alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"11plants.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002003;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"123002915.cn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002004;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"123adult123.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002005;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"28843622.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002006;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"2x5.us"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002007;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"360safeupdate02.gicp.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002008;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"3apa3a.tomsk.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002009;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"423654m.cn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002010;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"7system.ezua.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002011;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"90fd78b9078bd0g.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002012;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"98dfgr994883798df.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002013;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"abc.googlezuju.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002014;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"achecad.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002015;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"activedent.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002016;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"addweb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002017;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adminpaneltestasdf000444.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002018;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aeronitrex.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002019;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"agedstuff.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002020;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"airplains.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002021;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"airportsys.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002022;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"akronisltd.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002023;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"all-nacha-datainfo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002024;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"altium.dev.hosting.rubius.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002025;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"amberschool.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002026;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"amberschool2.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002027;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"americanmobile.ca"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002028;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"amstelone3.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002029;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"antifoher.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002030;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"antisorit.cn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002031;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"anysnare.us"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002032;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aptitude.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002033;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aquaedition.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002034;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aquajaunt.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002035;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aquaskiff.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002036;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aquasrc.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002037;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ariodtalk.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002038;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"astrawebservice.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002039;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"atlantatoagofs.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002040;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"atlantawadding.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002041;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"au-business-customer.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002042;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"axeswizardepx.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002043;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"barugen.dlinkddns.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002044;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"basedmarket.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002045;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"basiliskos.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002046;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"battlewright.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002047;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"becutie.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002048;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bellicbridge.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002049;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bellicoreturbo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002050;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bestlongnet.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002051;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bestsoftics.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002052;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bestvideoworld.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002053;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"betswinstrategy.cn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002054;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"betternewyear.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002055;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"biggestcoin.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002056;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"biggestfunds.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002057;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigimotopast.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002058;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigupdate.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002059;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigupdater.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002060;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigupdaters.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002061;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigupdates.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002062;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigupdating.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002063;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigupdatings.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002064;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"billycheerful.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002065;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"billyd.com.au"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002066;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bisiteles.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002067;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"blackbuckseri.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002068;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bluedisk.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002069;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bmi.kurskstu.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002070;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bonaquadjriga.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002071;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"boredret.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002072;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"botcat.la"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002073;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"botnet.24fun.mk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002074;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"botnetdown.gicp.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002075;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"boutique26.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002076;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"brandc.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002077;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"brnsounds.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002078;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"buyakabuyaka.kiev.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002079;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bxkkuskgdjskdn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002080;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cakerecipes.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002081;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"callmenowhere.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002082;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cantst0pmenever.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002083;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cc.kandek.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002084;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ccleanerwithsteak.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002085;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cdkd.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002086;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cekcuc.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002087;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"champiogogo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002088;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chamska.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002089;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"charterbeans.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002090;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cherlend2.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002091;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"choiodos.kodingen.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002092;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chot-extreme.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002093;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"closedsource.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002094;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cloudsaround.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002095;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cloudy-dns.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002096;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cnewsus.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002097;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cnnus.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002098;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"companian-usa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002099;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"coolsofa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002100;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cooltruling.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002101;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"coooolzz.zapto.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002102;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cornermarketmedia.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002103;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"countrysefa.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002104;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cp101.sharkserve.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002105;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cronjelaw.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002106;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cs2gameme.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002107;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cslrb-850-2.slc.westdc.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002108;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"curvechirp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002109;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"daosf3doapo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002110;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"daraskiluk.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002111;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dartzofmybpull.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002112;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dasad41da4safasdasd21.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002113;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"datacricketuf.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002114;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dbi-static.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002115;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"delovar999.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002116;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"digibeetlesop.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002117;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dive-west.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002118;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"djpeterblue.com.br"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002119;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"domainfortestingpanel999111.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002120;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"domainnameprovder.cz.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002121;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"domeafavour.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002122;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"down.adobe-updates.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002123;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"driscocity.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002124;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"drontapesoff.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002125;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dst-finance.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002126;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"duowork.kz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002127;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dvsdfvsw.narod2.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002128;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"e-exchanger.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002129;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"earlyship.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002130;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ecommerceone.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002131;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"edgecube.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002132;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"eepeohothe.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002133;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"eewqr12.servebeer.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002134;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ematome.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002135;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"esperadooptic.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002136;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"espmexusa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002137;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"eurostats2012.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002138;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"exp.exetsoft.org.