 any $HOME_NET any (msg:"realclix.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.199.187.182 any $HOME_NET any (msg:"exitfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.201.203.154 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.201.42.4 any $HOME_NET any (msg:"ads.electrocelt.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.207.130.76 any $HOME_NET any (msg:"barnesandnoble.bfast.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.207.195.198 any $HOME_NET any (msg:"richwebmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.212.232.240 any $HOME_NET any (msg:"inspectorclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.212.232.4 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.212.235.221 any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.212.242.247 any $HOME_NET any (msg:"banner.goldenpalace.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.216.103.189 any $HOME_NET any (msg:"adreporting.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.216.104.184 any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.216.74.57 any $HOME_NET any (msg:"intelliads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.216.74.58 any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.216.84.115 any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.216.92.136 any $HOME_NET any (msg:"exit76.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.216.94.73 any $HOME_NET any (msg:"admarketplace.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.216.97.175 any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.218.180.100 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.218.65.230 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.218.65.231 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.218.77.64 any $HOME_NET any (msg:"visit.webhosting.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.220.17.151 any $HOME_NET any (msg:"lop.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.220.17.153 any $HOME_NET any (msg:"lop.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.220.2.20 any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.220.2.7 any $HOME_NET any (msg:"ad.keenspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.223.110.65 any $HOME_NET any (msg:"revstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.226.4.34 any $HOME_NET any (msg:"affiliates.internationaljock.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.226.8.150 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.227.96.173 any $HOME_NET any (msg:"ad.simgames.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.228.194.18 any $HOME_NET any (msg:"traffictrader.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.228.45.75 any $HOME_NET any (msg:"tyroo.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.228.48.28 any $HOME_NET any (msg:"advertise.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.23.226.207 any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.135.58 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.153.150 any $HOME_NET any (msg:"ads180.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.158.246 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.158.38 any $HOME_NET any (msg:"counted.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.168.14 any $HOME_NET any (msg:"oxcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.169.2 any $HOME_NET any (msg:"www.kaplanindex.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.173.244 any $HOME_NET any (msg:"realcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.173.254 any $HOME_NET any (msg:"realcastmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.192.41 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.226.27 any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;)
alert tcp 66.230.239.174 any $HOME_NET any (msg:"zeus.developershed.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.231.185.75 any $HOME_NET any (msg:"clickhype.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.231.185.81 any $HOME_NET any (msg:"clickhype.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.232.154.27 any $HOME_NET any (msg:"oas.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.232.154.29 any $HOME_NET any (msg:"oas.foxnews.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.232.96.122 any $HOME_NET any (msg:"adshost1.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.126.61 any $HOME_NET any (msg:"i1img.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.126.71 any $HOME_NET any (msg:"ads.iwon.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.132.118 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.132.121 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.132.152 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.132.188 any $HOME_NET any (msg:"offermatica.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.132.232 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.132.91 any $HOME_NET any (msg:"touchclarity.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.133.1 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.133.11 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.133.14 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.133.33 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.133.52 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.133.62 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.133.8 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.134.160 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.1 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.18 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.19 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.192 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.193 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.194 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.195 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.2 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.224 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.225 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.226 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.3 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.44 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.138.59 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.110 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.118 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.121 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.152 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.153 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.166 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.180 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.204 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.205 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.206 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.207 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.54 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.62 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.139.70 any $HOME_NET any (msg:"webstat.channel4.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.141.144 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.141.145 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.141.16 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.141.17 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.142.1 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.142.14 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.142.2 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.142.20 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.142.24 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.142.3 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.142.57 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.142.58 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.143.118 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.143.121 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.143.54 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.143.62 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.143.70 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.148.88 any $HOME_NET any (msg:"ad.auditude.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.155.19 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.155.28 any $HOME_NET any (msg:"metrics.windowsitpro.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.160.74 any $HOME_NET any (msg:"affiliates.thinkhost.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.184.104 any $HOME_NET any (msg:"ads.gamershell.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.235.214.252 any $HOME_NET any (msg:"linkreferral.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.236.129.73 any $HOME_NET any (msg:"ads.asiafriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.240.165.115 any $HOME_NET any (msg:"affiliates.ultrahosting.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.240.173.8 any $HOME_NET any (msg:"adclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.240.252.32 any $HOME_NET any (msg:"ads.linuxjournal.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.244.151.241 any $HOME_NET any (msg:"juicyads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.246.235.131 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.246.235.44 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.246.235.59 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.17.46 any $HOME_NET any (msg:"trafficz.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.4.125 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.4.198 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.4.207 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.4.244 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.8.122 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.8.29 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.8.30 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.8.6 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.8.7 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.91.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.93.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.93.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.93.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.249.93.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.250.107.191 any $HOME_NET any (msg:"webangel.ru"; classtype:trojan-activity; priority:1;)
alert tcp 66.250.64.24 any $HOME_NET any (msg:"ad.choiceradio.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.252.159.51 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 66.252.159.52 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 66.252.2.27 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 66.254.100.195 any $HOME_NET any (msg:"ads2.brazzers.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.254.100.198 any $HOME_NET any (msg:"trafficjunky.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.104.24 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.104.28 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.107.34 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.139.100 any $HOME_NET any (msg:"ientrymail.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.139.35 any $HOME_NET any (msg:"600z.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.237.11 any $HOME_NET any (msg:"trekblue.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.237.138 any $HOME_NET any (msg:"elitetoplist.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.237.15 any $HOME_NET any (msg:"trekdata.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.250.173 any $HOME_NET any (msg:"banners.wunderground.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.32.118 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.32.70 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.60.100 any $HOME_NET any (msg:"ads.newgrounds.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.60.104 any $HOME_NET any (msg:"ads.newgrounds.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.69.137 any $HOME_NET any (msg:"banners.wunderground.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.28.69.150 any $HOME_NET any (msg:"as5000.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.29.43.7 any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.33.110.32 any $HOME_NET any (msg:"i-clicks.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.33.193.195 any $HOME_NET any (msg:"counter.dreamhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.33.201.133 any $HOME_NET any (msg:"ads.newdream.