alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"001.bladespoon.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002003;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"005.twoshekels.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002004;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"01.coolw.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002005;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"01.yxian.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002006;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"02.coolw.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002007;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"02.yxian.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002008;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"0md.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002009;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"1.vin4enso.cz8.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002010;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"111.gosdfsdjas.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002011;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"11sp.co.tv"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002012;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"1337.bnetinvaderz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002013;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"13666.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002014;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"15.bawbw.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002015;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"19sesse.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002016;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"1iii.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002017;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"1pulenepro.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002018;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"2012babah2012.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002019;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"221212121.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002020;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"2gunz.no-ip.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002021;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"2pulenepro.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002022;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"32002349293.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002023;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"32094820349.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002024;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"3214099021.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002025;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"32874239049394.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002026;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"333.aaszxy.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002027;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"3405902934059.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002028;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"349023094903.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002029;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"349209233.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002030;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"34real.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002031;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"365wowstore.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002032;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"3gcompanyplc.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002033;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"3m70.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002034;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"3weselchak.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002035;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"3x55conto.nu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002036;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"40aoz.sanjianistatistics.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002037;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"4238789324.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002038;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"458928409.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002039;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"663se2s.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002040;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"688set.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002041;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"6orod.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002042;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"753123.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002043;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"777yo777.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002044;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"82801se.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002045;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"842389423478923.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002046;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"8gbnews.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002047;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"8string.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002048;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"931125s.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002049;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"a.deluge.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002050;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"a.deluge.co.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002051;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"a.sodfirst.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002052;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"a.z2oplusm.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002053;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aa419.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002054;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aaa.fozdegen.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002055;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aaarrr.bulletprof.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002056;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aaic.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002057;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aaiv.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002058;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aaqx.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002059;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aasdaafs.wapdodoit.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002060;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aaszxr.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002061;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ab100jskd.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002062;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"abagnalefrankiezeus.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002063;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ac100djsdhg.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002064;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"acdhmegathr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002065;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ad1.alzaabi.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002066;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adaichaepo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002067;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adewright.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002068;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adidas35.freehostia.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002069;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"admcp21.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002070;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adminacces.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002071;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobe1-erbireal.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002072;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobe10-togeam.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002073;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobe2-joek.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002074;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobe4-natdup.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002075;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobe5-peltion.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002076;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobe7-jildyp.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002077;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobe8-muts.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002078;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobe9-mytdup.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002079;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobeactivation.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002080;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adobeserverupdate.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002081;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adspromo.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002082;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"advdomain235.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002083;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adwarecheck.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002084;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"adwordsformoney.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002085;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aerostuff.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002086;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aervrfhu.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002087;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aggood.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002088;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ago1980.ag.funpic.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002089;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"agreedframework.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002090;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aibieviake.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002091;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aijohcolev.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002092;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ajijpqhathr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002093;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ajjh.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002094;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"akapulkoparmitana.ws"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002095;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"alabayss.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002096;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aleksgood.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002097;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"alert35.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002098;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"alfastream.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002099;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"allibeybeach.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002100;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"alliedaeon.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002101;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aloa.asia"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002102;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"alsons.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002103;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"alssayer.ws"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002104;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"altmaforbetchrono00000.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002105;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"alwaysky.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002106;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"amar-co.si"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002107;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"amebas.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002108;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ammew.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002109;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"amring.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002110;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"amsterdamtoteheran.nl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002111;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"an-freeeze.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002112;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"analf.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002113;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"analigesto.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002114;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"analytics2.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002115;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"andige.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002116;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"andrej.andreev12.pochta.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002117;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"androzo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002118;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"antidopings.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002119;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"antispamerteam.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002120;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"antitake.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002121;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"antivir-online.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002122;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"anyhimi.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002123;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"anysearchweb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002124;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aolas.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002125;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"apollo.deltasystem.cl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002126;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"apsight.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002127;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aqqx.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002128;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"araaa.wapdodoit.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002129;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"archivopc.com.v-ddr.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002130;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ardhmeria-juaj.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002131;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"argentinos.zapto.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002132;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"armyrats.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002133;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aroolohnet.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002134;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"arsenalik.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002135;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"artrestn.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002136;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"arturfiles677.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002137;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"arturpirozhkov00.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002138;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"asbridgesburn.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002139;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"asf.wdn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002140;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ashkeytra.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002141;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"asiadomens.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002142;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"askuv.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002143;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aslrr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002144;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"asmodey.bh5.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002145;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"assdazzxcad.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002146;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"assde.asia"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002147;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"assolo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002148;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"astramani.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002149;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"asyea.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002150;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"atcer.lx.ro"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002151;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ath8net.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002152;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"atheistjkghk3242.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002153;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"atlascounter.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002154;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"atx7.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002155;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"aussiebob.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002156;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"autasienga.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002157;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"automon.com.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002158;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"autoparck.sumy.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002159;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"avalaz.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002160;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"avtomoto.limewebs.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002161;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"awawu.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002162;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"awtextile.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002163;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"azurcorporation.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002164;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b.chto.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002165;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b0fs.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002166;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b18c.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002167;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b1sh0p.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002168;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b1shop.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002169;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b1shop.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002170;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b1xs.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002171;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b2bdebtcollection.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002172;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"b2bdebtrecovery.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002173;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bacalavala.com.es"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002174;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bahoy.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002175;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"banan-service.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002176;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bananajuice21.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002177;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bandikots.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002178;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bankolocate.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002179;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"banktrustservice.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002180;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"baqrr.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002181;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"barakobrama.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002182;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"barraccuda.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002183;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"base1925.