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002139;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"expqlojkxytqp.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002140;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"faasppouk.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002141;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fabsnot.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002142;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"face18.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002143;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"faint.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002144;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fastgoal.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002145;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fattree.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002146;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"favino.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002147;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"favoritopilodjd.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002148;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"federalreserve-online.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002149;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"federetoktyt.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002150;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fedralwire-report.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002151;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"filebale.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002152;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fileservice.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002153;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"finans-group-global.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002154;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"flashbangsecurity.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002155;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"florianarray.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002156;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"foresttest218999fhjslk.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002157;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"forppp.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002158;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"forum4you.im"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002159;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fpzbox.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002160;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fred-c.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002161;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"freehost21.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002162;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"freshcomp.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002163;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"frtualpornclub.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002164;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ftwtogether.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002165;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"funtime.arvixe.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002166;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"garati.it"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002167;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gerlsipslokane.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002168;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ghostbustards.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002169;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ghosttrick.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002170;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"giftcanbuy.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002171;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gigasoftware.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002172;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gloriandelorians.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002173;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"go6po.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002174;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"godfix.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002175;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gorycup.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002176;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gotoberlin.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002177;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"greathell.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002178;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"greatjazz.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002179;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gugla.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002180;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"h21211.srv7.test-hf.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002181;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"haltermancelo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002182;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"heyitsme.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002183;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hhtres.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002184;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"high-privacy.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002185;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"high-update.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002186;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"high-upgrade.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002187;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"highnetlifenet.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002188;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hnwxqurqjvynwljf.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002189;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"holdaslas.so"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002190;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hosthqk.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002191;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hotupdaters.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002192;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hoycktsjwqsmklnv.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002193;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hselrurele.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002194;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hunterdriveez.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002195;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"huntersamplifi.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002196;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"huntersrafters.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002197;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hv673hv573hv53h7khv57.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002198;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"icredoname10012.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002199;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iesnare.us"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002200;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ignis.net.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002201;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ilovekeks.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002202;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"inboxacc.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002203;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"incode.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002204;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"indigocrickets.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002205;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"indingo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002206;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"insane.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002207;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"inspectmygadget.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002208;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"investriotinto.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002209;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ionicfood.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002210;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iopyte.bget.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002211;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iplatforma2020.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002212;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iqservice.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002213;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ironsum.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002214;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iserverupdates.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002215;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ishopsystem.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002216;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"itchyclock.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002217;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"itchysauce.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002218;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"itisagooddaytodie.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002219;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jad3.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002220;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jamesbondajent.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002221;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jcmtczpwontvppnt.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002222;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jdjsaf34.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002223;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jennifermusic.nl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002224;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jinanpharmaceutical.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002225;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jjustdoit.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002226;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jliqigsnggdwxp.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002227;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"johngottybest.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002228;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"johninjucy.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002229;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"josunrwpyghvttr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002230;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"junioroops.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002231;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jupaizeuph.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002232;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"just-ping.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002233;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"justbigtoyss.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002234;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kaftanhotel.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002235;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kawabungashop.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002236;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kickthefuture.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002237;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"klrtm.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002238;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kominas.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002239;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kosmovodki.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002240;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"koukou.mine.nu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002241;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kupie-dlugi.pl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002242;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lameedge.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002243;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"layeradv.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002244;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"leakyhero.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002245;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"legcold.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002246;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lesslane.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002247;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"letstarting.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002248;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"level-upgrade.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002249;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"level-upgrage.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002250;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"liberweb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002251;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"localdarcenss.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002252;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"localh0st.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002253;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lostyear.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002254;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lowerdog.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002255;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lprshcsmijfovp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002256;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"luckersun.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002257;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lwbbtfrtjjsyksl.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002258;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"m5ta2bq-server.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002259;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"makeitso.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002260;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"makemealive.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002261;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"makemoneyonline.tk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002262;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"manageopoly.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002263;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mationsperohe.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002264;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"maymacngocphuong.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002265;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mcgoth.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002266;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"media.https04.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002267;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mibolyri.pisem.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002268;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"michigan4movies.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002269;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microbase-update.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002270;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsoft-update.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002271;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsofto.sytes.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002272;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"midbomb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002273;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mildruby.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002274;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mildtune.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002275;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"minihose.