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.33.206.59 any $HOME_NET any (msg:"ads.newdream.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.33.206.60 any $HOME_NET any (msg:"ads.newdream.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.33.216.70 any $HOME_NET any (msg:"counter.dreamhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.33.255.75 any $HOME_NET any (msg:"websponsors.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.35.110.180 any $HOME_NET any (msg:"blast4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.35.110.72 any $HOME_NET any (msg:"blast4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.35.111.120 any $HOME_NET any (msg:"blast4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.35.111.135 any $HOME_NET any (msg:"blast4traffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.35.229.145 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.35.229.177 any $HOME_NET any (msg:"dist.belnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.36.242.227 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.39.107.246 any $HOME_NET any (msg:"ad.twitchguru.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.40.56.64 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.40.66.17 any $HOME_NET any (msg:"counter.fateback.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.104.150 any $HOME_NET any (msg:"adjuggler.yourdictionary.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.123.238 any $HOME_NET any (msg:"ads.heartlight.org"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.232.66 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.232.75 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.237.187 any $HOME_NET any (msg:"cash4banner.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.237.99 any $HOME_NET any (msg:"adserver.startnow.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.239.146 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.240.180 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.246.138 any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.246.139 any $HOME_NET any (msg:"banner.webmersion.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.247.158 any $HOME_NET any (msg:"rampidads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.252.236 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.252.237 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.254.244 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.45.254.245 any $HOME_NET any (msg:"cashpartner.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.46.150.29 any $HOME_NET any (msg:"ac.rnm.ca"; classtype:trojan-activity; priority:1;)
alert tcp 66.48.78.201 any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.48.78.205 any $HOME_NET any (msg:"adsrevenue.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.48.78.209 any $HOME_NET any (msg:"clicksor.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.48.78.246 any $HOME_NET any (msg:"clicksor.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.48.78.249 any $HOME_NET any (msg:"yesads.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.48.81.155 any $HOME_NET any (msg:"clicksor.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.48.97.11 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.48.97.14 any $HOME_NET any (msg:"casinotreasure.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.51.97.131 any $HOME_NET any (msg:"investopedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.54.16.42 any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.54.16.45 any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.54.32.235 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.54.32.244 any $HOME_NET any (msg:"ads.usatoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.54.33.109 any $HOME_NET any (msg:"www.dnps.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.54.5.97 any $HOME_NET any (msg:"advert.bayarea.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.129.226 any $HOME_NET any (msg:"sexcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.134.194 any $HOME_NET any (msg:"proton-tm.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.135.184 any $HOME_NET any (msg:"banners.videosz.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.141.20 any $HOME_NET any (msg:"ads03.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.141.21 any $HOME_NET any (msg:"ads03.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.141.50 any $HOME_NET any (msg:"ads.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.141.51 any $HOME_NET any (msg:"ads.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.144.206 any $HOME_NET any (msg:"ads.redtube.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.55.147.179 any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.59.45.145 any $HOME_NET any (msg:"affiliate.viator.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.59.66.6 any $HOME_NET any (msg:"ads.okcimg.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.10 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.13 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.14 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.146 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.147 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.148 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.149 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.15 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.150 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.158 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.159 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.16 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.17 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.18 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.21 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.22 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.23 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.237 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.238 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.239 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.24 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.25 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.26 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.27 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.28 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.29 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.30 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.31 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.40 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.41 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.42 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.43 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.44 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.45 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.46 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.49 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.51 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.53 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.54 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.56 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.57 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.60 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.62 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.67 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.68 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.69 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.70 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.71 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.72 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.74 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.75 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.76 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.78 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.79 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.8 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.80 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.18.9 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.19.21 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.19.22 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.19.29 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.19.41 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.19.42 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.20.240 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.20.241 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.20.243 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.21.76 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.21.77 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.21.78 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.21.79 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.21.80 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.6.21.81 any $HOME_NET any (msg:"pcash.imlive.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.7.159.242 any $HOME_NET any (msg:"leadclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.7.179.198 any $HOME_NET any (msg:"onlinerewardcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.119.205 any $HOME_NET any (msg:"eurekster.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.16.150 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.20.60 any $HOME_NET any (msg:"textlinks.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.21.80 any $HOME_NET any (msg:"popuptraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.28.40 any $HOME_NET any (msg:"fineclicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.45.190 any $HOME_NET any (msg:"clicktracks.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.55.200 any $HOME_NET any (msg:"validclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.55.201 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.64.60 any $HOME_NET any (msg:"oas.villagevoice.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.65.195 any $HOME_NET any (msg:"checkm8.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.68.147 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.70.91.44 any $HOME_NET any (msg:"clickhereforcellphones.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.71.247.134 any $HOME_NET any (msg:"adsystem.simplemachines.org"; classtype:trojan-activity; priority:1;)
alert tcp 66.71.247.135 any $HOME_NET any (msg:"adsystem.simplemachines.org"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.141.20 any $HOME_NET any (msg:"paycounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.211.100 any $HOME_NET any (msg:"affiliatefuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.24.11 any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.24.4 any $HOME_NET any (msg:"cookies.cmpnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.3.50 any $HOME_NET any (msg:"channelintelligence.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.93.20 any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.93.21 any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.93.40 any $HOME_NET any (msg:"101com.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.77.96.230 any $HOME_NET any (msg:"start.freeze.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.78.30.146 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.79.10.211 any $HOME_NET any (msg:"banners.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.79.165.40 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.79.165.49 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.79.166.101 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 66.79.177.160 any $HOME_NET any (msg:"euros4click.de"; classtype:trojan-activity; priority:1;)
alert tcp 66.79.180.50 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.79.189.134 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.79.191.231 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.9.53.130 any $HOME_NET any (msg:"ad.uk.tangozebra.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.90.102.153 any $HOME_NET any (msg:"ads.goyk.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.90.102.32 any $HOME_NET any (msg:"ads.goyk.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.90.102.33 any $HOME_NET any (msg:"ads.goyk.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.96.130.201 any $HOME_NET any (msg:"ads.ipowerweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.96.25.240 any $HOME_NET any (msg:"richwebmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.96.25.44 any $HOME_NET any (msg:"richwebmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.96.25.46 any $HOME_NET any (msg:"richwebmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.96.25.58 any $HOME_NET any (msg:"richwebmaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.98.134.100 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.98.164.58 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 66.98.176.64 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.98.186.36 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.98.208.60 any $HOME_NET any (msg:"paypopup.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.98.244.52 any $HOME_NET any (msg:"a.consumer.net"; classtype:trojan-activity; priority:1;)