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002184;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"basicasco.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002185;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"basketballsport.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002186;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"basurm.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002187;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bawtsfkincool.fileave.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002188;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bbb.fozdegen.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002189;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bbkind.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002190;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bbls.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002191;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bequeathooh4.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002192;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bersdf.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002193;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bertoluchio.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002194;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bestconcurso.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002195;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bestsocksshop.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002196;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bestviewbar.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002197;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bestviewbars.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002198;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"biaobrgeroin.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002199;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bichalina.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002200;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigamadillo.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002201;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigamadillo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002202;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigeasysite.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002203;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigpayinfo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002204;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bigpayinfos.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002205;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bits4ever.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002206;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"biyik.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002207;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"biznesscom.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002208;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"biztoolbar.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002209;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bklcm.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002210;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bl.fcrazy.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002211;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bl.fcrazy.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002212;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bl.nemeriss.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002213;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bl.widget-des.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002214;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bl4ckst4r.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002215;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"blackhorce.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002216;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"blacktraf.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002217;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"blakoneyrenr.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002218;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"blasphemy774.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002219;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"blixsearch.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002220;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"blogjo.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002221;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bluefincafe.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002222;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bmw-pad.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002223;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bmwx6here.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002224;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bodegazonen.dk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002225;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bombomuser.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002226;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bonokur.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002227;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bookheads.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002228;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"boonz.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002229;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bootch.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002230;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"boronbolt.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002231;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"boshbf.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002232;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bot.gravityz3ro.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002233;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"botnet.gsk2.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002234;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"botnet.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002235;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bpergroup.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002236;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"brclscounter.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002237;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"briderscapes.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002238;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"broad9.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002239;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"brocfg.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002240;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"brockenmon.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002241;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"brownconsulting.com.pe"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002242;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"brunongino.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002243;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bsnes.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002244;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bubendockader.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002245;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bulba-serche.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002246;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"buterbrodio.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002247;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"bvakjyr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002248;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"c.rowfirst.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002249;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"c339.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002250;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"c7.qpdofz.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002251;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cacallcentercareers.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002252;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cactus.esstu.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002253;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cahgofoneu.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002254;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cajadomestic.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002255;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"caleb.eu5.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002256;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"calvinkleinstuffz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002257;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"caposervice.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002258;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"caramelloinze.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002259;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"carbon.allenchaconads.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002260;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"carderplanet.me"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002261;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"carvertv.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002262;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"caseoffinance.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002263;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"caucasus-a.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002264;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cavemonsterfromhell.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002265;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cca.ky"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002266;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"centraldns.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002267;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"centralspl.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002268;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"centryfag.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002269;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chakra.master-networking.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002270;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chamberwellmanor.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002271;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"checkonline-protection.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002272;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"checkrapport.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002273;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cherry.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002274;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cheryy.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002275;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chetiripolka.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002276;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chinamega.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002277;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chinaoilfactory.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002278;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chispa.nu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002279;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chlenopopik.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002280;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chotnam.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002281;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chris25project.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002282;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"chudachok9.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002283;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cin-turk.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002284;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cird.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002285;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ciscocommunity.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002286;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cleanfile.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002287;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cleanmyos.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002288;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"click-clicke.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002289;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"clientsatisfactiononline.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002290;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"clocktribuh.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002291;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"clonick.no-ip.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002292;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cncdatanetwork.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002293;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cocainy.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002294;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cocainy.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002295;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"codrx.runox.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002296;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"coffeworld.rv.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002297;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cogs.trfafsegh.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002298;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"colloquialewfe.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002299;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"colopin.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002300;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"computers-services.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002301;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"condenadoalsuerte.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002302;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"condonikzang.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002303;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"conf23452.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002304;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"conf2552.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002305;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"configchenel.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002306;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"congealagmfd6dbd.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002307;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"connectionsupport.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002308;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"contentserver.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002309;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"contexstyle.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002310;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cool.epicip.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002311;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"coolparts31.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002312;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"coolw.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002313;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"core.pr0fit.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002314;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cosavnos.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002315;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"countrtds.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002316;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"countrystar.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002317;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cquenceclothing.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002318;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"crazzzy.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002319;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"creamwithsodahan.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002320;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"creativeid.com.au"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002321;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"crexes.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002322;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"crferari.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002323;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cribrejist.kz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002324;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"crookwach.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002325;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"crowledarmor.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002326;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cs-config.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002327;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cvvsellz.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002328;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"cybertranceru.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002329;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"d4rkst4r.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002330;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dadadsaaa.wapdodoit.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002331;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dahzunaeye.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002332;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dailyair.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002333;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dailynews6x24.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002334;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dairanet.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002335;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"darktimes4biz.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002336;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"darnite.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002337;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"darrellflowers.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002338;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"data0rder.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002339;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"datingtipsforman.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002340;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"davidopolko.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002341;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dbcavsaddve.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002342;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ddkom.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002343;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"declaracion.bde.es.psdrv.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002344;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"deewaek4heeh.kz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002345;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dehtrader.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002346;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"deilaeyeew.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002347;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"delphin.w2c.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002348;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"deltoflop.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002349;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"deluz666.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002350;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"demiliawes.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002351;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"demo1.de"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002352;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"demonvoploti.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002353;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dersausko.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002354;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"designtrl.km.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002355;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"desktop.google.com.3gsuite.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002356;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"desktop.google.com.x0x0x0x0x0x0.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002357;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"develo89.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002358;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"devi56.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002359;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"devicemom.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002360;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"deviliz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002361;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dewaned.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002362;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dfrgc.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002363;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dgnews.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002364;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dildogold.