# DNS SpyEye rules by Jack Pepper ( pepperjack@autoshun.org ) # regenerated periodically from the domains file at abuse.ch # The URL for the abuse.ch site: https://SpyEyetracker.abuse.ch/blocklist.php?download=domainblocklist # The source URL for this http://www.autoshun.org/downloads/SpyEyedomain.rules # # # Wed, 22 Feb 2012 02:18:02 -0600 # Error on ################################################################################ # Error on # abuse.ch SpyEye domain blocklist # # Error on # # # Error on # For questions please referer to https://spyeyetracker.abuse.ch/blocklist.php # # Error on ################################################################################ # Error on alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 13copacabana37.u2m.ru"; content:"|0e|13copacabana37|03|u2m|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139091; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 21go4mc.ru"; content:"|07|21go4mc|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139092; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 2go4mc.ru"; content:"|06|2go4mc|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139093; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 445566889900.com"; content:"|0c|445566889900|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139094; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 4yourcsecret.co.tv"; content:"|0c|4yourcsecret|02|co|02|tv"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139095; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 666acor666.com"; content:"|0a|666acor666|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139096; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 7hrh.com"; content:"|04|7hrh|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139097; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 98up.com"; content:"|04|98up|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139098; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain 99999ss.ru"; content:"|07|99999ss|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139099; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain a2535245.com"; content:"|08|a2535245|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139100; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain abelopatianeer.ru"; content:"|0e|abelopatianeer|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139101; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain abradtaingenb.ru"; content:"|0d|abradtaingenb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139102; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain abuniationeyan.com"; content:"|0e|abuniationeyan|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139103; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain activation-card.ru"; content:"|0f|activation-card|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139104; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain adonn.ru"; content:"|05|adonn|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139105; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ae-21-70.car1.losangeles1.level-3.us"; content:"|08|ae-21-70|04|car1|0b|losangeles1|07|level-3|02|us"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139106; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ae-21-70.car1.newyork1.levei-3.net"; content:"|08|ae-21-70|04|car1|08|newyork1|07|levei-3|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139107; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ae-4-90.edge2.dallas3.level-3.me"; content:"|07|ae-4-90|05|edge2|07|dallas3|07|level-3|02|me"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139108; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ae-63-26.cbr2.losangeles1.edge02.net"; content:"|08|ae-63-26|04|cbr2|0b|losangeles1|06|edge02|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139109; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain affinity.modeldns.com.au"; content:"|08|affinity|08|modeldns|03|com|02|au"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139110; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain allegro.gmb.pl"; content:"|07|allegro|03|gmb|02|pl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139111; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain allin2right4you.com"; content:"|0f|allin2right4you|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139112; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain allyneed.ru"; content:"|08|allyneed|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139113; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain alpha.supportman.su"; content:"|05|alpha|0a|supportman|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139114; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain alunionylogen.ru"; content:"|0d|alunionylogen|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139115; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain amsterbtn.vv.cc"; content:"|09|amsterbtn|02|vv|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139116; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain analservice.eu"; content:"|0b|analservice|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139117; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain aniani.info"; content:"|06|aniani|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139118; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain anotherfutureday.ru"; content:"|10|anotherfutureday|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139119; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain antfraud.co.cc"; content:"|08|antfraud|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139120; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain aor64avg.com"; content:"|08|aor64avg|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139121; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain armnpls.tk"; content:"|07|armnpls|02|tk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139122; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain arsenceumptor.ru"; content:"|0d|arsenceumptor|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139123; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain artvideo3d.ru"; content:"|0a|artvideo3d|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139124; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain asdaqr15.com"; content:"|08|asdaqr15|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139125; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain astaloscojonesbck.net.in"; content:"|11|astaloscojonesbck|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139126; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ayotechnologyblack.com"; content:"|12|ayotechnologyblack|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139127; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain babargeya789.ru"; content:"|0c|babargeya789|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139128; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain banercom.net"; content:"|08|banercom|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139129; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bannedcellebs.biz"; content:"|0d|bannedcellebs|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139130; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bannermegan2all.ru"; content:"|0f|bannermegan2all|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139131; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain baxo6pa7bo.com"; content:"|0a|baxo6pa7bo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139132; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bbberto9.ru"; content:"|08|bbberto9|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139133; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bbsmort.com"; content:"|07|bbsmort|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139134; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain beliimedvedkinfetki.ru"; content:"|13|beliimedvedkinfetki|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139135; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain besikdns.com"; content:"|08|besikdns|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139136; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain best-trololo.com"; content:"|0c|best-trololo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139137; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bezdarniki.com"; content:"|0a|bezdarniki|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139138; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bigmannn.ru"; content:"|08|bigmannn|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139139; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bisletravepa.ru"; content:"|0c|bisletravepa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139140; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain blackbmw.ru"; content:"|08|blackbmw|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139141; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain blinkltd.ru"; content:"|08|blinkltd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139142; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bombcreatorinvis.com"; content:"|10|bombcreatorinvis|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139143; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain borefx.com"; content:"|06|borefx|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139144; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bossgrangou.com"; content:"|0b|bossgrangou|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139145; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bp.olofyj.ru"; content:"|02|bp|06|olofyj|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139146; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain brainst.info"; content:"|07|brainst|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139147; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain broflergame.com"; content:"|0b|broflergame|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139148; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain brop.be"; content:"|04|brop|02|be"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139149; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain bropbrap.be"; content:"|08|bropbrap|02|be"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139150; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain brredret.ru"; content:"|08|brredret|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139151; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain burgermannnn7719.biz"; content:"|10|burgermannnn7719|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139152; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain burtkompe.com"; content:"|09|burtkompe|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139153; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain canoede.info"; content:"|07|canoede|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139154; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain capodeicapi.eu"; content:"|0b|capodeicapi|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139155; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain catalonianin.in"; content:"|0c|catalonianin|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139156; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain catch-crazycatfish.com"; content:"|12|catch-crazycatfish|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139157; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain cdn102.com"; content:"|06|cdn102|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139158; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain centralintelligenceagency.ru"; content:"|19|centralintelligenceagency|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139159; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain cerec.ru"; content:"|05|cerec|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139160; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain chanelworldnews.org"; content:"|0f|chanelworldnews|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139161; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain checkservicenow.ru"; content:"|0f|checkservicenow|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139162; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain chellotanno.ru"; content:"|0b|chellotanno|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139163; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain chesterfield.net.in"; content:"|0c|chesterfield|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139164; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain cholifo.info"; content:"|07|cholifo|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139165; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain chupikola579.com"; content:"|0c|chupikola579|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139166; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ciscoc.ru"; content:"|06|ciscoc|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139167; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain cmn12.com"; content:"|05|cmn12|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139168; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain columnisttt.net"; content:"|0b|columnisttt|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139169; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain coolbmw.ru"; content:"|07|coolbmw|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139170; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain cravityaz.ru"; content:"|09|cravityaz|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139171; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain creativesscoms.com"; content:"|0e|creativesscoms|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139172; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain cryingfreemen.ru"; content:"|0d|cryingfreemen|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139173; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain da3bom7ano.com"; content:"|0a|da3bom7ano|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139174; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dabtune4.eu"; content:"|08|dabtune4|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139175; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain daily-opinion.com"; content:"|0d|daily-opinion|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139176; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain darelleum.info"; content:"|09|darelleum|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139177; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain deeprunning2000.ru"; content:"|0f|deeprunning2000|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139178; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dfenhfenj4ojf.com"; content:"|0d|dfenhfenj4ojf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139179; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain diexe.ru"; content:"|05|diexe|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139180; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain diexr.ru"; content:"|05|diexr|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139181; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dineromode.dvrdns.org"; content:"|0a|dineromode|06|dvrdns|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139182; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dinurchik.org"; content:"|09|dinurchik|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139183; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dnsfiarfucktorylockup.in"; content:"|15|dnsfiarfucktorylockup|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139184; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dnsvirtualmc.com"; content:"|0c|dnsvirtualmc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139185; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain doliv777.com"; content:"|08|doliv777|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139186; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain domsterns.com"; content:"|09|domsterns|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139187; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dongdog.ru"; content:"|07|dongdog|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139188; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dontstop2346210.com"; content:"|0f|dontstop2346210|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139189; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dragobva.net"; content:"|08|dragobva|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139190; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain drookinabra.ru"; content:"|0b|drookinabra|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139191; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain druid1kkun.com"; content:"|0a|druid1kkun|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139192; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain dunkanmcclt.ru"; content:"|0b|dunkanmcclt|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139193; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain earlyship.ru"; content:"|09|earlyship|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139194; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain eclada.co.uk"; content:"|06|eclada|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139195; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain eclipsebooting.co.cc"; content:"|0e|eclipsebooting|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139196; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain enscorose.com"; content:"|09|enscorose|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139197; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain erokatan.com"; content:"|08|erokatan|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139198; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain estadisticasyreportes.ru"; content:"|15|estadisticasyreportes|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139199; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain etopala4.com"; content:"|08|etopala4|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139200; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain evennote1990.com"; content:"|0c|evennote1990|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139201; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain evoloutainary.co.cc"; content:"|0d|evoloutainary|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139202; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain eyesecurr327458.net"; content:"|0f|eyesecurr327458|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139203; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain fff44gfsfdsdfsdf.com"; content:"|10|fff44gfsfdsdfsdf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139204; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain fghrthn.cz.cc"; content:"|07|fghrthn|02|cz|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139205; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain fgrag3.com"; content:"|06|fgrag3|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139206; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain findmoreprofit.com"; content:"|0e|findmoreprofit|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139207; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain firstgetbt.com"; content:"|0a|firstgetbt|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139208; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain fitle8.com"; content:"|06|fitle8|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139209; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain fitoptkk.tk"; content:"|08|fitoptkk|02|tk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139210; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain fl8ku.com"; content:"|05|fl8ku|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139211; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain flashpokerist.ru"; content:"|0d|flashpokerist|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139212; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain frdik999.ru"; content:"|08|frdik999|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139213; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain freakcan.ru"; content:"|08|freakcan|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139214; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain fredxs3231.co.cc"; content:"|0a|fredxs3231|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139215; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain freemovies.white-shopping.com"; content:"|0a|freemovies|0e|white-shopping|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139216; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain funtovik.com"; content:"|08|funtovik|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139217; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain gameopiloris.com"; content:"|0c|gameopiloris|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139218; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ganja.mine.nu"; content:"|05|ganja|04|mine|02|nu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139219; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain garnizonworld.com"; content:"|0d|garnizonworld|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139220; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain getodkeltyo.com"; content:"|0b|getodkeltyo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139221; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain getpost.in"; content:"|07|getpost|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139222; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain globallaty.ru"; content:"|0a|globallaty|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139223; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain gmzopilori.com"; content:"|0a|gmzopilori|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139224; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain gogofuck.eu"; content:"|08|gogofuck|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139225; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain gok-shops.com"; content:"|09|gok-shops|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139226; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain gold.perfurtorkerhortar.com"; content:"|04|gold|12|perfurtorkerhortar|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139227; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain googletranlateservice.in"; content:"|15|googletranlateservice|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139228; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain goorsitk.com"; content:"|08|goorsitk|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139229; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain goreeotuma.ru"; content:"|0a|goreeotuma|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139230; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain gotriha.com"; content:"|07|gotriha|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139231; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain granford.ru"; content:"|08|granford|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139232; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain greathell.ru"; content:"|09|greathell|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139233; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain gui2hiphop.ru"; content:"|0a|gui2hiphop|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139234; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain guide2buy.ru"; content:"|09|guide2buy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139235; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hahahaitismydome.in"; content:"|10|hahahaitismydome|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139236; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hairfallsolutionz.com"; content:"|11|hairfallsolutionz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139237; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain haixcomatic89.in"; content:"|0d|haixcomatic89|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139238; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hallpublic.com"; content:"|0a|hallpublic|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139239; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain harnoved.ru"; content:"|08|harnoved|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139240; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hdkajhslalskjd.ru"; content:"|0e|hdkajhslalskjd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139241; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hellotryo.cz.cc"; content:"|09|hellotryo|02|cz|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139242; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hhasdalkjjfasd.ru"; content:"|0e|hhasdalkjjfasd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139243; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hireiar.ru"; content:"|07|hireiar|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139244; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hoploit888.ru"; content:"|0a|hoploit888|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139245; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain horchecker.com"; content:"|0a|horchecker|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139246; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain housbard.com"; content:"|08|housbard|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139247; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain http-y.ru"; content:"|06|http-y|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139248; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hydracock.ru"; content:"|09|hydracock|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139249; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain hypasoyergina.info"; content:"|0d|hypasoyergina|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139250; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain infosightreview.com"; content:"|0f|infosightreview|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139251; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain insubp.info"; content:"|06|insubp|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139252; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain invintor.net"; content:"|08|invintor|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139253; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain iporpip.ru"; content:"|07|iporpip|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139254; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ircbot.blogdns.net"; content:"|06|ircbot|07|blogdns|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139255; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain isbtnn.cz.cc"; content:"|06|isbtnn|02|cz|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139256; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain itxsolutions.ru"; content:"|0c|itxsolutions|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139257; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain jamuser.com"; content:"|07|jamuser|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139258; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain joomlaext.org"; content:"|09|joomlaext|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139259; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain jotraplor.com"; content:"|09|jotraplor|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139260; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain justcrs.eu"; content:"|07|justcrs|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139261; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain kaleidosskop.ru"; content:"|0c|kaleidosskop|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139262; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain kappazduliko.com"; content:"|0c|kappazduliko|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139263; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain karakumkonfetki.ru"; content:"|0f|karakumkonfetki|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139264; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain karpachiolo.ru"; content:"|0b|karpachiolo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139265; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain kirkolvartsn.com"; content:"|0c|kirkolvartsn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139266; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain kllissoks.com"; content:"|09|kllissoks|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139267; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain koletrezzo.ru"; content:"|0a|koletrezzo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139268; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain koletrezzo22.ru"; content:"|0c|koletrezzo22|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139269; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain krufop.com"; content:"|06|krufop|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139270; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain lanfrandik7.com"; content:"|0b|lanfrandik7|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139271; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain leskryshil.ru"; content:"|0a|leskryshil|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139272; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain lessice.ru"; content:"|07|lessice|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139273; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain lifofastranger.com"; content:"|0e|lifofastranger|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139274; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain litremiro.com"; content:"|09|litremiro|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139275; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain livedieoslix.com"; content:"|0c|livedieoslix|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139276; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain loadme2you.ru"; content:"|0a|loadme2you|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139277; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain logyrush.info"; content:"|08|logyrush|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139278; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain londonsbug.com"; content:"|0a|londonsbug|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139279; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain lu4isa.com"; content:"|06|lu4isa|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139280; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain magicmartini1.com"; content:"|0d|magicmartini1|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139281; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain magicmartini4en1.com"; content:"|10|magicmartini4en1|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139282; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain main.romari0.su"; content:"|04|main|07|romari0|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139283; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain maniax.strangled.net"; content:"|06|maniax|09|strangled|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139284; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain market.ecommrs.info"; content:"|06|market|07|ecommrs|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139285; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain markizac.com"; content:"|08|markizac|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139286; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain markizak.com"; content:"|08|markizak|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139287; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain markizan.com"; content:"|08|markizan|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139288; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain matrioska.net.in"; content:"|09|matrioska|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139289; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain media.cfa4.com"; content:"|05|media|04|cfa4|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139290; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain messertok.ru"; content:"|09|messertok|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139291; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain metallocon.ru"; content:"|0a|metallocon|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139292; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain microwavecolosol.com"; content:"|10|microwavecolosol|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139293; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain mijntabtime.com"; content:"|0b|mijntabtime|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139294; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain mildtune.ru"; content:"|08|mildtune|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139295; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain milloneti.net.in"; content:"|09|milloneti|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139296; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain millonetibck.net.in"; content:"|0c|millonetibck|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139297; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain mlbtnnew.cx.cc"; content:"|08|mlbtnnew|02|cx|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139298; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain mmggttjjll.com"; content:"|0a|mmggttjjll|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139299; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain mobil-prize.com"; content:"|0b|mobil-prize|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139300; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain mobilupdateonline.org"; content:"|11|mobilupdateonline|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139301; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain musicsoulreaver.ru"; content:"|0f|musicsoulreaver|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139302; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain musictherealsouldx.ru"; content:"|12|musictherealsouldx|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139303; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain mydnsniggaz.ru"; content:"|0b|mydnsniggaz|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139304; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain n3ot6op.com"; content:"|07|n3ot6op|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139305; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain nemiroffvodka.in"; content:"|0d|nemiroffvodka|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139306; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain neweuropeconsult.com"; content:"|10|neweuropeconsult|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139307; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain no-cartoon-net.com"; content:"|0e|no-cartoon-net|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139308; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain nokiamobilecorporation.in"; content:"|16|nokiamobilecorporation|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139309; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain novodebt.net"; content:"|08|novodebt|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139310; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain nowtorrent.ru"; content:"|0a|nowtorrent|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139311; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain obamaunreleased.com"; content:"|0f|obamaunreleased|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139312; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain off2off4sea.ru"; content:"|0b|off2off4sea|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139313; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain officebook1.org"; content:"|0b|officebook1|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139314; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain officebook11.org"; content:"|0c|officebook11|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139315; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain olyapolya.com"; content:"|09|olyapolya|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139316; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain on.rucl.ru"; content:"|02|on|04|rucl|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139317; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain opilori.com"; content:"|07|opilori|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139318; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain optimizzzm.ru"; content:"|0a|optimizzzm|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139319; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain oralania.com"; content:"|08|oralania|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139320; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain orgnetpro4u.ru"; content:"|0b|orgnetpro4u|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139321; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ourtulip.ru"; content:"|08|ourtulip|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139322; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain pacman.net.in"; content:"|06|pacman|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139323; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain paparazzion.com"; content:"|0b|paparazzion|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139324; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain peppercomdefa.com"; content:"|0d|peppercomdefa|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139325; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain pereostanovka.ru"; content:"|0d|pereostanovka|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139326; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain picomarkets.ru"; content:"|0b|picomarkets|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139327; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain plan2000putina.ru"; content:"|0e|plan2000putina|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139328; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain pleasekindlyuse.com"; content:"|0f|pleasekindlyuse|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139329; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain plsndmesnrudh-aerndmxsewnct.ru"; content:"|1b|plsndmesnrudh-aerndmxsewnct|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139330; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain pobedddittto.com"; content:"|0c|pobedddittto|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139331; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain poorikandazila.ru"; content:"|0e|poorikandazila|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139332; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain pornstarspoint.com"; content:"|0e|pornstarspoint|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139333; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain primaryconnectserver.org"; content:"|14|primaryconnectserver|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139334; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain quinncurry0.com"; content:"|0b|quinncurry0|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139335; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain randomcrappy.com"; content:"|0c|randomcrappy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139336; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain rangemaster777u.ru"; content:"|0f|rangemaster777u|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139337; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain raptag.ru"; content:"|06|raptag|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139338; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain rebekkasolte.com"; content:"|0c|rebekkasolte|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139339; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain registrationstables.com"; content:"|13|registrationstables|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139340; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain remstwedber-keltbrzsemcd.ru"; content:"|18|remstwedber-keltbrzsemcd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139341; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain retts1rementts1nvestts1ng.info"; content:"|19|retts1rementts1nvestts1ng|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139342; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain returenget60.net"; content:"|0c|returenget60|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139343; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain retybe.net"; content:"|06|retybe|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139344; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain rncswshdrkstbhl-srtmxbchecwskch.su"; content:"|1f|rncswshdrkstbhl-srtmxbchecwskch|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139345; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain road12street12.ru"; content:"|0e|road12street12|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139346; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain rockettc.com"; content:"|08|rockettc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139347; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain rupertnn.cjb.net"; content:"|08|rupertnn|03|cjb|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139348; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ruskypower.net.in"; content:"|0a|ruskypower|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139349; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain salapali.com"; content:"|08|salapali|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139350; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain securebrowsing.from-de.com"; content:"|0e|securebrowsing|07|from-de|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139351; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain security-suites.com"; content:"|0f|security-suites|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139352; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sergeevs.net"; content:"|08|sergeevs|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139353; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sex-anal-tits.com"; content:"|0d|sex-anal-tits|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139354; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain siriusprojbck.net.in"; content:"|0d|siriusprojbck|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139355; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sleemst.ru"; content:"|07|sleemst|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139356; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain smart2xchange.ru"; content:"|0d|smart2xchange|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139357; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain smartcaller.biz"; content:"|0b|smartcaller|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139358; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sna.paradoxnet.ru"; content:"|03|sna|0a|paradoxnet|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139359; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sobakivatokatifree.net"; content:"|12|sobakivatokatifree|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139360; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain soop.mgupi.ru"; content:"|04|soop|05|mgupi|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139361; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain spl.privathosting.eu"; content:"|03|spl|0d|privathosting|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139362; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain spyhugol.strangled.net"; content:"|08|spyhugol|09|strangled|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139363; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sqwed.net"; content:"|05|sqwed|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139364; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain srviceebesst.com"; content:"|0c|srviceebesst|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139365; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ssksjfjghgnvjffrccf.com"; content:"|13|ssksjfjghgnvjffrccf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139366; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sslverisign.ru"; content:"|0b|sslverisign|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139367; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain steelbridge-llc.co.uk"; content:"|0f|steelbridge-llc|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139368; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain stervyatniks.ru"; content:"|0c|stervyatniks|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139369; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain stopbullets2000.biz"; content:"|0f|stopbullets2000|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139370; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain storeapi.biz"; content:"|08|storeapi|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139371; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sweeeetybe.kz"; content:"|0a|sweeeetybe|02|kz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139372; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain sweeeetybebe.ru"; content:"|0c|sweeeetybebe|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139373; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain swistertwister.ru"; content:"|0e|swistertwister|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139374; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain swordandair2000.ru"; content:"|0f|swordandair2000|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139375; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain t3a4ano.com"; content:"|07|t3a4ano|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139376; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain tearriamarie.aisites.com"; content:"|0c|tearriamarie|07|aisites|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139377; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain tebeda.ru"; content:"|06|tebeda|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139378; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain teenstubegoldb.com"; content:"|0e|teenstubegoldb|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139379; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain testspeeds.ru"; content:"|0a|testspeeds|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139380; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain theimageshare.com"; content:"|0d|theimageshare|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139381; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain tkt-mail.com"; content:"|08|tkt-mail|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139382; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain tmt-mail.com"; content:"|08|tmt-mail|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139383; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain to3rta7nol.com"; content:"|0a|to3rta7nol|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139384; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain tolkachevphoto.ru"; content:"|0e|tolkachevphoto|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139385; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain tr1ple.com"; content:"|06|tr1ple|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139386; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain traffic-4webmaster.com"; content:"|12|traffic-4webmaster|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139387; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain traffka.eu"; content:"|07|traffka|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139388; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain traysus.com"; content:"|07|traysus|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139389; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain triplefun.org"; content:"|09|triplefun|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139390; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain triplenaple2us.ru"; content:"|0e|triplenaple2us|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139391; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain troleybusikoff.ru"; content:"|0e|troleybusikoff|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139392; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain trustebuyshop.com"; content:"|0d|trustebuyshop|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139393; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain tusch.dk"; content:"|05|tusch|02|dk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139394; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ukadevochka.ru"; content:"|0b|ukadevochka|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139395; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain unkvarante.ru"; content:"|0a|unkvarante|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139396; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain uol8.com"; content:"|04|uol8|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139397; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain updatesuitmicrosoft.ws"; content:"|13|updatesuitmicrosoft|02|ws"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139398; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain upmyspeed.ru"; content:"|09|upmyspeed|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139399; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain valentine-suites.com"; content:"|10|valentine-suites|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139400; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain vatasystem.com"; content:"|0a|vatasystem|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139401; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain velobest.ru"; content:"|08|velobest|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139402; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain veslouhoyboy.ru"; content:"|0c|veslouhoyboy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139403; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain vewiews.com"; content:"|07|vewiews|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139404; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain vffbrgbg.com"; content:"|08|vffbrgbg|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139405; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain visitorcounterback.net.in"; content:"|12|visitorcounterback|03|net|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139406; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain vladtoblyad.com"; content:"|0b|vladtoblyad|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139407; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain vnzlashop.tk"; content:"|09|vnzlashop|02|tk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139408; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain vsenormalno.com"; content:"|0b|vsenormalno|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139409; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain vseteplo.ru"; content:"|08|vseteplo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139410; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain waipdns.ru"; content:"|07|waipdns|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139411; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain warmarms.ru"; content:"|08|warmarms|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139412; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain wavone.us"; content:"|06|wavone|02|us"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139413; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain wdf55hoiio3.com"; content:"|0b|wdf55hoiio3|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139414; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain wearsdu4enfarg23.com"; content:"|10|wearsdu4enfarg23|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139415; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain wearsdu4enfarg23ma.com"; content:"|12|wearsdu4enfarg23ma|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139416; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain wearsdu4enfarg27asd.com"; content:"|13|wearsdu4enfarg27asd|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139417; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain webcontrolsday.net"; content:"|0e|webcontrolsday|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139418; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain webpatrol.com.tw"; content:"|09|webpatrol|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139419; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain weraty.biz"; content:"|06|weraty|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139420; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain werestprod.com"; content:"|0a|werestprod|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139421; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain widuop.com"; content:"|06|widuop|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139422; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain work-and-sex.in"; content:"|0c|work-and-sex|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139423; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.2go-inc.com"; content:"|03|www|07|2go-inc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139424; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.alemaloholaadcx.in"; content:"|03|www|0f|alemaloholaadcx|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139425; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.borsgandkotletsplatinum.com"; content:"|03|www|17|borsgandkotletsplatinum|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139426; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.carboxxxs200.biz"; content:"|03|www|0c|carboxxxs200|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139427; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.carboxxxs400.biz"; content:"|03|www|0c|carboxxxs400|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139428; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.cossusffsfecvdsions1212.com"; content:"|03|www|17|cossusffsfecvdsions1212|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139429; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.discount-london-tours.com"; content:"|03|www|15|discount-london-tours|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139430; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.eyesecurr657444.net"; content:"|03|www|0f|eyesecurr657444|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139431; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.guusdirue.net"; content:"|03|www|09|guusdirue|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139432; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.koburana.ru"; content:"|03|www|08|koburana|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139433; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.msonline4.com"; content:"|03|www|09|msonline4|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139434; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.mydarts4you.com"; content:"|03|www|0b|mydarts4you|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139435; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.pr.veslouhoyboy.ru"; content:"|03|www|02|pr|0c|veslouhoyboy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139436; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.privathosting.eu"; content:"|03|www|0d|privathosting|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139437; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.randomcrappy.com"; content:"|03|www|0c|randomcrappy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139438; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.tmplookup.com"; content:"|03|www|09|tmplookup|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139439; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain www.topedu.cn"; content:"|03|www|06|topedu|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139440; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain wwww.romarioflying.ru"; content:"|04|wwww|0d|romarioflying|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139441; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain wyphona.com"; content:"|07|wyphona|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139442; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain wzk.laweb.es"; content:"|03|wzk|05|laweb|02|es"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139443; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain xe-11-0-0.edge1.losangeles6.levei-3.net"; content:"|09|xe-11-0-0|05|edge1|0b|losangeles6|07|levei-3|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139444; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain xokl1.com"; content:"|05|xokl1|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139445; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain yalupa.com"; content:"|06|yalupa|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139446; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain yandex2012.ru"; content:"|0a|yandex2012|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139447; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain yankloods.com"; content:"|09|yankloods|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139448; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain ygla.ru"; content:"|04|ygla|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139449; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain yoga-info.com.ua"; content:"|09|yoga-info|03|com|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139450; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain yourjerkybeaf.ru"; content:"|0d|yourjerkybeaf|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139451; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain yuckymud.ru"; content:"|08|yuckymud|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139452; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain z43b1z.eu"; content:"|06|z43b1z|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139453; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain zaebiz.eu"; content:"|06|zaebiz|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139454; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain zipgate.ru"; content:"|07|zipgate|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139455; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain zxr0.chickenkiller.com"; content:"|04|zxr0|0d|chickenkiller|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139456; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.SpyEye domain zxr0.strangled.net"; content:"|04|zxr0|09|strangled|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,SpyEyetracker.abuse.ch/blocklist.php; sid:1139457; rev:3;)