alert tcp 66.98.246.45 any $HOME_NET any (msg:"topmmorpgsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 66.98.247.29 any $HOME_NET any (msg:"xtremetop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.111.153.14 any $HOME_NET any (msg:"ads.linuxsecurity.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.121.212.61 any $HOME_NET any (msg:"adjix.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.139.254.130 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.139.254.131 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.139.254.134 any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.139.254.135 any $HOME_NET any (msg:"clickbank.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.139.254.137 any $HOME_NET any (msg:"clickbank.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.119.33 any $HOME_NET any (msg:"anahtars.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.132.11 any $HOME_NET any (msg:"ads.cgnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.132.12 any $HOME_NET any (msg:"ads.cgnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.132.4 any $HOME_NET any (msg:"ads.cgnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.149.163 any $HOME_NET any (msg:"gostats.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.168.135 any $HOME_NET any (msg:"incentaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.168.172 any $HOME_NET any (msg:"incentaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.18.186 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.18.36 any $HOME_NET any (msg:"advertising.se"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.18.6 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.180.238 any $HOME_NET any (msg:"crispads.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.205.4 any $HOME_NET any (msg:"idcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.208.203 any $HOME_NET any (msg:"freeonlineusers.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.22.17 any $HOME_NET any (msg:"avres.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.221.147 any $HOME_NET any (msg:"histats.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.24.103 any $HOME_NET any (msg:"trafficsecrets.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.35.179 any $HOME_NET any (msg:"bigbangmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.35.53 any $HOME_NET any (msg:"bannerhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.36.33 any $HOME_NET any (msg:"microstatic.pl"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.52.51 any $HOME_NET any (msg:"banners.sys-con.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.56.137 any $HOME_NET any (msg:"chitika.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.58.29 any $HOME_NET any (msg:"gamesites100.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.68.51 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.68.54 any $HOME_NET any (msg:"ads.harpers.org"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.76.201 any $HOME_NET any (msg:"bannerserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.77.192 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.82.61 any $HOME_NET any (msg:"adserver.portalofevil.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.15.94.25 any $HOME_NET any (msg:"xchange.ro"; classtype:trojan-activity; priority:1;)
alert tcp 67.161.2.70 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.170.221.47 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.170.82.122 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.170.83.157 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.147.218 any $HOME_NET any (msg:"funpageexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.19.178 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.216.114 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.224.74 any $HOME_NET any (msg:"hitiz.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.247.122 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.31.86 any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.39.141 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.54.31 any $HOME_NET any (msg:"gator.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.54.53 any $HOME_NET any (msg:"gator.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.81.178 any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.18.90.133 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.188.92.12 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.19.124.187 any $HOME_NET any (msg:"e-planning.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.19.129.190 any $HOME_NET any (msg:"buyhitscheap.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.19.146.35 any $HOME_NET any (msg:"urlcash.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.19.19.130 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.19.197.162 any $HOME_NET any (msg:"sponsors.thoughtsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.19.212.250 any $HOME_NET any (msg:"bluekai.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.19.248.186 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.19.47.29 any $HOME_NET any (msg:"neoffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.11.92 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.11.95 any $HOME_NET any (msg:"gamesites200.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.173.112 any $HOME_NET any (msg:"sexinyourcity.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.42.19 any $HOME_NET any (msg:"adv-adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.42.23 any $HOME_NET any (msg:"adv-adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.42.28 any $HOME_NET any (msg:"adv-adserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.6.217 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.6.223 any $HOME_NET any (msg:"commissionmonster.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.87.123 any $HOME_NET any (msg:"pointroll.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.192.92.227 any $HOME_NET any (msg:"ad.auditude.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.195.6.198 any $HOME_NET any (msg:"adserver.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.195.61.65 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.199.128.19 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.199.128.43 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.199.128.44 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.199.128.48 any $HOME_NET any (msg:"ads.seniorfriendfinder.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.20.57.39 any $HOME_NET any (msg:"caniamedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.201.14.126 any $HOME_NET any (msg:"caniamedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.201.36.204 any $HOME_NET any (msg:"namimedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.201.36.205 any $HOME_NET any (msg:"therapistla.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.201.52.101 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.201.52.148 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.201.52.201 any $HOME_NET any (msg:"bizrate.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.202.31.193 any $HOME_NET any (msg:"admeld.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.202.5.28 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.202.94.71 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;)
alert tcp 67.202.94.86 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;)
alert tcp 67.202.94.87 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;)
alert tcp 67.202.94.93 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;)
alert tcp 67.202.94.94 any $HOME_NET any (msg:"amung.us"; classtype:trojan-activity; priority:1;)
alert tcp 67.203.22.40 any $HOME_NET any (msg:"realtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.205.1.8 any $HOME_NET any (msg:"ultramercial.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.205.54.21 any $HOME_NET any (msg:"adnetwork.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.205.63.30 any $HOME_NET any (msg:"retargeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.207.222.205 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.208.131.127 any $HOME_NET any (msg:"tracking.gajmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.211.111.169 any $HOME_NET any (msg:"clickedyclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.212.92.251 any $HOME_NET any (msg:"cibleclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.214.159.118 any $HOME_NET any (msg:"adsdaq.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.214.159.120 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.214.159.86 any $HOME_NET any (msg:"contextweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.215.173.124 any $HOME_NET any (msg:"tvmtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.215.173.231 any $HOME_NET any (msg:"zantracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.215.174.121 any $HOME_NET any (msg:"zantracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.215.246.202 any $HOME_NET any (msg:"ads.bittorrent.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.215.253.138 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.215.6.84 any $HOME_NET any (msg:"qctop.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.216.179.138 any $HOME_NET any (msg:"robotreplay.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.217.168.212 any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.217.168.213 any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.217.168.214 any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.217.184.239 any $HOME_NET any (msg:"ad.bnmla.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.220.140.59 any $HOME_NET any (msg:"ads.datinggold.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.220.140.62 any $HOME_NET any (msg:"ads.datinggold.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.220.194.133 any $HOME_NET any (msg:"123found.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.221.235.201 any $HOME_NET any (msg:"apture.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.103.233 any $HOME_NET any (msg:"performancing.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.132.193 any $HOME_NET any (msg:"a.consumer.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.132.195 any $HOME_NET any (msg:"a.consumer.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.132.199 any $HOME_NET any (msg:"a.consumer.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.151.138 any $HOME_NET any (msg:"midnightclicking.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.152.74 any $HOME_NET any (msg:"class-act-clicks.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.155.114 any $HOME_NET any (msg:"midnightclicking.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.158.75 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 67.222.30.119 any $HOME_NET any (msg:"hitiz.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.223.225.253 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.223.226.253 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.223.229.232 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.223.229.28 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.223.229.29 any $HOME_NET any (msg:"targetnet.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.225.180.208 any $HOME_NET any (msg:"adimpact.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.225.181.136 any $HOME_NET any (msg:"adimpact.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.225.184.114 any $HOME_NET any (msg:"dealdotcom.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.225.190.36 any $HOME_NET any (msg:"bluewhaleweb.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.227.236.73 any $HOME_NET any (msg:"adcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.227.236.89 any $HOME_NET any (msg:"adcash.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.227.245.180 any $HOME_NET any (msg:"topsafelist.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.115.163 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.115.164 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.128.231 any $HOME_NET any (msg:"havamedia.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.151.66 any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.151.67 any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.151.68 any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.151.69 any $HOME_NET any (msg:"web.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.161.73 any $HOME_NET any (msg:"mdotm.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.162.200 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.163.216 any $HOME_NET any (msg:"softclick.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.17.235 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.183.35 any $HOME_NET any (msg:"clustrmaps.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.186.42 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.186.43 any $HOME_NET any (msg:"mixpanel.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.205.131 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.22.210 any $HOME_NET any (msg:"hits.informer.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.226.99 any $HOME_NET any (msg:"adserver.bizhat.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.235.91 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.228.81.217 any $HOME_NET any (msg:"wmirk.ru"; classtype:trojan-activity; priority:1;)