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002365;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dimlerstock.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002366;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dir320yota.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002367;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"direct-point.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002368;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"directstmpl.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002369;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"discoverany.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002370;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"distribway.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002371;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"djhbzsv.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002372;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"djkksdjfkkldjslkdfj.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002373;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dledns.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002374;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dnsserverbackupzones.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002375;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dnuos.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002376;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"doctormiler.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002377;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"doctornimnul.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002378;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"doctorscam.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002379;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dog-deluxe.nl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002380;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"domain460003.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002381;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"donald-dark.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002382;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"door4.net.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002383;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dotroot.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002384;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"downloadmiddle.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002385;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"downloads.mediaoff-0011.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002386;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"downloads.mediaoff-005.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002387;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"downloads.pixhome-007.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002388;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"downloads.pixhome-009.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002389;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"downloads.pixhome-014.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002390;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"downloads.pixhome-018.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002391;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dowsonstoke.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002392;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dragelike.jino.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002393;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dresnennewsllc.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002394;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"driver-cs.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002395;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"driverupdateter.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002396;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"drtyyyt.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002397;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"drygy.mooo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002398;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ds.xdns.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002399;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dsgfopllllc.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002400;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"duribi.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002401;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"dzinternet.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002402;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"eagen85.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002403;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"easytest4us.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002404;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"eatmyshortsforever.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002405;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ecologiauto.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002406;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ectoplan.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002407;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"edatingtipsandtricks.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002408;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"eemaimocho.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002409;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"eexiziedai.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002410;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ekrantel0.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002411;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ekuns.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002412;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"elesssnet.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002413;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ellater.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002414;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ellynoise.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002415;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"elnasa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002416;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"enoraup.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002417;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"enzoforfree.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002418;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ergota.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002419;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"erorr.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002420;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"erotic4gals.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002421;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ertopolk.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002422;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"esero86.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002423;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"estero89.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002424;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"esvictory1.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002425;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"esvictory5.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002426;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"esvr1.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002427;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"esvr2.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002428;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"esvr3.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002429;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"etyet.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002430;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"eurelectrics.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002431;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"euro-transp.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002432;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"euroassistant.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002433;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"evgonar.1gb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002434;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"evqwt.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002435;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"evrorem2010.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002436;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"evvke.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002437;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ewwinvvnwieoncnuurnvn.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002438;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"excel-biz.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002439;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"exclusiveearnings.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002440;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"excode.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002441;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"exfxreporting.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002442;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"exhouse400doors.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002443;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"extrim.jr1.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002444;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"f3411ssgas.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002445;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fabrika.uzhgorod.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002446;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fancycake.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002447;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"farfa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002448;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"farsearch.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002449;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fart2074.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002450;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"farwest.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002451;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fcrazy.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002452;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fdlnpnldnssnlaksjdljksasdad.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002453;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fdsfs.wapdodoit.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002454;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"feit23.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002455;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fel0ny.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002456;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ferdinandi.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002457;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fest.snadder.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002458;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ffadd.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002459;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fhjslk21.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002460;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fiducia-securitygate.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002461;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"files-online.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002462;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"findyourkin.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002463;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"finlinkonline.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002464;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"first-shockabsorbers.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002465;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fiusdfss.wapdodoit.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002466;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fivefingers31.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002467;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fiwzv.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002468;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fixerman.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002469;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"flamefight.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002470;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"flashsecurity.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002471;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"flexinstaller.org.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002472;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"flf.kz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002473;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"floranimal.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002474;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fooofle.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002475;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"forad.cz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002476;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fordearfriends.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002477;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"foreks999.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002478;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"forexcenterhome.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002479;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"forskarskolan.se"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002480;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fortoooco.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002481;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fotosbasesite.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002482;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"foxy10000.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002483;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fpcc.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002484;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"freehost21.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002485;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"freewhois.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002486;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"friendship888.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002487;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"friendsparty.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002488;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"from-us-with-love.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002489;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"frondircass.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002490;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"fsdfsdfsd.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002491;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"futurexstream.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002492;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"g00glee.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002493;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"g3vrv3rveverfsd.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002494;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gabesflowers.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002495;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gaddem.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002496;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"galaradio.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002497;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gamecp12.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002498;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gametester.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002499;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"garant.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002500;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"garant.ivano-frankivsk.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002501;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gate234.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002502;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gaubine-forwodore.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002503;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gavnoedov.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002504;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gaxnet32.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002505;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gb100skdahsdyg.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002506;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"geekspoker.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002507;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"geleiance.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002508;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"genderswar.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002509;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"genie-hkfc.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002510;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"genri.cz.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002511;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"germinaler4he.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002512;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"geroinanety.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002513;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"geroine.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002514;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gerst66.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002515;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gfdplaytennisron.mobi"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002516;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ggooggle.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002517;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ghyas.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002518;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gibderv.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002519;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gigapayfosus.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002520;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gilsenkirhen.at"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002521;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gipnogaba777.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002522;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"globalreceive.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002523;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"globalunitrack.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002524;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"globus-trio.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002525;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gm1online.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002526;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"goawatanitooo.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002527;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gobishertech.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002528;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gointernetdating.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002529;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"goldfieldforu.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002530;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gonoristan.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002531;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gooddatingadvice.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002532;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"googie-update.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002533;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"google-analyze.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002534;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"google-bot.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002535;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"google-counter.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002536;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"google-diric.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002537;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"google-stats.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002538;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"google-stats008.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002539;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"google-update-checker.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002540;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"google223.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002541;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"googleadsenstats.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002542;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"googleanalisys.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002543;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"googleenginierung.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002544;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"googletracker.