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002276;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"miniokoyokolia.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002277;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"missboys.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002278;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"misssershmidt.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002279;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"moigerta.cn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002280;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mokshark.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002281;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mswqvxohtpfnzj.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002282;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"muchachoslot.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002283;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"munaeghohz.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002284;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"myscarts.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002285;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mz.u-gu.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002286;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nachauser-storeinfo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002287;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nachauserinfo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002288;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nahwisohch.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002289;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"namesservers.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002290;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"national-security-agency.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002291;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"naughtywifepal.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002292;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nearhog.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002293;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"neironhounder.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002294;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"neoprenolen.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002295;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netupdate1.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002296;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netupdate4.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002297;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netupdate5.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002298;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netupdate8.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002299;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netupdater.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002300;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netupdaters.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002301;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netupdates.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002302;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netupdatings.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002303;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"newturbobrowser.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002304;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"newyaction.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002305;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nicefilmsa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002306;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"njxnerslmmvpyto.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002307;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nookbizkitsad.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002308;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"noseclan.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002309;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nuttyknack.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002310;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"objectsphereuf.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002311;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ofigalidon.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002312;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oneant.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002313;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oneboy.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002314;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onemoretimehi.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002315;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onepet.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002316;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onlinereger.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002317;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oposumschoone.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002318;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oqkplss.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002319;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oqocbqmmmnnjzq.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002320;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ourtulip.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002321;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ozoneiphone.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002322;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"panelfretbbuiewnwdkhjg888333.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002323;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"papertulip.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002324;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pearlrumor.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002325;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pellicslotersa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002326;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"petroleumgroup.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002327;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"petromg.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002328;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"phoneajoystick.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002329;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"photo-repair.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002330;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"piecerack.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002331;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pighair.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002332;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"plantlunch.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002333;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pochemuchka.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002334;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"poisk.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002335;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"polovinkajfie.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002336;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"poogatodf.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002337;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"popspostenkple.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002338;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"porno-mix-sex.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002339;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"poste-secyre.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002340;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"potvamp.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002341;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"prlwppsunenofsx.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002342;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ptichka.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002343;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ptsoncmrusnjoew.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002344;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"purecash.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002345;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pyrohost.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002346;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"qroslnnklpmcrmor.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002347;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"quardsecurity.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002348;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"queenchair.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002349;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"quiverforge.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002350;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"quiverharbor.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002351;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"quiverwave.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002352;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"qwertyghost122245678.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002353;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rabbitsgohole.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002354;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"radikal-ph0to.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002355;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"reflectivelayer.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002356;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rehandntersfee.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002357;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"renwoxing.me"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002358;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"retyuloploples.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002359;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"revercestable.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002360;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rewriterform.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002361;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"roguefood.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002362;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rogueroad.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002363;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rohacafe.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002364;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rokqsjhzyiusvrj.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002365;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"roobshall.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002366;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"routerstructo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002367;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rt2.paydaylloans.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002368;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rudeink.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002369;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"runnystorm.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002370;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sampinv.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002371;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sarjnessfundof.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002372;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sc00d.webatu.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002373;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"scarts.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002374;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"scooter.web.tr"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002375;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sdkjgndfjnf.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002376;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"seawoljoystick.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002377;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"secondconcert.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002378;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"secureserfingnet.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002379;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"securitydaemon.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002380;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"seeikom.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002381;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sellertop.cn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002382;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"serva4ok.server2.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002383;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"servicespaypal.be"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002384;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sfimnakedgirls.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002385;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sgy.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002386;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"shikalmuna.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002387;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"shokoladdeath.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002388;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sickstage.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002389;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"siimplesale.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002390;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"simplychasinasis.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002391;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"simulatormage.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002392;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"skiangpa.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002393;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"skykeyboard2.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002394;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smartcheat.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002395;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smartsecurityadvizor.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002396;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smartsecuritybox.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002397;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smokybear.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002398;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"snaretrace.us"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002399;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"snaretrack.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002400;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"snarework.us"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002401;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"snotarms.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002402;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"softmarket-drom.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002403;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"softmarkets.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002404;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"softsecuritylab.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002405;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"soretag.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002406;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sox.kz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002407;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spl.kerrq.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002408;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ssss.everywebspace.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002409;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"stacyeiblerki.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002410;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"staticplan.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002411;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"statserver.admin163biz.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002412;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"steelcinetecs.