alert tcp 67.23.12.128 any $HOME_NET any (msg:"ads2.net-communities.co.uk"; classtype:trojan-activity; priority:1;)
alert tcp 67.23.33.102 any $HOME_NET any (msg:"fusionads.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.23.7.65 any $HOME_NET any (msg:"netcommunities.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.55.121.4 any $HOME_NET any (msg:"privatecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.63.55.53 any $HOME_NET any (msg:"ads.web21.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.72.20.20 any $HOME_NET any (msg:"ads.v3.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.88.217.230 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.88.217.235 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.88.220.26 any $HOME_NET any (msg:"adxpose.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.88.220.27 any $HOME_NET any (msg:"widgetbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 67.98.249.180 any $HOME_NET any (msg:"dynamic.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.98.249.181 any $HOME_NET any (msg:"static.fmpub.net"; classtype:trojan-activity; priority:1;)
alert tcp 67.99.176.30 any $HOME_NET any (msg:"freewebcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.100.33.1 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.100.36.16 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.100.53.149 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.197.17 any $HOME_NET any (msg:"adserver.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.117 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.118 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.119 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.120 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.121 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.122 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.123 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.124 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.125 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.126 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.127 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.128 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.129 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.130 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.135 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.136 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.137 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.138 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.139 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.140 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.141 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.67 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.68 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.69 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.212.71 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.213.151 any $HOME_NET any (msg:"ipro.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.234.44 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.234.45 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.234.46 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.234.47 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.234.78 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.142.234.88 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.167.223.148 any $HOME_NET any (msg:"overpeer.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.168.112.22 any $HOME_NET any (msg:"affiliation-france.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.168.112.4 any $HOME_NET any (msg:"affiliation-france.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.169.65.94 any $HOME_NET any (msg:"hidden.gogoceleb.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.169.72.178 any $HOME_NET any (msg:"whaleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.169.73.2 any $HOME_NET any (msg:"crakmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.169.73.54 any $HOME_NET any (msg:"promo.badoink.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.169.80.103 any $HOME_NET any (msg:"whaleads.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.169.85.226 any $HOME_NET any (msg:"craktraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.146.133 any $HOME_NET any (msg:"exchangead.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.211.30 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.232.100 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.232.143 any $HOME_NET any (msg:"feedbackresearch.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.232.44 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.232.60 any $HOME_NET any (msg:"theadhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.254.122 any $HOME_NET any (msg:"smartdirect.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.254.198 any $HOME_NET any (msg:"lucidmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.178.254.199 any $HOME_NET any (msg:"therichkids.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.180.195.71 any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.180.206.184 any $HOME_NET any (msg:"yieldmanager.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.180.221.254 any $HOME_NET any (msg:"visit.webhosting.yahoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.232.188.164 any $HOME_NET any (msg:"assets1.exgfnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.232.35.119 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.232.35.169 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.233.228.233 any $HOME_NET any (msg:"adshost1.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.233.244.176 any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.130.13 any $HOME_NET any (msg:"ads.creative-serving.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.170.143 any $HOME_NET any (msg:"admailtiser.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.135 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.136 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.137 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.138 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.139 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.140 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.141 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.142 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.143 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.144 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.146 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.147 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.148 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.149 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.150 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.151 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.152 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.153 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.154 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.155 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.156 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.157 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.158 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.159 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.160 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.161 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.173 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.174 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.175 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.176 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.177 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.178 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.179 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.180 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.181 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.182 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.183 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.184 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.185 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.186 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.187 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.200 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.201 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.202 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.203 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.204 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.205 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.206 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.207 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.208 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.209 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.210 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.211 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.212 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.213 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.214 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.215 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.216 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.217 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.218 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.219 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.220 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.221 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.222 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.223 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.224 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.225 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.226 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.243 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.244 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.245 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.246 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.247 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.248 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.249 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.250 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.251 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.179.252 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.145 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.146 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.147 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.148 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.149 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.150 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.151 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.152 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.153 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.169 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.170 