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002545;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gopuz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002546;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gorliante.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002547;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"governmentfunding.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002548;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gpt0.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002549;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"granata282.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002550;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"greatan.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002551;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"greatuk.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002552;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gredserop.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002553;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"greengirlinbighome.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002554;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"greenhead.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002555;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"greenline.cv.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002556;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"grefprostat.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002557;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gregariouszy.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002558;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"grigga-sinna.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002559;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"groov.uzhgorod.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002560;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gtrb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002561;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"gtrfz.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002562;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"guahslq.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002563;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hack-off.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002564;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hackfact.co.za"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002565;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hackingnation.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002566;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hallownets.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002567;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hamilakinec.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002568;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"happykinder.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002569;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"happyworld0nline.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002570;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"haretere.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002571;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"harflash.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002572;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hasgsa.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002573;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hassled.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002574;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"havethe.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002575;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hazelpay.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002576;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hcardoso.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002577;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"heisthat.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002578;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hellokittyn.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002579;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hellzoness.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002580;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"helmihelmi.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002581;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"helsint.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002582;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"herewereytinj.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002583;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"heroladaaw.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002584;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"herserton.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002585;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"heskdo44se.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002586;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hhjjqjghfir.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002587;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hibernawar.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002588;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hiddenowned.viefirehosting.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002589;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hihohy.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002590;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hikmesanbukais.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002591;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hilary-blog.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002592;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hilaryblog.x10.bz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002593;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hiphopniger.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002594;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"histerpryne.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002595;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"history03kf.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002596;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"historycontext.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002597;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hjelp-haiti.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002598;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hkisl.com.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002599;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"homeschoolvideo.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002600;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hometelecaring.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002601;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"homyak777.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002602;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"horonili.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002603;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"horosta.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002604;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"horosta1.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002605;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"host-data.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002606;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hostingpanelavg.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002607;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hostz-150909.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002608;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hotdot2561.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002609;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hottravels.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002610;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hozeisland.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002611;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hqcqyqlktsg.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002612;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hqll.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002613;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hronumers.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002614;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hsaaba.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002615;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hsbc-trial.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002616;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hsbc-trial.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002617;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hsbc-trial.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002618;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"huaas.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002619;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"huashna.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002620;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hub-z.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002621;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hubportalzone.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002622;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hufndas.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002623;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hulasoftz.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002624;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hulinadobaranublja.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002625;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hydrateam.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002626;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"hzo4em.vn.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002627;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iam.superfluxed.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002628;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iaoa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002629;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"icelemon.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002630;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"idigo35.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002631;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ieexv.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002632;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iefeiyusahgaineeveikooth.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002633;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ielaithereej.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002634;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iesahnaepi.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002635;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iescrow.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002636;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ieweepeeve.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002637;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iffer.asia"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002638;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iframecash.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002639;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"igetth.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002640;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iijae.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002641;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ijll.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002642;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ili-lala-ili.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002643;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iliil.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002644;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"imageaseea.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002645;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"imbiurbiej.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002646;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"img4453945.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002647;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"in49bars.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002648;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"incode.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002649;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"incornew.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002650;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"indigo49.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002651;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"infinitccoopp.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002652;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"info-news.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002653;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ingo666.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002654;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"inhaber-moack.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002655;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"instamfan.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002656;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"interhostingservicesnet.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002657;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"internazionale.vc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002658;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"inversiontrace.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002659;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iooiiooi.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002660;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iphotos.ir"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002661;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ipnatstats.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002662;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iprivate.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002663;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iproxy.nl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002664;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ipv6i.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002665;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ipvi6.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002666;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"irc.superbits.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002667;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iron-words.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002668;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"irrationalsdv3.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002669;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"islamatease.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002670;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"issimode.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002671;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"itspitsp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002672;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"itsupportworld.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002673;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ivanyi.homeip.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002674;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iveeteepew.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002675;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iwantr8.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002676;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"IWfybFyWi.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002677;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"iyahoo.me"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002678;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"izdibabu.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002679;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"j2c-crib.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002680;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jacquelinesiven.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002681;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jamesbeach.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002682;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jessw.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002683;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jfgh.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002684;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jisver.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002685;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jjaa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002686;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jjlb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002687;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jjll.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002688;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jjol.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002689;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jk100asdsadhg.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002690;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"joanglobus.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002691;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jocudaidie.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002692;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"johgheejae.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002693;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"johnm.tmweb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002694;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jokersimson.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002695;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"joysmovie.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002696;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"judiciousr347.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002697;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"juicypussyy.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002698;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"jupitermotors.com.au"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002699;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"justinnew4.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002700;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"justinnew5.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002701;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"justinnew6.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002702;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"justpaythis.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002703;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kabinaout.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002704;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kaithuushi.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002705;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kalashmalash.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002706;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kalib.eu5.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002707;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kannat.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002708;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"karenearly.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002709;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"karissmikksa.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002710;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"karma.collection.pk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002711;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kashamalasha.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002712;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kassvikiss.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002713;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kasszeukiss.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002714;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kazyvi.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002715;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kebopof.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002716;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"keholope.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002717;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"keiboghigi.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002718;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kelandiciv.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002719;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kennywest.mooo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002720;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"keroholek.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002721;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kindsms.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002722;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kiniop.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002723;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kino.vitk.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002724;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kjjm.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002725;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kkads.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002726;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"klajj.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002727;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"klastf.