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002413;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"steelstorm.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002414;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"stfuthesims.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002415;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"stripsneko.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002416;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"strongtopguard.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002417;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"styleforyour.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002418;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sundaymold.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002419;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"svjazbila.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002420;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"svjazinet.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002421;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"taemaidoo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002422;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"telefonchukcha.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002423;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"telelope.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002424;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"test444for555test333.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002425;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testeradminpanel222777.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002426;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testfhjtestpanel2226333.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002427;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testfortestltd444557.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002428;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testing1testing2fhj3888222.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002429;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testingdomainforfhj2220001.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002430;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testingforg00gle777245.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002431;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testingforinnovation2221999.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002432;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testinglightversion999111.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002433;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testonlyforfhj3355591.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002434;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testtestforfhj111998.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002435;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testtestingpotatoes111222.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002436;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"testtexttost555888.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002437;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tg2000.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002438;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"theddos.me"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002439;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thelookaround.net.atservers.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002440;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thescarts.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002441;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"theshop.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002442;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tixuanabridge.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002443;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"toloveornottolove.ipq.co"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002444;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"toplake.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002445;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"topsecurityplace.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002446;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"topupdate.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002447;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"topupdater.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002448;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"topupdaters.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002449;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tor4ok.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002450;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"totalexcel.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002451;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"toxicyack.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002452;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tr.hyundaita.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002453;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"track.wwwapps-ups.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002454;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tradingcenter.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002455;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"traveltomexixo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002456;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trezvostida.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002457;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trigaproholds.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002458;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"triplexguard.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002459;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"troj.zx9.de"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002460;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trucktrumpet.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002461;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"truststats.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002462;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trutofmymemory.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002463;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tscounter.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002464;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tuk-tuk.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002465;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tunepage.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002466;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tunisianowar.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002467;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"turkeyinworld.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002468;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tventinypoloret.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002469;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ufkirankmega.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002470;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uilveropoly.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002471;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ukadevochka.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002472;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uklopandaberk.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002473;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ultimatesecurity.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002474;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ultrareservation.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002475;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ultrawirereservation.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002476;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"underfeet.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002477;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"united-trans.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002478;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"upserv74912.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002479;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uptonxtwealth.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002480;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uralgaz.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002481;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uskamalchik.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002482;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vampkeys.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002483;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vardington7.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002484;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vastcoins.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002485;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vensart.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002486;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"viimans.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002487;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"villiam-grea.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002488;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"viperos.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002489;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vipworldhost.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002490;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"voizhest.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002491;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vseponovoy.cc.im"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002492;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vvmmp.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002493;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vzrnb4o4.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002494;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"warynews.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002495;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wdoyqoxnmmrlqyot.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002496;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"weaktrash.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002497;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wearysnake.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002498;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"webanalyses.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002499;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"webanalyticsrecord.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002500;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"westernillusion.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002501;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"westfight.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002502;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"whyvavilon.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002503;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"widowadvertising.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002504;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wildboy.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002505;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"winner-bets.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002506;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wisework.orge.pl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002507;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"witlion.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002508;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"woodwit.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002509;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"woodyalternative.ns1.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002510;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"woodyalternative2.ns1.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002511;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wopedjhfntzfgh.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002512;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wsqwehnnjppxrgxp.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002513;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wuvwqckpzfxrqi.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002514;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.aleph3.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002515;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.artmetal.cz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002516;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.caserow.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002517;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.easilypaydayloan.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002518;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.escrow-int-ltd.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002519;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.fundateideas.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002520;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.sensotek-spa.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002521;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.strbrst.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002522;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xaz6g1bc-server.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002523;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xlamonline.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002524;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xldavinchireverce.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002525;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xlreservation.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002526;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xoophafiel.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002527;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xpubblicita.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002528;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xtrace-upgrade.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002529;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xxmagicreservation.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002530;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xxxmagicreservation.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002531;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ygnlgxyzamfxvlt.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002532;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ymlo.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002533;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"youdontfkjbaher.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002534;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"youngmetal.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002535;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yourtulip.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002536;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ytjsxkupugwfppp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002537;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ytpfmnmgyjinxrhe.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002538;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yuelqmpimjxsmn.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002539;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"z0rex.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002540;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zaebiz.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002541;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zanyquery.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002542;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zapppo1.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002543;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zenhour.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002544;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zlegalsource.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002545;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zlen.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002546;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zsearchweb.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002547;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zxz666.myftp.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002548;)