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.171 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.172 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.173 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.174 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.175 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.176 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.177 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.178 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.183 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.184 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.185 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.186 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.187 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.188 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.189 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.190 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.191 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.192 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.193 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.194 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.195 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.196 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.197 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.198 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.199 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.200 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.202 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.203 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.204 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.205 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.206 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.207 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.208 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.209 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.210 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.211 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.212 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.213 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.214 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.215 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.216 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.217 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.218 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.219 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.221 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.222 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.223 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.224 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.247 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.248 any $HOME_NET any (msg:"ad.thewheelof.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.249 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.250 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.251 any $HOME_NET any (msg:"ads.avazu.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.252 any $HOME_NET any (msg:"ads.exactdrive.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.253 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.67.185.254 any $HOME_NET any (msg:"ads.pickmeup-ltd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.107.160 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.107.161 any $HOME_NET any (msg:"track.anchorfree.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.107.69 any $HOME_NET any (msg:"box.anchorfree.net"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.30.100 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.30.105 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.30.110 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.30.115 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.30.80 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.30.85 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.30.90 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.68.30.95 any $HOME_NET any (msg:"cbanners.virtuagirlhd.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.71.209.57 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.71.220.155 any $HOME_NET any (msg:"adimages.go.com"; classtype:trojan-activity; priority:1;)
alert tcp 68.71.48.13 any $HOME_NET any (msg:"ads.satyamonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.0.137.154 any $HOME_NET any (msg:"advertserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.0.147.100 any $HOME_NET any (msg:"searchramp.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.0.219.109 any $HOME_NET any (msg:"vericlick.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.0.247.52 any $HOME_NET any (msg:"advertserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.10.224.247 any $HOME_NET any (msg:"affiliates.ultrahosting.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.10.233.37 any $HOME_NET any (msg:"lakequincy.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.10.24.246 any $HOME_NET any (msg:"mediamgr.ugo.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.10.24.70 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.10.24.93 any $HOME_NET any (msg:"adcontent.gamespy.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.10.25.46 any $HOME_NET any (msg:"ads.gamespyid.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.12.31.26 any $HOME_NET any (msg:"adventory.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.147.76.121 any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.147.76.65 any $HOME_NET any (msg:"adinterax.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.155.184.152 any $HOME_NET any (msg:"ads.faxo.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.16.243.73 any $HOME_NET any (msg:"infiniteadds.org"; classtype:trojan-activity; priority:1;)
alert tcp 69.16.250.220 any $HOME_NET any (msg:"dealdotcom.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.162.133.171 any $HOME_NET any (msg:"infiniteadds.org"; classtype:trojan-activity; priority:1;)
alert tcp 69.162.154.23 any $HOME_NET any (msg:"50websads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.163.146.58 any $HOME_NET any (msg:"pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.163.154.20 any $HOME_NET any (msg:"ads.hideyourarms.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.163.254.5 any $HOME_NET any (msg:"counter.dreamhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.164.205.23 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.164.206.55 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.165.98.61 any $HOME_NET any (msg:"ads.slim.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.166.132.246 any $HOME_NET any (msg:"icptrack.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.167.141.209 any $HOME_NET any (msg:"adgridwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.167.162.66 any $HOME_NET any (msg:"searchfeast.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.170.135.92 any $HOME_NET any (msg:"bannerswap.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.172.200.114 any $HOME_NET any (msg:"webgains.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.174.242.183 any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.174.247.169 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.174.247.170 any $HOME_NET any (msg:"lfstmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.194.143.52 any $HOME_NET any (msg:"fimserve.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.194.143.64 any $HOME_NET any (msg:"rubiconproject.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.194.230.11 any $HOME_NET any (msg:"microticker.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.194.244.11 any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.194.245.5 any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.195.77.90 any $HOME_NET any (msg:"peer39.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.197.22.76 any $HOME_NET any (msg:"reachjunction.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.197.23.175 any $HOME_NET any (msg:"realtechnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.2.101.13 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.2.101.36 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.2.103.13 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.2.103.57 any $HOME_NET any (msg:"ads.nola.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.2.38.68 any $HOME_NET any (msg:"ads.casinocity.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.17.30 any $HOME_NET any (msg:"offermatica.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.24.247 any $HOME_NET any (msg:"rightstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.34.91 any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.35.142 any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.36.8 any $HOME_NET any (msg:"eadexchange.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.49.240 any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.53.191 any $HOME_NET any (msg:"directorym.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.55.138 any $HOME_NET any (msg:"banners.isoftmarketing.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.56.9 any $HOME_NET any (msg:"ad-tech.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.20.69.171 any $HOME_NET any (msg:"displayadsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.138.128 any $HOME_NET any (msg:"ads.tahono.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.11 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.12 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.13 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.14 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.16 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.17 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.22 any $HOME_NET any (msg:"newtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.3 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.4 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.48 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.5 any $HOME_NET any (msg:"dmtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.142.9 any $HOME_NET any (msg:"adminshop.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.178.136 any $HOME_NET any (msg:"ads.hollywood.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.190.10 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.190.30 any $HOME_NET any (msg:"clickbooth.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.190.36 any $HOME_NET any (msg:"clickboothlnk.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.27.170 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.27.173 any $HOME_NET any (msg:"ads.fortunecity.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.47.166 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.25.47.62 any $HOME_NET any (msg:"quantcast.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.26.170.37 any $HOME_NET any (msg:"trafficz.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.28.181.47 any $HOME_NET any (msg:"ads.deviantart.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.28.197.155 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.28.243.141 any $HOME_NET any (msg:"ads.forbes.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.28.74.175 any $HOME_NET any (msg:"socialspark.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.31.16.88 any $HOME_NET any (msg:"a.xanga.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.31.58.194 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 69.31.58.200 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 69.31.81.57 any $HOME_NET any (msg:"topbarh.box.sk"; classtype:trojan-activity; priority:1;)
alert tcp 69.31.91.10 any $HOME_NET any (msg:"topbarh.box.sk"; classtype:trojan-activity; priority:1;)
alert tcp 69.36.40.52 any $HOME_NET any (msg:"decknetwork.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.39.236.36 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 69.39.239.7 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 69.41.161.35 any $HOME_NET any (msg:"ads.hardwaresecrets.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.41.174.168 any $HOME_NET any (msg:"statisfy.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.41.187.109 any $HOME_NET any (msg:"mocean.mobi"; classtype:trojan-activity; priority:1;)