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002728;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"knifes4you.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002729;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kokaine.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002730;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"koloderber.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002731;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kopibara.km.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002732;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"korkd.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002733;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"koshki.hostok.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002734;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kosimbabkinaletu.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002735;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"krassoffki.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002736;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kretanlkam.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002737;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kripakripchampion.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002738;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ks357429.kimsufi.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002739;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ksakksik.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002740;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kspaibu1nasnfx87.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002741;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kukushata.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002742;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kursovie.org.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002743;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"kurupt.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002744;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"l1nn.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002745;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lab-sport.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002746;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lac3w8bu.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002747;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lake777.homeip.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002748;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lalocationmanager.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002749;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lampstage.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002750;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lanuevaeradeldesarrollo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002751;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lavandos8.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002752;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"laxahngeezoh.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002753;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"leadingcase.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002754;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"leeds-consulting.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002755;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"leeitpobbod.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002756;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lefamefilmacusto.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002757;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"leninvgorkax.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002758;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"leyew.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002759;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lightobmen.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002760;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lilia.jino.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002761;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lingartstorage.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002762;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"linmaoshuiqing.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002763;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lisaspers.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002764;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"listwowgame.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002765;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"liswegwegwegu.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002766;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"litsed.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002767;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"liturile.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002768;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"liventsov.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002769;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"livetrust.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002770;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lkda.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002771;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lkem.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002772;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"llllllllllllllllll.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002773;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lolofam.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002774;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"loloohuildifsd.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002775;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lometr.pl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002776;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lonleycin.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002777;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lonngren.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002778;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lopokerasandco.hk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002779;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lovelaser.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002780;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lovesca.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002781;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"luckyhostgf.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002782;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"luinstra-vt.nl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002783;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"lumibonu.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002784;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"m19citizen.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002785;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"m4st3r.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002786;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ma456.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002787;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"maccrack.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002788;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"macuysinstall.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002789;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"madcmx.mx"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002790;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"maddogidogi.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002791;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"maddogidogi222.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002792;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mafisiengo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002793;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"maglavais.ath.cx"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002794;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"makeadifference.be"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002795;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"malbobro.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002796;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mamama.aa.am"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002797;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"marketingsmoney.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002798;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"martyxa.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002799;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"massive-dynamic.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002800;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mathematics2u.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002801;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"maxel-vuds.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002802;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"maybelaterornot.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002803;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mazavaza.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002804;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mazavaza0087.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002805;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mcafee-registry.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002806;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mcdwhbvmthr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002807;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mclaugn.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002808;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"media1960.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002809;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"media76.pabumatrekurik.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002810;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"medriop56.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002811;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"megatuz.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002812;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"menu.mcdir.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002813;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"meowtent.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002814;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mercadoabc.com.br"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002815;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"messorg.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002816;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mfkt.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002817;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mgekohii.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002818;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mh-2.gnet.ba"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002819;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsoft-iexplorer8-update.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002820;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsoft-server4-update.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002821;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsoft-update.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002822;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsoft-updates.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002823;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsoft-vista-update.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002824;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsoft-windowsxp-update.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002825;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"microsoft-xp-update.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002826;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"milzvortex.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002827;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mir-krossover.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002828;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mitroger.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002829;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mjef.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002830;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mmjl3l45lkjbdb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002831;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mmnba.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002832;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mmoworlds.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002833;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mnobabla.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002834;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mohname333.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002835;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"molniy347.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002836;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"montaz.gr"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002837;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mooshooh.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002838;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"morda99.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002839;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mordes.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002840;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"movngs.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002841;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mroblom.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002842;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mrx.net.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002843;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"msupdatescheck.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002844;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"muchomucho.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002845;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mustangviper.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002846;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"my-oyster.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002847;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mydailymail.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002848;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mygsm-spy.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002849;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mynameisboxxy.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002850;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mypc-services10.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002851;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"myperfection.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002852;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"myphpsoft.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002853;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mystaticdatas.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002854;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mysticfamiliar.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002855;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"mywebsource.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002856;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nadvet.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002857;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"napznet.me"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002858;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"napzter13.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002859;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"narayanjik.hk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002860;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nascetur.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002861;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"naukograda.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002862;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"navigable446.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002863;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ncccnnnc.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002864;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nebwsy.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002865;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nekovo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002866;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nelmafirstusa.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002867;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nemohuildifsd.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002868;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nemohuildiin.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002869;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nerow.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002870;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"net.lovealiy.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002871;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"net.staedew.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002872;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netcarfind.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002873;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"netornotin.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002874;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"networksolutions5.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002875;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"neuromint.bz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002876;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nevereversite.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002877;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"newbraga.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002878;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"newconcurso.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002879;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"newrus.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002880;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"newsbosnia.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002881;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nextpics.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002882;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nfruhskhfts.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002883;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nicefilmsa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002884;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"niposedas.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002885;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nisol.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002886;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nissanmoto.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002887;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nnam.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002888;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nnee.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002889;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"noabuseplease.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002890;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"noprtus.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002891;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nordrilskre.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002892;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nospam.km.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002893;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nsboxdownblodmids.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002894;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nsirgey.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002895;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nudlkasnuls.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002896;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nukaszqz.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002897;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nuzi.com.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002898;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"nvffr.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002899;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oashae2ieyek.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002900;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"odboe.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002901;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ofruv.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002902;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ogagarin.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002903;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ohmaebahsh.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002904;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ohphahfech.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002905;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oiav84.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002906;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"okrison.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002907;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"olandik.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002908;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oldcarsforrent.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002909;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oliku.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002910;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"on-line-analytics.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002911;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onlinecentralstore.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002912;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onlinegazik.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002913;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onlinelicensechecker.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002914;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onlinestik.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002915;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onlinewebcenter.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002916;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"onlynet.bnetinvaderz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002917;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oomseekerss.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002918;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ootaivilei.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002919;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"openslp.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002920;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ophaeghaev.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002921;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"opllllc.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002922;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"oracleoledb.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002923;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"otherall.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002924;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"otherchina.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002925;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"otimagrafica.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002926;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ouiu.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002927;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"outinfo.studenthost.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002928;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"p1anka.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002929;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"panmiamibeach.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002930;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"parfaitpournous.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002931;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"parliament.tk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002932;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pausestorm.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002933;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pax08.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002934;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"paypay.co"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002935;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pdx1online.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002936;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pelmeshko.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002937;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"perezinstitute.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002938;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"perichikkk.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002939;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"permanentgoodazmark.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002940;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"perrys.ath.cx"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002941;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"persivkrovis.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002942;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"phaizeipeu.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002943;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"phcconsulting.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002944;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"photobank.pasweokz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002945;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"photostock.pasweq.co.kr"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002946;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"photovideo.uz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002947;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"picula.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002948;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pilonoc.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002949;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pinzec.hut2.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002950;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pinzec1.hut2.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002951;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pipeccc.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002952;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pipiskin.hk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002953;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pitorysoue.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002954;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"platinal.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002955;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"platinumhostingservice.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002956;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"platnuki.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002957;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pllae.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002958;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"plumberg.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002959;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"plumberga.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002960;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pnp2biz.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002961;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pnp2bizforum.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002962;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pobedim.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002963;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"podgorz.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002964;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"podzemje.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002965;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pogoaliceadvance.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002966;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"polygraphy-p.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002967;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"popunserv.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002968;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pornoland7.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002969;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"portisheadmusic15.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002970;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"postmetoday.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002971;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"poteriapoter.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002972;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pozemk.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002973;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ppherph.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002974;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pradsuyz.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002975;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pravolevo.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002976;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pravoved.pl.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002977;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"prawns.kosherfishery.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002978;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"presentsdelivery.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002979;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"preypal.org.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002980;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"primusdns.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002981;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"print-design.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002982;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"printbalance.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002983;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pro-dancing.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002984;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"profincorp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002985;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"progledeltru.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002986;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"projectcurtis.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002987;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"projectijtihad.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002988;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"promo-standart.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002989;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"promodetz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002990;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"promowho.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002991;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"protologim.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002992;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"psycho.lv"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002993;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pteradaktel.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002994;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ptichkaleti88.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002995;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"puppetmasterz.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002996;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"purplepron.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002997;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pusicat.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002998;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"pxcallcentercareers.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7002999;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"qpolf.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003000;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"qpsk2.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003001;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"quebec3465.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003002;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"quickshows.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003003;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"qyclub.com.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003004;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"railuhocal.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003005;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rainbox.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003006;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ramblerbot.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003007;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ramona4u.go.ro"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003008;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rapidshareds.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003009;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"raskeni.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003010;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"raushan.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003011;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"real-warez.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003012;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"realfun.ro"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003013;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"realtorrentltd.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003014;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"realtybestus.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003015;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"recessa.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003016;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"recover777.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003017;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"recover7777.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003018;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"recover88888.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003019;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"recrush.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003020;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"redee3e.com.pl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003021;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"redirectoff.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003022;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"redmapsis.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003023;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"redondo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003024;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ree.fcrazy.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003025;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"regaledgh7.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003026;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"regularsystemupdates.asia"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003027;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"reklamaservice.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003028;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"reklamen6.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003029;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"reklamen7.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003030;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"relaxsearch.uphero.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003031;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"remot.today-saturday.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003032;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rendom.mx"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003033;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"repkamouse.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003034;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"repuzer.net.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003035;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"reservedomainforzs1.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003036;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"revoset.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003037;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rezervzv.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003038;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"riaptfnrvmr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003039;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rizzle.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003040;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rjkifj.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003041;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rmtiw.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003042;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ro.cybercartel.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003043;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"robertomilanomoreomglol.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003044;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"robotbobot.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003045;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"robul.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003046;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rodjerio.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003047;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"roideada.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003048;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"romanticdateonline.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003049;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"roop.barxlays.co.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003050;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"roundhome.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003051;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rp-legal.ro"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003052;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rpmm0.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003053;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rrrekti.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003054;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rsafw.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003055;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rttta.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003056;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rubychief.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003057;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rulesselur.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003058;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"runtarius.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003059;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ruskod.com.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003060;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ruskod.net.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003061;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ruskod.org.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003062;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"russianmomds.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003063;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"rustat.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003064;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ruxyjatech.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003065;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"s-domain.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003066;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"safe-web.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003067;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"safeserfing.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003068;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"safewhales.ws"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003069;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"saill.asia"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003070;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"saintsup.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003071;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sakura2.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003072;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"salamandainword.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003073;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"salx.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003074;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"samson.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003075;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"saragranroth.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003076;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sas.1337hosting.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003077;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sashahost.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003078;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sattor.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003079;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"scan-sec.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003080;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sdlls.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003081;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"searchadvertsol.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003082;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"searchbestsleep.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003083;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"seawizard.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003084;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sec.livecasting33.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003085;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"seclinezzz.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003086;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"secure-networks.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003087;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"secure.valid.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003088;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"securesustemupdates.asia"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003089;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"securityinternacces.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003090;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sedoborod.