alert tcp 69.42.67.234 any $HOME_NET any (msg:"topsites.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 69.42.67.236 any $HOME_NET any (msg:"topsites.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 69.42.73.10 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.42.73.50 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.42.73.55 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.42.73.60 any $HOME_NET any (msg:"adbot.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.42.82.196 any $HOME_NET any (msg:"ecoupons.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.144 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.146 any $HOME_NET any (msg:"ads2.rne.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.151 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.153 any $HOME_NET any (msg:"rankyou.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.158 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.167 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.172 any $HOME_NET any (msg:"ads2.rne.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.200 any $HOME_NET any (msg:"sageanalyst.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.208 any $HOME_NET any (msg:"referralware.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.210 any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.211 any $HOME_NET any (msg:"pillscash.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.160.221 any $HOME_NET any (msg:"usapromotravel.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.132 any $HOME_NET any (msg:"imagecash.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.152 any $HOME_NET any (msg:"adserver.digitoday.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.156 any $HOME_NET any (msg:"itsptp.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.162 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.165 any $HOME_NET any (msg:"adprofile.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.166 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.177 any $HOME_NET any (msg:"zangocash.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.197 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.205 any $HOME_NET any (msg:"anahtars.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.210 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.215 any $HOME_NET any (msg:"adzones.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.43.161.4 any $HOME_NET any (msg:"addme.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.44.123.73 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.44.123.78 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.44.154.229 any $HOME_NET any (msg:"ads.virtualcountries.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.44.155.114 any $HOME_NET any (msg:"goldstats.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.44.157.42 any $HOME_NET any (msg:"ads.virtualcountries.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.44.60.99 any $HOME_NET any (msg:"ad1.emule-project.org"; classtype:trojan-activity; priority:1;)
alert tcp 69.45.86.40 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.45.86.48 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.45.86.55 any $HOME_NET any (msg:"ads.nwsource.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.20.65 any $HOME_NET any (msg:"adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.21.14 any $HOME_NET any (msg:"onlinecashmethod.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.225.44 any $HOME_NET any (msg:"newtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.226.141 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.226.163 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.226.167 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.160 any $HOME_NET any (msg:"richmails.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.169 any $HOME_NET any (msg:"porngraph.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.171 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.175 any $HOME_NET any (msg:"freebanner.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.176 any $HOME_NET any (msg:"hitiz.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.177 any $HOME_NET any (msg:"popupnation.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.181 any $HOME_NET any (msg:"ads2.rne.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.37 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.39 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.57 any $HOME_NET any (msg:"adflight.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.228.59 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.230.10 any $HOME_NET any (msg:"banners.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.230.70 any $HOME_NET any (msg:"banners.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.230.80 any $HOME_NET any (msg:"banners.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.235.101 any $HOME_NET any (msg:"stats.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.235.102 any $HOME_NET any (msg:"stats.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.235.78 any $HOME_NET any (msg:"dnads.directnic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.28.42 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.28.87 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.28.90 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.28.92 any $HOME_NET any (msg:"eu-adcenter.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.46.36.6 any $HOME_NET any (msg:"feedjit.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.48.248.50 any $HOME_NET any (msg:"shoppingads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.48.248.51 any $HOME_NET any (msg:"text-link-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.48.248.61 any $HOME_NET any (msg:"auctionads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.5.11.164 any $HOME_NET any (msg:"microticker.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.5.6.164 any $HOME_NET any (msg:"questaffiliates.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.131.221 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.131.237 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.135.82 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.137.28 any $HOME_NET any (msg:"madisonavenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.138.146 any $HOME_NET any (msg:"teenrevenue.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.193.1 any $HOME_NET any (msg:"bannertesting.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.198.228 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.215.238 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.219.148 any $HOME_NET any (msg:"adsynergy.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.50.223.101 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.51.17.129 any $HOME_NET any (msg:"ads4homes.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.51.8.31 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.51.8.33 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.51.8.39 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.51.8.4 any $HOME_NET any (msg:"myaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.226.116 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.231.165 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.231.250 any $HOME_NET any (msg:"ads.phpclasses.org"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.236.133 any $HOME_NET any (msg:"edgeio.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.136 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.137 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.142 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.145 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.163 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.164 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.168 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.169 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.48.238 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.114 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.150 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.199 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.200 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.209 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.211 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.226 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.25 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.45 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.46 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.5 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.74 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.75 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.76 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.52.93 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.60.182 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.60.206 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.60.6 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.61.160 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.62.114 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.62.118 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.62.122 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.62.66 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.62.90 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.63.16 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.63.3 any $HOME_NET any (msg:"plugrush.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.63.31 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.63.55 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.55.63.56 any $HOME_NET any (msg:"loading321.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.56.136.30 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.56.152.78 any $HOME_NET any (msg:"herbalaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.56.163.51 any $HOME_NET any (msg:"passion-4.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.56.171.54 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.56.194.122 any $HOME_NET any (msg:"pronetadvertising.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.56.235.196 any $HOME_NET any (msg:"relmaxtop.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.57.129.18 any $HOME_NET any (msg:"ads.cgnetworks.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.57.155.105 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.57.155.11 any $HOME_NET any (msg:"counter.bloke.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.144.164 any $HOME_NET any (msg:"pubmatic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.148.68 any $HOME_NET any (msg:"directaclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.161.242 any $HOME_NET any (msg:"trackalyzer.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.170.246 any $HOME_NET any (msg:"internetfuel.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.175.208 any $HOME_NET any (msg:"fusionquest.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.181.11 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.181.9 any $HOME_NET any (msg:"ad.jetsoftware.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.195.11 any $HOME_NET any (msg:"textads.biz"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.195.38 any $HOME_NET any (msg:"textads.biz"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.196.216 any $HOME_NET any (msg:"ads.stackoverflow.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.197.21 any $HOME_NET any (msg:"ads.stackoverflow.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.59.28.209 any $HOME_NET any (msg:"bans.bride.ru"; classtype:trojan-activity; priority:1;)
alert tcp 69.6.2.106 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.6.2.68 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.6.2.98 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.6.21.113 any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.6.21.21 any $HOME_NET any (msg:"actualdeals.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.6.27.100 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.6.27.3 any $HOME_NET any (msg:"tracking101.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.6.33.3 any $HOME_NET any (msg:"freepay.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.60.111.110 any $HOME_NET any (msg:"mixtraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.60.114.117 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.60.115.201 any $HOME_NET any (msg:"textads.biz"; classtype:trojan-activity; priority:1;)