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003091;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sefergtrserfv.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003092;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sefergtrserfv.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003093;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"seistic.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003094;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sekmoon.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003095;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"senrofay.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003096;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"serfinworld.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003097;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sergeus200.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003098;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sero86.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003099;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"server.18cyber.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003100;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"server1.servingsupport.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003101;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"servermail.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003102;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"servertransporternews.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003103;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"serviceexe.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003104;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"servicesocks5.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003105;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"servtemp.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003106;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"setyupdate.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003107;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sexypupsik.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003108;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"shadowtycoon.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003109;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"shd3h80nd348dhn348f34hinom9io.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003110;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"shipal.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003111;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ships.ath.cx"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003112;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"shkafu.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003113;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"shkens.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003114;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"showersystemreviews.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003115;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"shwarzgold.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003116;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"siftozzillaa.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003117;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"silence7.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003118;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"silentpanel.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003119;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"silvton.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003120;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"simmentog.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003121;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sir-t.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003122;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sirius-socks.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003123;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sj82hags6.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003124;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"skodaligthcx.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003125;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"slasher.c2boffshore.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003126;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"slavenkad.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003127;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"slmsezs.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003128;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"slmstse.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003129;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"slsmdns.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003130;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smallteam.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003131;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smile.if.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003132;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smlsesd.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003133;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smmazdt.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003134;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"smmseza.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003135;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sng-soft.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003136;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sobakozgav.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003137;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"socks5servise.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003138;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"softinfosite.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003139;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sollutsn.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003140;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"solo1928.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003141;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sonyproduction.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003142;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sosiska.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003143;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sourtel.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003144;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sourtel1.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003145;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spacebuxer.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003146;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spacecountry.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003147;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spainfoodandwine.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003148;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spanukk.phpnet.us"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003149;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sparkleroads.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003150;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spasicomp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003151;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spendolo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003152;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spics.servepics.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003153;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"spiritnum.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003154;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sportfinish.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003155;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sportshots.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003156;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sprottcareers.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003157;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"srty.nei28.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003158;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"srvdlls.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003159;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ssdzamd.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003160;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sseusms.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003161;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ssezsea.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003162;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ssl-molotok.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003163;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sslillisilsltlis.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003164;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sstdsclick1.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003165;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"st-resources.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003166;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"starcountry.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003167;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"starsico.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003168;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"start.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003169;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"static-bay.org.uk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003170;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"statistics-of-world.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003171;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"stats.kuldipadvertisements.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003172;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sthsdla.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003173;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"stomaid.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003174;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"stopwarsintheworld.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003175;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"stovery.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003176;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"strbypass.uz.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003177;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"streetstorm.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003178;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"subaruservice.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003179;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"subvencionwest.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003180;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sumyho.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003181;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"supermamba.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003182;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"suphazgdman.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003183;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sureameritradex.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003184;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"susez.mine.nu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003185;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"suvaf.wapdodoit.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003186;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"svinopavstvo.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003187;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"svyazko.3rdx.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003188;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"swedpank.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003189;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sympathy.hdnews.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003190;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"symyho331.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003191;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"symyho3393245.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003192;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"sys32.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003193;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"szsdmst.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003194;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"szsemse.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003195;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"szysese.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003196;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"szzssda.co.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003197;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"t0rb.tk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003198;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ta1ch1.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003199;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"taboo.serveblog.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003200;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"taipeifubonban.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003201;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"talents-dz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003202;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tarstall.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003203;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tdsnumero.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003204;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"technoplast.com.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003205;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"technotronics.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003206;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"technotrucks.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003207;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tempr.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003208;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"test2.salefale.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003209;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thebfdshop.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003210;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thedownget.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003211;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thefinmodel.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003212;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"theit.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003213;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thelegallywildbunch.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003214;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thelinx.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003215;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"theprotection.km.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003216;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thereismypuper-gb.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003217;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thereismysuper-d.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003218;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thetrinity.com.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003219;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"theusbwebsite.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003220;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"thewayithastobe.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003221;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"this-all-clean.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003222;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"threemonthscar.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003223;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tieos.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003224;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tigerm.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003225;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tiho.polomaem.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003226;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tissot333.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003227;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tjkd.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003228;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tjkleen.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003229;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"to.zuo.hu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003230;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tobacktoback.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003231;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tolima.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003232;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tollukk88.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003233;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tomorrrrow.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003234;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"top5000.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003235;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"top5z.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003236;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"torbaaa.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003237;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"torre.asia"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003238;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"totalunix.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003239;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"toutube.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003240;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"toxicfree.ssht.kr"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003241;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tr1dent.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003242;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trachsel.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003243;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tracker.bizrgm.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003244;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"traff.street-info.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003245;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trafficsupple.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003246;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"transjapan.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003247;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"translatespanish.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003248;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"transliators.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003249;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"transport96.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003250;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tranzmerc.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003251;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"traskl.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003252;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trastlifer.hk"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003253;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"treverthisone.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003254;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trfn.salefale.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003255;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trinnitti-soft.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003256;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"trollar.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003257;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ttl-host.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003258;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tttbbbttt.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003259;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tuktuk.su"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003260;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tutsi.net.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003261;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"tvbingoshow.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003262;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ubagubagurame.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003263;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ubojnajasila.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003264;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ubuuntu.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003265;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uffertyew.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003266;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uiao.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003267;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uk.69.mu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003268;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ukboox.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003269;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ukcallcentercareers.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003270;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ukliit.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003271;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ukosp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003272;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uktop10banksreview.