alert tcp 69.60.120.198 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 69.60.122.105 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.60.7.199 any $HOME_NET any (msg:"ads.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.60.7.210 any $HOME_NET any (msg:"track.gawker.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.63.218.249 any $HOME_NET any (msg:"adworldnetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.63.219.250 any $HOME_NET any (msg:"valuead.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.176 any $HOME_NET any (msg:"nuseek.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.19 any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.21 any $HOME_NET any (msg:"adscpm.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.210 any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.211 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.213 any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.216 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.243 any $HOME_NET any (msg:"avsads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.147.248 any $HOME_NET any (msg:"onlinecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.153.126 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.153.135 any $HOME_NET any (msg:"indieclick.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.153.171 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.154.198 any $HOME_NET any (msg:"dmtracker.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.111 any $HOME_NET any (msg:"newtopsites.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.119 any $HOME_NET any (msg:"pay-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.124 any $HOME_NET any (msg:"ad2flash.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.128 any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.130 any $HOME_NET any (msg:"n69.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.131 any $HOME_NET any (msg:"topsearcher.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.133 any $HOME_NET any (msg:"netincap.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.136 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.137 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.144 any $HOME_NET any (msg:"advertmarket.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.15 any $HOME_NET any (msg:"adprofile.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.186 any $HOME_NET any (msg:"hotkeys.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.155.4 any $HOME_NET any (msg:"nuseek.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.176.165 any $HOME_NET any (msg:"bannerhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.240.47 any $HOME_NET any (msg:"adbrite.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.34.153 any $HOME_NET any (msg:"ads.bigfoot.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.38.23 any $HOME_NET any (msg:"affiliate.mogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.56.156 any $HOME_NET any (msg:"creative.whi.co.nz"; classtype:trojan-activity; priority:1;)
alert tcp 69.64.59.218 any $HOME_NET any (msg:"megastats.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.65.109.141 any $HOME_NET any (msg:"ads.betanews.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.65.22.215 any $HOME_NET any (msg:"alladvantage.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.65.22.5 any $HOME_NET any (msg:"alladvantage.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.65.38.224 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 69.65.39.23 any $HOME_NET any (msg:"adf.ly"; classtype:trojan-activity; priority:1;)
alert tcp 69.65.43.176 any $HOME_NET any (msg:"amazingcounters.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.67.216.234 any $HOME_NET any (msg:"affiliate.mercola.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.72.142.98 any $HOME_NET any (msg:"chartbeat.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.72.168.234 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.72.225.13 any $HOME_NET any (msg:"adserver.hardwareanalysis.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.73.177.6 any $HOME_NET any (msg:"forex-affiliate.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.8.219.192 any $HOME_NET any (msg:"trafficstrategies.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.80.225.24 any $HOME_NET any (msg:"whoisonline.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.80.251.83 any $HOME_NET any (msg:"ad.slutload.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.85.88.44 any $HOME_NET any (msg:"shareadspace.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.88.139.49 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.88.139.50 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.88.139.55 any $HOME_NET any (msg:"affiliate.dtiserv.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.88.145.11 any $HOME_NET any (msg:"promos.fling.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.89.74.113 any $HOME_NET any (msg:"sparkstudios.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.9.161.98 any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.9.170.150 any $HOME_NET any (msg:"blogads.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.9.177.200 any $HOME_NET any (msg:"clickhouse.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.152.224 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.152.225 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.152.226 any $HOME_NET any (msg:"didtheyreadit.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.204.170 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.204.171 any $HOME_NET any (msg:"iperceptions.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.24.158 any $HOME_NET any (msg:"linkrain.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.31.112 any $HOME_NET any (msg:"ads.redlightcenter.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.7.17 any $HOME_NET any (msg:"adcentriconline.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.90.74.226 any $HOME_NET any (msg:"banner.casinodelrio.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.93.15.21 any $HOME_NET any (msg:"herbalaffiliateprogram.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.93.171.85 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.93.193.202 any $HOME_NET any (msg:"ad-rotator.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.93.2.12 any $HOME_NET any (msg:"4d5.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.93.220.38 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 69.93.250.118 any $HOME_NET any (msg:"ads.satyamonline.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.93.73.21 any $HOME_NET any (msg:"bannerboxes.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.94.138.192 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.94.14.95 any $HOME_NET any (msg:"specificpop.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.94.25.146 any $HOME_NET any (msg:"pageranktop.com"; classtype:trojan-activity; priority:1;)
alert tcp 69.94.73.65 any $HOME_NET any (msg:"freestats.tv"; classtype:trojan-activity; priority:1;)
alert tcp 70.165.44.241 any $HOME_NET any (msg:"neudesicmediagroup.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.168.128.168 any $HOME_NET any (msg:"itfarm.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.182.179.196 any $HOME_NET any (msg:"trackmysales.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.32.146.212 any $HOME_NET any (msg:"doubleclick.net"; classtype:trojan-activity; priority:1;)
alert tcp 70.34.32.33 any $HOME_NET any (msg:"viewpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.34.32.55 any $HOME_NET any (msg:"viewpoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.39.84.249 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.39.84.250 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.39.99.86 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.39.99.87 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.39.99.88 any $HOME_NET any (msg:"ads.yourfreedvds.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.129.172 any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.129.173 any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.129.197 any $HOME_NET any (msg:"wikia-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.129.220 any $HOME_NET any (msg:"athena-ads.wikia.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.138.14 any $HOME_NET any (msg:"turn.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.22.65 any $HOME_NET any (msg:"quinst.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.23.11 any $HOME_NET any (msg:"qnsr.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.23.116 any $HOME_NET any (msg:"thecounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.23.121 any $HOME_NET any (msg:"thecounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.23.243 any $HOME_NET any (msg:"quinst.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.254.174 any $HOME_NET any (msg:"eurekster.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.26.234 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.33.241 any $HOME_NET any (msg:"adadvisor.net"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.34.254 any $HOME_NET any (msg:"quantcast.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.42.51.126 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.111.82 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.114.142 any $HOME_NET any (msg:"easyhits4u.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.189.210 any $HOME_NET any (msg:"adreactor.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.191.146 any $HOME_NET any (msg:"adserver.portalofevil.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.218.21 any $HOME_NET any (msg:"passion-4.net"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.236.226 any $HOME_NET any (msg:"adscholar.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.44.103 any $HOME_NET any (msg:"ads.shizmoo.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.52.18 any $HOME_NET any (msg:"ads.digital-digest.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.84.96.2 any $HOME_NET any (msg:"sitemeter.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.113.2 any $HOME_NET any (msg:"statcounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.160.244 any $HOME_NET any (msg:"adserver.legacy-network.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.162.181 any $HOME_NET any (msg:"dialerporn.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.166.243 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.22.227 any $HOME_NET any (msg:"freelogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.223.162 any $HOME_NET any (msg:"xclicks.net"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.251.170 any $HOME_NET any (msg:"hurricanedigitalmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.46.54 any $HOME_NET any (msg:"gamesitestop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.53.210 any $HOME_NET any (msg:"goingplatinum.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.85.96.106 any $HOME_NET any (msg:"domaining.in"; classtype:trojan-activity; priority:1;)
alert tcp 70.86.108.254 any $HOME_NET any (msg:"enginenetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.86.170.162 any $HOME_NET any (msg:"ads.flooble.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.86.189.194 any $HOME_NET any (msg:"advariant.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.86.212.2 any $HOME_NET any (msg:"sponsors.thoughtsmedia.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.86.4.26 any $HOME_NET any (msg:"adserver.portalofevil.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.87.105.162 any $HOME_NET any (msg:"hitiz.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.87.197.26 any $HOME_NET any (msg:"toplistcity.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.87.21.179 any $HOME_NET any (msg:"opienetwork.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.87.239.82 any $HOME_NET any (msg:"statxpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.87.24.152 any $HOME_NET any (msg:"bvalphaserver.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.87.3.233 any $HOME_NET any (msg:"ads.soft32.com"; classtype:trojan-activity; priority:1;)
alert tcp 70.87.32.82 any $HOME_NET any (msg:"top-site-list.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.184.92.53 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.184.92.55 any $HOME_NET any (msg:"ad.cooks.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.197.217.87 any $HOME_NET any (msg:"engage.everyone.net"; classtype:trojan-activity; priority:1;)