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003273;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ultra-light4u.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003274;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"umor.sumy.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003275;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"unedge.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003276;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uniqez.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003277;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"unoparketiklo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003278;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"untitled-themovie.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003279;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"update-flash.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003280;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"update-java3.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003281;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"update-java4.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003282;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"update-kabul.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003283;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"update-office.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003284;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"update4ever.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003285;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uplevelgmno.vn.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003286;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uploadhost.zapto.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003287;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"urbanmilk.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003288;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"url.fmip.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003289;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"usa.hostbaron.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003290;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uscguard.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003291;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"userprivileges.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003292;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ushenkohuivolosatiy.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003293;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ushship.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003294;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ustunoto.com.tr"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003295;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uyerfbvo.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003296;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"uytrec.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003297;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"v-murmanske.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003298;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vaiocluberifvreiwweuv.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003299;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"validating.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003300;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"varxx.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003301;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vaseacubmw.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003302;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vaseajretikru.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003303;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vazegdurak.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003304;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vbcveeuvthr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003305;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vbmn.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003306;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vds-6ae9.1gb.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003307;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"velokot.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003308;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ventureiusaj.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003309;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"verde.esmasamor.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003310;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"veridatalookup.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003311;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"verter2010.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003312;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vertucom62.me"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003313;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"verybigmoney.cv.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003314;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vfgplnovthr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003315;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"victorry.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003316;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"videobusiness.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003317;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vilkgood.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003318;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vinodel.if.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003319;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vipcont.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003320;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vipeks.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003321;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"viponlineshopworld.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003322;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"visatour.asia"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003323;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vk-bot.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003324;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vkontakte-theme.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003325;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vkontax.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003326;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vkpriz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003327;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vladimir-dz.dynalias.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003328;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vladlen.real-host.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003329;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vohphozeeg.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003330;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"voidrage.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003331;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"voina83737.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003332;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"volkahatab.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003333;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"volkanboya.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003334;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vopret.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003335;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"voraciousutre5.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003336;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"voraojoong.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003337;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vrvv.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003338;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vseserioznocb.megabyet.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003339;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vviv.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003340;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vvmmp.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003341;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"vxuservx.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003342;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wabkvtiwthr.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003343;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"walterex.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003344;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wcup2010.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003345;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"web-e-mail.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003346;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"webentersite.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003347;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"webmoney-job.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003348;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"weed.sindromx.net.ua"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003349;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"weedies.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003350;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"werh.biz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003351;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"werrrcorp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003352;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"whiteagngo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003353;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"whitehorce.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003354;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"whoismak.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003355;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wifahquaht.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003356;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wildbunchwtf.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003357;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"williamsentry.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003358;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wind10.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003359;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"windows-update.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003360;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"windows-update210.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003361;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"windows7-catalog.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003362;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"windowsserverinfo.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003363;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"winsofter.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003364;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wmatm.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003365;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wmbarnaul.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003366;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wngo.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003367;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wolfinformatics.ch"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003368;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"woodeko.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003369;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"woodruby.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003370;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"woot.ccpower.bz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003371;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"worksofast.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003372;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"worldnetdirect.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003373;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"worldwesttrans.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003374;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wrangel55.biz.preview.ihc.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003375;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wrefraquaf.tw"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003376;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wvvl.faramandi.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003377;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wvvw.dns-configs.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003378;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wvvw.my-dns-stat.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003379;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wvw.msnstats.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003380;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wvw.stats-serv.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003381;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.aksobor.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003382;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.alcamarsaci.cl"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003383;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.fem2.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003384;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.gaddem.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003385;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.kazanovshina.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003386;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.n950.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003387;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.salamandainword.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003388;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.tklasx.da.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003389;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.win-uploads.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003390;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"www.your-updates.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003391;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"wxw.ms-update.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003392;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"x-monitoring.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003393;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xareemudeixa.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003394;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xborjom.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003395;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xcorp.net.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003396;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xe54.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003397;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xee1aeph2aay.kz"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003398;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xepace.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003399;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xiphrix.customer.attikh.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003400;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xsnatch.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003401;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xvaluegate.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003402;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xw0v.info"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003403;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xx-monitoring.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003404;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xxxdessert.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003405;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xxxvidzforfree.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003406;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"xyseinobama.name"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003407;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yad.stelladimare.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003408;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yeeshiedot.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003409;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yesandns.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003410;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yesoc.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003411;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"ygyg.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003412;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"youmoneyway.cc"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003413;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"your-up-search.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003414;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yourgoogleanalytics.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003415;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yourgoogleanalytics.eu"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003416;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yourgunparts.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003417;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yourkep.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003418;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"youwillfindtheresomethinginterestinf.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003419;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yrganosserx.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003420;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yrots.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003421;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yyer.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003422;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"yyycejui.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003423;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"z.ins.ge"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003424;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"z.peliman.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003425;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"z.poafirst.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003426;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"z.sunbon.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003427;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"z140877.infobox.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003428;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"z141795.infobox.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003429;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zadovsite.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003430;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zaebalivse.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003431;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zanga.haos.ro"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003432;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zbzr.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003433;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zebra.ignorelist.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003434;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zeferesds.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003435;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zephehooqu.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003436;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zeppbrannigan.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003437;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zerg-invest.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003438;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zeromagic.spb.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003439;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zeus-logs.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003440;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zeus.bnetinvaderz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003441;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zeusbot.xvn.in"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003442;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zeusbotnet.dvrdns.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003443;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zevaka2.cn"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003444;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zion-z0ne.net"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003445;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zmagazine.ru"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003446;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zonephp.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003447;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zouweengongohgaegeetiebi.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003448;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zroot.info.tm"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003449;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zuo.podgorz.org"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003450;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zxfr.salefale.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003451;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Zeus"; flow: to_server,established; content:"zzzzzz.com"; reference:url,www.abuse.ch; classtype:policy-violation;sid:7003452;)