alert tcp 71.29.126.230 any $HOME_NET any (msg:"linkshighway.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.4.175.98 any $HOME_NET any (msg:"eyeblaster.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.40.76.138 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.5.65.70 any $HOME_NET any (msg:"overpeer.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.6.142.33 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.6.193.126 any $HOME_NET any (msg:"exchange-it.com"; classtype:trojan-activity; priority:1;)
alert tcp 71.6.208.31 any $HOME_NET any (msg:"zintext.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.162.20 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.162.241 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.162.242 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.162.40 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.162.69 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.162.70 any $HOME_NET any (msg:"ads.weather.ca"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.203.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.203.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.100 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.101 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.102 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.113 any $HOME_NET any (msg:"web2.deja.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.205.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.207.127 any $HOME_NET any (msg:"video-stats.video.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.207.99 any $HOME_NET any (msg:"measuremap.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.209.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.217.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.217.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.217.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.217.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.221.103 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.221.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.221.127 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.221.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.221.99 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.247.104 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.247.147 any $HOME_NET any (msg:"www-google-analytics.l.google.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.247.99 any $HOME_NET any (msg:"googlesyndication.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.14.253.99 any $HOME_NET any (msg:"google-analytics.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.166.185.151 any $HOME_NET any (msg:"newt1.adultadworld.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.131.162 any $HOME_NET any (msg:"malwaredomains.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.131.188 any $HOME_NET any (msg:"bannerimage.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.131.38 any $HOME_NET any (msg:"infinite-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.133.155 any $HOME_NET any (msg:"therichkids.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.141.42 any $HOME_NET any (msg:"trafficspaces.net"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.232.100 any $HOME_NET any (msg:"bestsearch.net"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.232.146 any $HOME_NET any (msg:"adserversolutions.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.232.20 any $HOME_NET any (msg:"cyberbounty.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.232.8 any $HOME_NET any (msg:"media-servers.net"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.248.70 any $HOME_NET any (msg:"matchcraft.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.253.118 any $HOME_NET any (msg:"pay-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.26.138 any $HOME_NET any (msg:"trafficmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.167.52.63 any $HOME_NET any (msg:"pay-ads.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.172.67.24 any $HOME_NET any (msg:"adengage.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.172.84.148 any $HOME_NET any (msg:"adminder.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.2.114.172 any $HOME_NET any (msg:"jcount.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.2.6.81 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.2.6.91 any $HOME_NET any (msg:"leadingedgecash.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.2.7.31 any $HOME_NET any (msg:"enquisite.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.20.110.8 any $HOME_NET any (msg:"top20.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.20.114.94 any $HOME_NET any (msg:"adsymptotic.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.20.118.151 any $HOME_NET any (msg:"veruta.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.20.21.238 any $HOME_NET any (msg:"gtop100.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.20.40.27 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.20.40.28 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.20.40.29 any $HOME_NET any (msg:"tinybar.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.11.42 any $HOME_NET any (msg:"precisioncounter.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.194.140 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.194.16 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.194.20 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.194.23 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.194.29 any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.194.32 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.195.15 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.195.161 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.195.34 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.195.66 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.195.72 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.195.98 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.114 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.131 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.134 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.153 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.165 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.194 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.39 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.71 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.202.96 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.203.132 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.203.133 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.203.146 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.203.149 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.203.159 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.206.84 any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.102 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.114 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.134 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.137 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.153 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.165 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.195 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.212 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.226 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.241 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.207.246 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.210.210 any $HOME_NET any (msg:"assoc-amazon.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.210.7 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.102 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.131 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.137 any $HOME_NET any (msg:"intergi.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.146 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.147 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.153 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.163 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.165 any $HOME_NET any (msg:"ads.psd2html.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.168 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.171 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.174 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.188 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.197 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.200 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.214 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.228 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.211.247 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.214.144 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.214.160 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.214.200 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.214.39 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.214.42 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.215.101 any $HOME_NET any (msg:"adzerk.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.215.107 any $HOME_NET any (msg:"statistics.ro"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.215.133 any $HOME_NET any (msg:"yab-adimages.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.215.165 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.215.197 any $HOME_NET any (msg:"alexa-sitestats.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.215.76 any $HOME_NET any (msg:"ads.s3.sitepoint.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.215.90 any $HOME_NET any (msg:"entrecard.s3.amazonaws.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.21.92.22 any $HOME_NET any (msg:"ads.jiwire.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.22.202.136 any $HOME_NET any (msg:"topbucks.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.101.40 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.101.41 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.101.42 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.101.43 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.130.162 any $HOME_NET any (msg:"dialerporn.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.153.251 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.153.253 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.193.58 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.241.20 any $HOME_NET any (msg:"itsptp.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.247.106 any $HOME_NET any (msg:"clickthrutraffic.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.232.6.21 any $HOME_NET any (msg:"advertisingbox.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.233.104.123 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.233.107.124 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.233.107.125 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.233.111.159 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.233.119.199 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.233.127.217 any $HOME_NET any (msg:"stats.wordpress.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.233.24.22 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.233.24.24 any $HOME_NET any (msg:"woopra.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.246.55.34 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 72.246.55.8 any $HOME_NET any (msg:"banner.getgo.de"; classtype:trojan-activity; priority:1;)
alert tcp 72.249.61.70 any $HOME_NET any (msg:"adsmart.net"; classtype:trojan-activity; priority:1;)
alert tcp 72.251.206.98 any $HOME_NET any (msg:"ads.imgur.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.26.125.200 any $HOME_NET any (msg:"nbjmp.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.26.224.162 any $HOME_NET any (msg:"www.banner-link.com.br"; classtype:trojan-activity; priority:1;)
alert tcp 72.3.135.151 any $HOME_NET any (msg:"bannerhost.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.3.139.203 any $HOME_NET any (msg:"webstat.net"; classtype:trojan-activity; priority:1;)
alert tcp 72.3.165.244 any $HOME_NET any (msg:"inboxdollars.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.3.221.161 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.3.221.162 any $HOME_NET any (msg:"cpalead.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.3.225.27 any $HOME_NET any (msg:"adsoldier.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.3.232.32 any $HOME_NET any (msg:"ads.directionsmag.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.3.234.226 any $HOME_NET any (msg:"affiliate.mogs.com"; classtype:trojan-activity; priority:1;)
alert tcp 72.30.190.80 any $HOME_NET any (msg:"marketingsolutions.yahoo.com"; classtype:trojan-activity